Proactive Feature Detection

• Currently, proactive feature detection can check traffic of websites that are connected to WAF in cloud CNAME access mode or dedicated mode. Currently, proactive feature detection is not supported in cloud load balance access mode.
• Currently, proactive feature detection supports only web browser services. Before enabling this function, ensure that the protected object is a browser client. Alternatively, configure matching conditions to ensure that the resources can be accessed only by web browsers. Otherwise, mobile app access may be affected.
• Currently, proactive feature detection supports only origin server HTML pages that are encoded using UTF8. To keep normal access to origin servers unaffected, ensure that UTF8 is used for encoding HTML packets and Content-Type is HTML for origin servers before enabling this function.

Proactive feature detection is the fourth phase during bot detection. The system injects JavaScript code into HTML responses to monitor and verify the client browser's runtime environment, including keyboard and mouse interaction behaviors. In this way, the system can identify requests from tools and normal requests, and handle bot attacks based on the interaction confidence and protective action.

Interaction confidence indicates the frequency of interactions (such as keyboard and mouse operations) generated by a client within a period of time. A lower confidence level indicates a lower frequency of client interactions and a higher probability that the client is an automation program. A higher confidence level indicates a higher probability that the client initiates a normal operation.

The confidence levels are as follows:

• Skip: Do not detect interactions. For example, if you enable proactive feature detection rules and set the interaction confidence to Skip, the system does not count the keyboard and mouse interactions of the client. If the interaction confidence is set to a low value, the client that has no keyboard and mouse interactions generated will be blocked.
• High: More than 10 interactions are generated within 600s.
• Medium: More than 5 interactions are generated within 600s.
• Low: More than 0 interactions are generated within 600s.