Understanding Bot Traffic

Traffic Classifications

BotGuard for Applications classifies all traffic as valid (VAL), bot (BOT), or nonstandard (NSD). Each category reflects HUMAN’s decision about the authenticity of a specific interaction. Additionally, bot and nonstandard traffic is labeled with a reason code that provides further insight into the behavior observed for that interaction.

This traffic can be viewed in the Dashboard under the Traffic Time Series chart.

BotGuard for Applications flags an interaction as a bot if that interaction shows irrefutable signs of automation. HUMAN maintains strict requirements to maintain a precision threshold of >99% for all bot-designated activity. We recommend blocking or mitigating all bot traffic (with the exception of known, safe bots, like internal automation tools and search engine crawlers).

BotGuard for Applications flags an interaction as nonstandard if that interaction displays certain suspicious traits that indicate automation but do not meet the 99% precision threshold. While legitimate users with unusual configurations (e.g. outdated devices) can sometimes be flagged as nonstandard, this traffic still has a high probability of being a bot. Although your response strategy will vary based on your specific use case and threat model, we generally recommend flagging these transactions as high-risk rather than blocking nonstandard traffic altogether. Your HUMAN Customer Success Manager can help identify the most appropriate action to meet your needs.

Threat Categories & Taxonomies

Bot and nonstandard traffic on your site can further be broken down into threat categories. These categories provide insight into why the traffic was marked as a bot or nonstandard.

SeeTaxonomy for a breakdown of what each reason code and threat category means.

The Threat Category Time Series chart shows a view of bot and nonstandard traffic over a period of time. This allows you to visualize trends and spikes in traffic that pose a threat to your application.

You can also filter this view to only show bot traffic or click to drill down on specific data points to understand more about individual spikes.

A breakdown of traffic by threat category is also available.