Enterprise Web Security with Cloudflare WAF and DDoS Protection#

1
Traditional WAF/DDoS Solutions:
2
  hardware_appliances:
3
    - High upfront costs ($50K-$500K+)
4
    - Limited throughput capacity
5
    - Complex maintenance and updates
6
    - Single points of failure
7

8
  cloud_solutions:
9
    - Per-GB bandwidth charges
10
    - Limited geographic coverage
11
    - Latency impact from scrubbing centers
12
    - Manual rule management overhead
13

14
  security_gaps:
15
    - Signature-based detection only
16
    - No machine learning capabilities
17
    - Limited bot detection accuracy
18
    - Reactive rather than proactive defense

1
// Core managed rulesets configuration
2
const managedRulesets = {
3
  // OWASP Core Rule Set - Most comprehensive
4
  owasp_core_ruleset: {
5
    id: "efb7b8c949ac4650a09736fc376e9aee",
6
    enabled: true,
7
    action: "challenge", // or "block", "log", "managed_challenge"
8
    sensitivity: "medium", // low, medium, high
9

10
    // Override specific rules
11
    overrides: [
12
      {
13
        rule_id: "100001", // SQL Injection detection
14
        action: "block",
15
        enabled: true
16
      },
17
      {
18
        rule_id: "100002", // XSS detection
19
        action: "challenge",
20
        enabled: true
21
      },
22
      {
23
        rule_id: "100003", // File inclusion
24
        action: "block",
25
        enabled: true
26
      }
27
    ]
28
  },
29

30
  // Cloudflare Managed Ruleset
31
  cloudflare_managed: {
32
    id: "4814384a9e5d4991b9815dcfc25d2f1f",
33
    enabled: true,
34
    action: "challenge",
35

36
    categories: [
37
      {
38
        category: "wordpress",
39
        enabled: true,
40
        action: "block" // Aggressive blocking for WordPress attacks
41
      },
42
      {
43
        category: "drupal",
44
        enabled: true,
45
        action: "challenge"
46
      },
47
      {
48
        category: "joomla",
49
        enabled: false // Disable if not using Joomla
50
      }
51
    ]
52
  },
53

54
  // Cloudflare Exposed Credentials Check
55
  exposed_credentials: {
56
    id: "c2e184081120413c86c3ab7e14069605",
57
    enabled: true,
58
    action: "managed_challenge",
59

60
    // Custom response for credential stuffing
61
    response: {
62
      content_type: "application/json",
63
      body: {
64
        error: "Account security check required",
65
        action_required: "Please verify your identity"
66
      }
67
    }
68
  }
69
};
70

71
// API configuration using Terraform
72
const wafConfig = `
73
resource "cloudflare_ruleset" "waf_managed_rules" {
74
  zone_id  = var.zone_id
75
  name     = "WAF Managed Rules"
76
  kind     = "zone"
77
  phase    = "http_request_firewall_managed"
78

79
  rules {
80
    action = "execute"
81
    expression = "true"
82

83
    action_parameters {
84
      id = "efb7b8c949ac4650a09736fc376e9aee" # OWASP
85
      overrides {
86
        categories {
87
          category = "sqli"
88
          action   = "block"
89
          enabled  = true
90
        }
91

92
        categories {
93
          category = "xss"
94
          action   = "challenge"
95
          enabled  = true
96
        }
97

98
        rules {
99
          id      = "100001"
100
          action  = "block"
101
          enabled = true
102
        }
103
      }
104
    }
105
  }
106
}`;

1
// Advanced custom WAF rules
2
const customWafRules = [
3
  {
4
    name: "Block Known Attack Patterns",
5
    expression: `
6
      (http.request.uri.path contains "/wp-admin" and not cf.threat_score < 10) or
7
      (http.request.uri.path contains "/admin" and http.request.method eq "POST" and not cf.bot_management.verified_bot) or
8
      (http.request.uri.query contains "union select" or http.request.body contains "union select") or
9
      (http.request.uri.query contains "../" and http.request.uri.query contains "etc/passwd") or
10
      (http.request.headers["user-agent"] eq "" or http.request.headers["user-agent"] contains "sqlmap")
11
    `,
12
    action: "block",
13
    enabled: true,
14
    description: "Block common attack patterns and tools"
15
  },
16

17
  {
18
    name: "API Rate Limiting Enhanced",
19
    expression: `
20
      http.request.uri.path matches "^/api/" and
21
      (
22
        (rate(1m) > 100 and cf.threat_score > 15) or
23
        (rate(10m) > 500 and not cf.bot_management.verified_bot) or
24
        (rate(1h) > 2000)
25
      )
26
    `,
27
    action: "challenge",
28
    enabled: true,
29
    description: "Adaptive API rate limiting based on threat score"
30
  },
31

32
  {
33
    name: "Geo-based Access Control",
34
    expression: `
35
      http.request.uri.path matches "^/(admin|wp-admin|administrator)/" and
36
      not ip.geoip.country in {"US" "CA" "GB" "DE" "FR" "AU"} and
37
      cf.threat_score > 5
38
    `,
39
    action: "challenge",
40
    enabled: true,
41
    description: "Restrict admin access to trusted countries"
42
  },
43

44
  {
45
    name: "Advanced Bot Detection",
46
    expression: `
47
      (
48
        cf.bot_management.score < 30 and
49
        not cf.bot_management.verified_bot and
50
        (
51
          http.request.uri.path contains "/login" or
52
          http.request.uri.path contains "/register" or
53
          http.request.uri.path contains "/checkout"
54
        )
55
      ) or
56
      (
57
        cf.bot_management.ja3_hash in {"hash1" "hash2" "hash3"} and
58
        cf.threat_score > 20
59
      )
60
    `,
61
    action: "managed_challenge",
62
    enabled: true,
63
    description: "Challenge suspicious bot traffic on sensitive endpoints"
64
  },
65

66
  {
67
    name: "File Upload Protection",
68
    expression: `
69
      http.request.method eq "POST" and
70
      http.request.uri.path matches "^/upload" and
71
      (
72
        http.request.headers["content-type"] contains "application/x-php" or
73
        http.request.headers["content-type"] contains "text/x-script" or
74
        http.request.body contains "<?php" or
75
        http.request.body contains "<script"
76
      )
77
    `,
78
    action: "block",
79
    enabled: true,
80
    description: "Block malicious file upload attempts"
81
  },
82

83
  {
84
    name: "OWASP Top 10 Custom Rules",
85
    expression: `
86
      (
87
        # SQL Injection patterns
88
        http.request.uri.query matches ".*('|(\\\\x27))|((\"|\\\\x22))" or
89
        http.request.uri.query matches ".*(union|select|insert|delete|drop|create|alter|exec|execute)" or
90

91
        # XSS patterns
92
        http.request.uri.query matches ".*<[^>]*script[^>]*>.*" or
93
        http.request.uri.query matches ".*(javascript:|vbscript:|onload=|onerror=)" or
94

95
        # Command Injection
96
        http.request.uri.query matches ".*(\\\\x00|\\\\x04|\\\\x1a)" or
97
        http.request.uri.query matches ".*(\\\\|\\\\\\\\|\\/|\\/\\/).*" or
98

99
        # Path Traversal
100
        http.request.uri.path matches ".*(\\.\\.\\/|\\.\\.\\\\\\\\" or
101

102
        # XXE Prevention
103
        http.request.body contains "<!ENTITY" or
104
        http.request.body contains "<!DOCTYPE"
105
      )
106
    `,
107
    action: "block",
108
    enabled: true,
109
    description: "Custom OWASP Top 10 vulnerability protection"
110
  }
111
];
112

113
// Terraform configuration for custom rules
114
const customRulesToTerraform = `
115
resource "cloudflare_ruleset" "waf_custom_rules" {
116
  zone_id  = var.zone_id
117
  name     = "WAF Custom Rules"
118
  kind     = "zone"
119
  phase    = "http_request_firewall_custom"
120

121
  ${customWafRules.map((rule, index) => `
122
  rules {
123
    action = "${rule.action}"
124
    expression = "${rule.expression}"
125
    description = "${rule.description}"
126
    enabled = ${rule.enabled}
127
  }`).join('\n')}
128
}`;

1
// Advanced sensitivity configuration
2
const sensitivityConfig = {
3
  // High security environments (financial, healthcare)
4
  high_security: {
5
    paranoia_level: 4,
6
    blocking_threshold: 1, // Block on single rule match
7
    anomaly_threshold: 5,
8
    sql_injection_threshold: 1,
9
    xss_threshold: 1,
10

11
    custom_thresholds: {
12
      "932100": 1, // Application Attack: LFI
13
      "932110": 1, // Application Attack: RFI
14
      "932160": 1, // Remote Command Execution
15
      "933100": 1, // PHP Injection Attack
16
      "942100": 1, // SQL Injection Attack
17
      "941100": 1  // XSS Attack
18
    }
19
  },
20

21
  // Standard environments (e-commerce, SaaS)
22
  standard_security: {
23
    paranoia_level: 2,
24
    blocking_threshold: 3,
25
    anomaly_threshold: 10,
26
    sql_injection_threshold: 3,
27
    xss_threshold: 3,
28

29
    custom_thresholds: {
30
      "932100": 3,
31
      "942100": 2, // More sensitive to SQL injection
32
      "941100": 3
33
    }
34
  },
35

36
  // Development environments
37
  development: {
38
    paranoia_level: 1,
39
    blocking_threshold: 5,
40
    anomaly_threshold: 15,
41
    action: "log", // Log only, don't block
42

43
    excluded_rules: [
44
      "932100", // Disable LFI detection for dev
45
      "933100"  // Disable PHP injection for dev
46
    ]
47
  }
48
};
49

50
// Dynamic rule adjustment based on traffic patterns
51
const adaptiveRules = `
52
// Increase sensitivity during attack patterns
53
if (attack_score > 50 && false_positive_rate < 0.1) {
54
  sensitivity = "high";
55
  blocking_threshold = 1;
56
} else if (false_positive_rate > 0.5) {
57
  // Reduce sensitivity if too many false positives
58
  sensitivity = "low";
59
  blocking_threshold = 5;
60
}
61

62
// Time-based adjustments
63
if (time_of_day >= 22 || time_of_day <= 6) {
64
  // More aggressive blocking during off-hours
65
  blocking_threshold = blocking_threshold * 0.5;
66
}
67

68
// Geographic adjustments
69
if (country_risk_score > 7) {
70
  blocking_threshold = blocking_threshold * 0.7;
71
}`;

1
# Autonomous DDoS Protection Configuration
2
ddos_l3_l4_protection:
3
  # Automatic detection and mitigation
4
  autonomous_system:
5
    enabled: true
6
    sensitivity: "high"  # high, medium, low
7

8
  # Volumetric attack protection
9
  volumetric_protection:
10
    pps_threshold: 1000000    # 1M packets per second
11
    bps_threshold: 10000000000 # 10 Gbps
12
    connection_threshold: 100000
13

14
  # Protocol-specific settings
15
  protocols:
16
    tcp:
17
      syn_flood_protection: true
18
      rst_flood_protection: true
19
      ack_flood_protection: true
20
      connection_rate_limit: 1000 # per second per IP
21

22
    udp:
23
      flood_protection: true
24
      reflection_mitigation: true
25
      amplification_protection: true
26
      rate_limit: 10000 # packets per second
27

28
    icmp:
29
      flood_protection: true
30
      rate_limit: 100 # per second per IP
31
      block_ping_of_death: true
32

33
  # Advanced detection methods
34
  detection_methods:
35
    - behavioral_analysis
36
    - machine_learning
37
    - statistical_analysis
38
    - signature_based
39
    - reputation_based
40

41
  # Mitigation techniques
42
  mitigation_techniques:
43
    - rate_limiting
44
    - connection_limiting
45
    - traffic_shaping
46
    - blackholing
47
    - challenge_response

1
// HTTP DDoS Protection Rules
2
const httpDdosRules = [
3
  {
4
    name: "HTTP Flood Protection",
5
    description: "Detect and mitigate HTTP flood attacks",
6

7
    detection_criteria: {
8
      requests_per_second: {
9
        threshold: 100,
10
        window: "1m",
11
        per_source_ip: true
12
      },
13

14
      pattern_analysis: {
15
        same_user_agent: true,
16
        same_referer: true,
17
        same_accept_header: true,
18
        missing_headers: ["accept-encoding", "accept-language"]
19
      },
20

21
      behavioral_indicators: {
22
        no_javascript_execution: true,
23
        no_cookie_support: true,
24
        linear_request_pattern: true,
25
        identical_timing: true
26
      }
27
    },
28

29
    mitigation_actions: [
30
      {
31
        condition: "initial_detection",
32
        action: "javascript_challenge",
33
        duration: "5m"
34
      },
35
      {
36
        condition: "challenge_failed",
37
        action: "captcha_challenge",
38
        duration: "30m"
39
      },
40
      {
41
        condition: "repeated_failures",
42
        action: "block",
43
        duration: "24h"
44
      }
45
    ]
46
  },
47

48
  {
49
    name: "Slowloris Protection",
50
    description: "Detect slow HTTP attacks",
51

52
    detection_criteria: {
53
      connection_duration: {
54
        threshold: "30s",
55
        incomplete_requests: true
56
      },
57

58
      request_rate: {
59
        threshold: 1, # Very slow request rate
60
        window: "10s"
61
      },
62

63
      header_completion: {
64
        timeout: "15s"
65
      }
66
    },
67

68
    mitigation_actions: [
69
      {
70
        condition: "slow_request_detected",
71
        action: "connection_timeout",
72
        timeout: "10s"
73
      },
74
      {
75
        condition: "multiple_slow_connections",
76
        action: "rate_limit",
77
        limit: "5 connections per IP"
78
      }
79
    ]
80
  },
81

82
  {
83
    name: "Application Layer DoS",
84
    description: "Protect expensive application endpoints",
85

86
    targets: [
87
      "/api/search",
88
      "/api/report/generate",
89
      "/upload",
90
      "/convert"
91
    ],
92

93
    protection_rules: [
94
      {
95
        endpoint: "/api/search",
96
        max_requests_per_minute: 60,
97
        complexity_analysis: true,
98
        query_length_limit: 1000
99
      },
100
      {
101
        endpoint: "/api/report/generate",
102
        max_requests_per_hour: 10,
103
        require_authentication: true,
104
        queue_requests: true
105
      }
106
    ]
107
  }
108
];
109

110
// Terraform configuration
111
const ddosProtectionConfig = `
112
resource "cloudflare_ruleset" "ddos_l7_protection" {
113
  zone_id = var.zone_id
114
  name    = "HTTP DDoS Protection"
115
  kind    = "zone"
116
  phase   = "ddos_l7"
117

118
  rules {
119
    action = "challenge"
120
    expression = "(cf.ddos.http_score gt 50)"
121
    description = "Challenge suspicious HTTP traffic"
122

123
    action_parameters {
124
      phases = ["ddos_l7"]
125
      products = ["ddos"]
126
    }
127
  }
128

129
  rules {
130
    action = "block"
131
    expression = "(cf.ddos.http_score gt 80)"
132
    description = "Block obvious DDoS traffic"
133
  }
134
}`;

1
# Python script for advanced DDoS analytics
2
import requests
3
import json
4
import time
5
from datetime import datetime, timedelta
6

7
class CloudflareDDoSAnalyzer:
8
    def __init__(self, api_token, zone_id):
9
        self.api_token = api_token
10
        self.zone_id = zone_id
11
        self.base_url = "https://api.cloudflare.com/client/v4"
12
        self.headers = {
13
            "Authorization": f"Bearer {api_token}",
14
            "Content-Type": "application/json"
15
        }
16

17
    def get_ddos_analytics(self, hours=24):
18
        """Get DDoS attack analytics"""
19
        end_time = datetime.utcnow()
20
        start_time = end_time - timedelta(hours=hours)
21

22
        params = {
23
            "start": start_time.isoformat() + "Z",
24
            "end": end_time.isoformat() + "Z",
25
            "metrics": "requests,bytes,threats",
26
            "dimensions": "attackType,mitigationType,country"
27
        }
28

29
        response = requests.get(
30
            f"{self.base_url}/zones/{self.zone_id}/analytics/ddos",
31
            headers=self.headers,
32
            params=params
33
        )
34

35
        return response.json()
36

37
    def detect_attack_patterns(self, analytics_data):
38
        """Analyze patterns in DDoS attacks"""
39
        patterns = {
40
            "attack_types": {},
41
            "source_countries": {},
42
            "peak_times": [],
43
            "mitigation_effectiveness": {}
44
        }
45

46
        for datapoint in analytics_data.get("result", []):
47
            # Analyze attack types
48
            attack_type = datapoint.get("attackType", "unknown")
49
            patterns["attack_types"][attack_type] = patterns["attack_types"].get(attack_type, 0) + 1
50

51
            # Track source countries
52
            country = datapoint.get("country", "unknown")
53
            patterns["source_countries"][country] = patterns["source_countries"].get(country, 0) + 1
54

55
            # Analyze mitigation effectiveness
56
            mitigation = datapoint.get("mitigationType", "unknown")
57
            requests_mitigated = datapoint.get("requests_mitigated", 0)
58
            patterns["mitigation_effectiveness"][mitigation] = patterns["mitigation_effectiveness"].get(mitigation, 0) + requests_mitigated
59

60
        return patterns
61

62
    def create_adaptive_rules(self, patterns):
63
        """Create adaptive DDoS protection rules based on patterns"""
64
        rules = []
65

66
        # Create country-based rules for repeat offenders
67
        top_attack_countries = sorted(
68
            patterns["source_countries"].items(),
69
            key=lambda x: x[1],
70
            reverse=True
71
        )[:5]
72

73
        for country, attack_count in top_attack_countries:
74
            if attack_count > 100:  # Threshold for adaptive blocking
75
                rule = {
76
                    "expression": f'ip.geoip.country eq "{country}" and cf.threat_score gt 20',
77
                    "action": "challenge",
78
                    "description": f"Adaptive rule for high-risk country: {country}"
79
                }
80
                rules.append(rule)
81

82
        # Create time-based rules for peak attack times
83
        for peak_time in patterns.get("peak_times", []):
84
            rule = {
85
                "expression": f'cf.ddos.http_score gt 30 and http.request.timestamp.hour eq {peak_time}',
86
                "action": "challenge",
87
                "description": f"Enhanced protection during peak attack time: {peak_time}:00"
88
            }
89
            rules.append(rule)
90

91
        return rules
92

93
    def implement_adaptive_rules(self, rules):
94
        """Deploy adaptive rules to Cloudflare"""
95
        ruleset_data = {
96
            "name": "Adaptive DDoS Protection",
97
            "kind": "zone",
98
            "phase": "http_request_firewall_custom",
99
            "rules": rules
100
        }
101

102
        response = requests.post(
103
            f"{self.base_url}/zones/{self.zone_id}/rulesets",
104
            headers=self.headers,
105
            json=ruleset_data
106
        )
107

108
        return response.json()
109

110
    def run_adaptive_protection(self):
111
        """Main function to run adaptive DDoS protection"""
112
        print("Fetching DDoS analytics...")
113
        analytics = self.get_ddos_analytics(hours=72)  # 3 days of data
114

115
        print("Analyzing attack patterns...")
116
        patterns = self.detect_attack_patterns(analytics)
117

118
        print("Creating adaptive rules...")
119
        rules = self.create_adaptive_rules(patterns)
120

121
        if rules:
122
            print(f"Deploying {len(rules)} adaptive rules...")
123
            result = self.implement_adaptive_rules(rules)
124
            print(f"Adaptive rules deployed: {result}")
125
        else:
126
            print("No adaptive rules needed at this time.")
127

128
        return patterns, rules
129

130
# Usage
131
analyzer = CloudflareDDoSAnalyzer("your-api-token", "your-zone-id")
132
patterns, rules = analyzer.run_adaptive_protection()

1
// Comprehensive bot management configuration
2
const botManagementRules = [
3
  {
4
    name: "Verified Bots Allow",
5
    description: "Allow verified good bots (Google, Bing, etc.)",
6
    expression: "cf.bot_management.verified_bot",
7
    action: "allow",
8
    priority: 1,
9
    enabled: true
10
  },
11

12
  {
13
    name: "Low Bot Score Block",
14
    description: "Block obvious bad bots",
15
    expression: "cf.bot_management.score lt 10 and not cf.bot_management.verified_bot",
16
    action: "block",
17
    priority: 2,
18
    enabled: true
19
  },
20

21
  {
22
    name: "Medium Bot Score Challenge",
23
    description: "Challenge suspicious bot activity",
24
    expression: `
25
      cf.bot_management.score ge 10 and cf.bot_management.score lt 30 and
26
      not cf.bot_management.verified_bot and
27
      (
28
        http.request.uri.path matches "^/(login|register|checkout|api)" or
29
        http.request.method eq "POST"
30
      )
31
    `,
32
    action: "managed_challenge",
33
    priority: 3,
34
    enabled: true
35
  },
36

37
  {
38
    name: "API Bot Protection",
39
    description: "Protect API endpoints from bot abuse",
40
    expression: `
41
      http.request.uri.path matches "^/api/" and
42
      (
43
        (cf.bot_management.score lt 50 and not cf.bot_management.verified_bot) or
44
        (rate(1m) gt 100 and cf.bot_management.score lt 80)
45
      )
46
    `,
47
    action: "challenge",
48
    priority: 4,
49
    enabled: true
50
  },
51

52
  {
53
    name: "Form Submission Protection",
54
    description: "Protect forms from automated submissions",
55
    expression: `
56
      http.request.method eq "POST" and
57
      (
58
        http.request.uri.path contains "/contact" or
59
        http.request.uri.path contains "/newsletter" or
60
        http.request.uri.path contains "/comment"
61
      ) and
62
      cf.bot_management.score lt 50
63
    `,
64
    action: "managed_challenge",
65
    priority: 5,
66
    enabled: true
67
  },
68

69
  {
70
    name: "Scraping Protection",
71
    description: "Detect and block content scraping",
72
    expression: `
73
      (
74
        cf.bot_management.score lt 40 and
75
        rate(1m) gt 50 and
76
        http.request.headers["accept"] contains "text/html"
77
      ) or
78
      (
79
        # Detect scraping patterns
80
        http.user_agent contains "python" or
81
        http.user_agent contains "curl" or
82
        http.user_agent contains "wget" or
83
        http.user_agent contains "scrapy"
84
      ) and not cf.bot_management.verified_bot
85
    `,
86
    action: "challenge",
87
    priority: 6,
88
    enabled: true
89
  }
90
];
91

92
// Advanced bot detection using JA3 fingerprinting
93
const ja3FingerprintingRules = [
94
  {
95
    name: "Suspicious JA3 Hashes",
96
    description: "Block known malicious JA3 TLS fingerprints",
97
    expression: `
98
      cf.bot_management.ja3_hash in {
99
        "a441b15a2e27b56b23e6e0f90b60e78e",
100
        "72a589da586844d7f0818ce684948eea",
101
        "b32309a26951912be7dba376398abc3b"
102
      }
103
    `,
104
    action: "block",
105
    enabled: true
106
  },
107

108
  {
109
    name: "Automated Tool Detection",
110
    description: "Detect automated tools by JA3 + User-Agent mismatch",
111
    expression: `
112
      (
113
        cf.bot_management.ja3_hash eq "769,47-53-5-10-49171-49172-49161-49162-49,0-10-11,23-24,0" and
114
        not http.user_agent matches "Mozilla.*Chrome"
115
      ) or
116
      (
117
        http.user_agent contains "Chrome" and
118
        cf.bot_management.ja3_hash in {"curl_ja3_hash", "python_requests_ja3"}
119
      )
120
    `,
121
    action: "challenge",
122
    enabled: true
123
  }
124
];

1
# Advanced bot behavior analysis script
2
import requests
3
import json
4
import numpy as np
5
from datetime import datetime, timedelta
6
import matplotlib.pyplot as plt
7

8
class BotBehaviorAnalyzer:
9
    def __init__(self, api_token, zone_id):
10
        self.api_token = api_token
11
        self.zone_id = zone_id
12
        self.headers = {
13
            "Authorization": f"Bearer {api_token}",
14
            "Content-Type": "application/json"
15
        }
16

17
    def analyze_request_patterns(self, hours=24):
18
        """Analyze bot request patterns"""
19

20
        # Fetch bot management analytics
21
        analytics = self.get_bot_analytics(hours)
22

23
        patterns = {
24
            "timing_analysis": self.analyze_timing_patterns(analytics),
25
            "volume_analysis": self.analyze_volume_patterns(analytics),
26
            "behavioral_analysis": self.analyze_behavioral_patterns(analytics),
27
            "evasion_techniques": self.detect_evasion_techniques(analytics)
28
        }
29

30
        return patterns
31

32
    def analyze_timing_patterns(self, analytics):
33
        """Detect non-human timing patterns"""
34
        request_intervals = []
35

36
        for session in analytics.get("sessions", []):
37
            timestamps = session.get("timestamps", [])
38
            if len(timestamps) > 1:
39
                intervals = np.diff(timestamps)
40
                request_intervals.extend(intervals)
41

42
        if not request_intervals:
43
            return {"status": "no_data"}
44

45
        # Analyze timing characteristics
46
        mean_interval = np.mean(request_intervals)
47
        std_interval = np.std(request_intervals)
48
        coefficient_of_variation = std_interval / mean_interval if mean_interval > 0 else 0
49

50
        # Human behavior typically has higher variation
51
        is_bot_like = coefficient_of_variation < 0.3 and mean_interval < 2.0
52

53
        return {
54
            "mean_interval": mean_interval,
55
            "std_interval": std_interval,
56
            "coefficient_of_variation": coefficient_of_variation,
57
            "is_bot_like": is_bot_like,
58
            "confidence": min(1.0, (0.3 - coefficient_of_variation) * 3) if is_bot_like else 0
59
        }
60

61
    def analyze_volume_patterns(self, analytics):
62
        """Analyze request volume patterns"""
63
        hourly_requests = {}
64

65
        for request in analytics.get("requests", []):
66
            hour = datetime.fromisoformat(request["timestamp"]).hour
67
            hourly_requests[hour] = hourly_requests.get(hour, 0) + 1
68

69
        # Calculate volume characteristics
70
        volumes = list(hourly_requests.values())
71
        if not volumes:
72
            return {"status": "no_data"}
73

74
        peak_volume = max(volumes)
75
        avg_volume = np.mean(volumes)
76
        volume_variation = np.std(volumes)
77

78
        # Detect flat volume patterns (bot-like)
79
        is_flat_pattern = volume_variation < (avg_volume * 0.2)
80

81
        # Detect burst patterns
82
        burst_ratio = peak_volume / avg_volume if avg_volume > 0 else 0
83
        is_burst_pattern = burst_ratio > 5.0
84

85
        return {
86
            "peak_volume": peak_volume,
87
            "avg_volume": avg_volume,
88
            "volume_variation": volume_variation,
89
            "is_flat_pattern": is_flat_pattern,
90
            "is_burst_pattern": is_burst_pattern,
91
            "burst_ratio": burst_ratio
92
        }
93

94
    def analyze_behavioral_patterns(self, analytics):
95
        """Analyze behavioral indicators"""
96
        behaviors = {
97
            "javascript_execution": 0,
98
            "cookie_support": 0,
99
            "referrer_diversity": set(),
100
            "user_agent_consistency": {},
101
            "page_dwell_time": [],
102
            "navigation_patterns": []
103
        }
104

105
        for request in analytics.get("requests", []):
106
            # JavaScript execution
107
            if request.get("javascript_executed"):
108
                behaviors["javascript_execution"] += 1
109

110
            # Cookie support
111
            if request.get("cookies_accepted"):
112
                behaviors["cookie_support"] += 1
113

114
            # Referrer diversity
115
            if request.get("referrer"):
116
                behaviors["referrer_diversity"].add(request["referrer"])
117

118
            # User agent consistency
119
            ua = request.get("user_agent", "")
120
            behaviors["user_agent_consistency"][ua] = behaviors["user_agent_consistency"].get(ua, 0) + 1
121

122
            # Dwell time
123
            if request.get("dwell_time"):
124
                behaviors["page_dwell_time"].append(request["dwell_time"])
125

126
        # Calculate behavioral scores
127
        total_requests = len(analytics.get("requests", []))
128
        js_execution_rate = behaviors["javascript_execution"] / total_requests if total_requests > 0 else 0
129
        cookie_support_rate = behaviors["cookie_support"] / total_requests if total_requests > 0 else 0
130
        referrer_diversity_score = len(behaviors["referrer_diversity"])
131

132
        # Bot likelihood based on behaviors
133
        bot_indicators = 0
134
        if js_execution_rate < 0.1:
135
            bot_indicators += 1
136
        if cookie_support_rate < 0.1:
137
            bot_indicators += 1
138
        if referrer_diversity_score < 2:
139
            bot_indicators += 1
140
        if len(behaviors["user_agent_consistency"]) == 1:  # Single UA
141
            bot_indicators += 1
142

143
        bot_probability = bot_indicators / 4.0
144

145
        return {
146
            "js_execution_rate": js_execution_rate,
147
            "cookie_support_rate": cookie_support_rate,
148
            "referrer_diversity_score": referrer_diversity_score,
149
            "user_agent_diversity": len(behaviors["user_agent_consistency"]),
150
            "avg_dwell_time": np.mean(behaviors["page_dwell_time"]) if behaviors["page_dwell_time"] else 0,
151
            "bot_probability": bot_probability,
152
            "bot_indicators": bot_indicators
153
        }
154

155
    def detect_evasion_techniques(self, analytics):
156
        """Detect bot evasion techniques"""
157
        evasion_indicators = {
158
            "rotating_user_agents": False,
159
            "proxy_rotation": False,
160
            "rate_limiting_awareness": False,
161
            "header_manipulation": False,
162
            "session_manipulation": False
163
        }
164

165
        user_agents = set()
166
        ip_addresses = set()
167
        request_intervals = []
168

169
        for request in analytics.get("requests", []):
170
            user_agents.add(request.get("user_agent", ""))
171
            ip_addresses.add(request.get("ip_address", ""))
172

173
            if request.get("timestamp"):
174
                request_intervals.append(request["timestamp"])
175

176
        # Check for rotating user agents
177
        if len(user_agents) > 10 and len(analytics.get("requests", [])) < 100:
178
            evasion_indicators["rotating_user_agents"] = True
179

180
        # Check for proxy/IP rotation
181
        if len(ip_addresses) > 5 and len(analytics.get("requests", [])) < 50:
182
            evasion_indicators["proxy_rotation"] = True
183

184
        # Check for rate limiting awareness (regular intervals)
185
        if len(request_intervals) > 10:
186
            intervals = np.diff(sorted(request_intervals))
187
            if np.std(intervals) < 0.1:  # Very regular timing
188
                evasion_indicators["rate_limiting_awareness"] = True
189

190
        return evasion_indicators
191

192
    def create_adaptive_bot_rules(self, patterns):
193
        """Create adaptive bot management rules"""
194
        rules = []
195

196
        # Rule based on timing analysis
197
        if patterns["timing_analysis"].get("is_bot_like"):
198
            rule = {
199
                "name": "Adaptive Timing-based Bot Detection",
200
                "expression": f'cf.bot_management.score lt 50 and rate(1m) gt 30',
201
                "action": "challenge",
202
                "description": "Detected non-human timing patterns"
203
            }
204
            rules.append(rule)
205

206
        # Rule based on behavioral analysis
207
        bot_prob = patterns["behavioral_analysis"].get("bot_probability", 0)
208
        if bot_prob > 0.6:
209
            rule = {
210
                "name": "Adaptive Behavioral Bot Detection",
211
                "expression": 'cf.bot_management.score lt 60 and not cf.bot_management.verified_bot',
212
                "action": "managed_challenge",
213
                "description": "Detected bot-like behavioral patterns"
214
            }
215
            rules.append(rule)
216

217
        # Rule for evasion techniques
218
        evasion = patterns["evasion_techniques"]
219
        if evasion.get("rotating_user_agents") or evasion.get("proxy_rotation"):
220
            rule = {
221
                "name": "Adaptive Evasion Detection",
222
                "expression": 'cf.bot_management.score lt 70 and cf.threat_score gt 10',
223
                "action": "block",
224
                "description": "Detected bot evasion techniques"
225
            }
226
            rules.append(rule)
227

228
        return rules
229

230
# Usage
231
analyzer = BotBehaviorAnalyzer("your-api-token", "your-zone-id")
232
patterns = analyzer.analyze_request_patterns(hours=48)
233
adaptive_rules = analyzer.create_adaptive_bot_rules(patterns)