Machine Learning

What is Machine Learning?

Machine learning is building a model from examples rather than writing the rules by hand. Given enough labelled cases, a model learns the patterns that separate them and applies that to cases it has not seen.

In bot detection it is used for exactly one thing: combining many weak signals into a single verdict. No individual signal — a straight mouse path, a data-centre address, an unusual font list — settles anything. The useful question is what the whole set implies together, and that is a task models do better than hand-written thresholds.

Where it genuinely helps

• Weighting signals against each other. A data-centre IP matters much less when the behaviour is clearly human, and much more when combined with browser contradictions. Rules struggle to express that; models handle it naturally.
• Finding combinations nobody specified. A particular pairing of timing and browser properties may be a reliable tell without anyone having noticed it.
• Scoring rather than deciding. A continuous score lets you set a threshold per endpoint — strict on checkout, relaxed on a blog post — instead of one global verdict.

Where it is oversold

Three limitations that matter more than the technique:

Labels are the bottleneck, not the algorithm. Supervised learning needs confirmed cases, and in bot detection confirmation often takes weeks — a chargeback, an abuse report, a scalped ticket that resurfaces on a resale site. A model trained on labels that arrive months late is always learning yesterday's attack.

Baselines absorb the problem. If a share of historical traffic was already automated, it sits in the "normal" class and the model learns that automation is normal. On sites with a long-standing scraping or scalping problem this is the default situation, not an edge case.

It is beaten by simple rules more often than vendors admit. Measured honestly against a holdout set, a handful of well-chosen deterministic checks — a response faster than human reaction time, a browser contradicting itself — frequently outperform a model, because they encode impossibilities rather than tendencies.

What this implies for design

Use models for the weighing, and keep the decisive signals deterministic.

A physical impossibility does not need a probability attached. A client that answered before the page painted, or that claims Safari on iOS while exposing a Chrome-only API, has produced a contradiction — and a rule that says so is explainable to a customer who asks why they were blocked, which a model's score is not.

That explainability is also a buying criterion worth applying to vendors. Forrester marked the sector down on it in its 2026 Wave, and the practical version of the question is simple: when a real customer is blocked, can the vendor tell you which signal did it?

Prosopo uses models where weighing is needed and deterministic checks where the evidence is conclusive. The mix is deliberate, because a verdict you cannot explain is a verdict you cannot defend.