BOT Type | Impact |
Malicious scanner | This type of BOT automatically scans websites and services on the internet for known vulnerabilities and weaknesses, which may lead to security issues such as unauthorized access, data leakage, or denial-of-service attacks. |
Spam | This type of BOT is used to send spam, which may contain advertisements, malicious links, or phishing emails. It may cause users to receive a large amount of spam, affecting user experience, and may also lead to security issues such as fraud or malware propagation. |
DDoS | This type of BOT is used to launch distributed denial-of-service attacks, which may cause the target website or service to become paralyzed, affecting normal user access and causing significant losses to the victim. |
Social | This type of BOT is used to automatically publish, like, follow, and comment on social media platforms, which may lead to inaccurate data on the platforms and cause damage to normal users and the social platforms themselves. |
Web crawlers | This type of BOT is used to crawl and index website content. Excessive crawling may cause high server load, affect website performance, and even lead to the theft of sensitive data. |
Field Type | Field | Field Description |
Scope | Request path | Request URL scope for policy enforcement |
| HOST | Domain scope of client requests where the policy is effective |
Request content | Header value | Specific value of a parameter in an HTTP request |
| GET parameter value | Specific value of a query string parameter passed to the server via the GET method |
| POST parameter value | Specific value of a form field or a parameter in the request body submitted to the server via the POST method |
| COOKIE parameter value | Specific value of a Cookie set by the Set-Cookie header in HTTP |
Session feature | Average session speed | Session average speed = Total number of sessions / Session duration |
| Total sessions | Total number of visits within a session |
| Session duration | Session duration = Session end time - Session start time |
| Robots.txt. | Whether a url containing robots.txt exists within the session. |
Request characteristics | Most used URL | The most frequently requested URL is the specified URL. |
| URL duplication | URL duplication ratio = Number of occurrences of the most frequently requested URL / Total number of requests within the session |
| Total URL types | Number of unique URLs after deduplication within a session. |
| Requested parameters | Most frequently requested parameter is the specified parameter. |
| Most used parameter | Parameter duplication ratio = Number of occurrences of the most frequently requested parameter / Total number of requests within the session |
COOKIE | COOKIE duplication rate | (Number of non-empty cookies - Number of cookie types) / Number of non-empty cookies |
| COOKIE exist | Number of non-empty cookies / Total number of requests within the session |
| COOKIE abuse | Whether COOKIE abuse exists. |
| Most used COOKIE | The most frequently occurring Cookie within a session is the specified Cookie. |
HTTP Header | Request method | Proportion of occurrence counts for each request method within a session |
| HTTP protocol version | Proportion of occurrence counts for each HTTP protocol version within a session. |
| Status code | Proportion of occurrence counts for each return status code within a session. |
IP address Characteristics | Access source IP | Source IP address of the request |
| IP type | Type of the source IP address, classified based on threat intelligence tags |
| IP owner | Internet service provider (ISP) of the source IP address |
| IP contains session count | Number of sessions per source IP address |
| IP location | Geographic region of the source IP address |
UserAgent | Most used UA | The most frequently requested UA is the specified UA. |
| UA type | Number of UA types within a session |
| UA exist | Number of non-empty UAs / Total number of requests within the session |
| UA type | UA type, classified according to the different UA types defined in the UA policy. |
| UA randomness index | Variance of UA frequencies, measuring the degree of dispersion. |
Referer | Most used Referer | The most frequently requested Referer is the specified Referer. |
| Percentage of repeated Referers | (Number of non-empty Referers - Number of Referer types) / Number of non-empty Referers |
| Referer exist | Number of non-empty Referers / Total number of requests within the session |
| Referer abuse | Referer abuse or not |
Session Settings | Session ID exists | token existence or not |
| Session ID | token value |
| Session IPs | Number of IPs contained within a session request. |
Action Type | Description |
Monitor | Session requests that meet the matching conditions will be monitored and logged. You can view the monitored session information under Custom Types in BOT Details. |
JS validation | Requests that meet the matching conditions will undergo JavaScript validation and have their logs recorded. Note: JS Validation is supported only in the Enterprise edition and above. If your current edition does not support it, upgrade your WAF edition first. For details, see WAF Plan Upgrade Method. |
Redirection to | Session requests that meet the matching conditions are redirected to a specified URL. However, redirection is only supported to URLs under the current domain. |
CAPTCHA | Applicable only to browser access scenarios. Session requests that meet the matching conditions will undergo a Captcha challenge. If the challenge fails, the request is intercepted. If the challenge succeeds, the request proceeds with normal access. Click Advanced settings next to Human-machine recognition to configure the number of Captcha retry attempts, releasing duration, and interception duration. Note: The CAPTCHA feature includes three verification methods: slider CAPTCHA, Frictionless verification, and Voice Verification Captcha. Voice Verification Captcha is supported only in non-Chinese mainland regions. |
Block | Session requests that meet the matching conditions will be intercepted. The interception results can be checked in Attack Logs, and real-time information about blocked IP addresses can be viewed in IP Block Status. When you select the interception action, you can set the response page content returned to requests matching the rule and customize the return page. |
Trust | Session requests that meet the matching conditions will be allowed without logging. |
Delay penalty | Session requests that meet the matching conditions will be penalized by the WAF for a period of time. Subsequent requests during the penalty period will be blocked. Normal access automatically resumes after the penalty period ends. Configure the penalty duration, which supports a range of 1-5000 milliseconds. After you enable the delay penalty, the request response time increases. Therefore, configure it appropriately based on the request timeout settings of your business. |
Multi-action hybrid policy | Configure multiple action types and set differentiated handling actions for different effective scopes. |
Tag type | Description |
Normal | Identifies access traffic as normal human-generated traffic. |
Friendly bot | Identifies the traffic from this access source as a friendly/legitimate BOT. Note: Friendly BOTs have the highest priority. When a match occurs, the traffic is directly released and bypasses all subsequent BOT detection rules. |
Suspicious bot | The traffic from this access source is suspected to be BOT, but it cannot be determined whether it is harmful to the website. |
Malicious bot | Identifies the traffic from this access source as a BOT that generates malicious traffic/unfriendly access requests to the website. |
Tag type | Description |
Permanent | Permanent |
Scheduled Effectiveness | Takes effect according to the specified time period each day. |
Weekly Granularity Effective | Takes effect on specific days and time periods each week. |
Monthly Granularity Effective | Takes effect on specific dates and time periods each month. |
피드백