Checkout Bot Defense: Behavioral Risk Scoring (2D)

Traffic Mix

Bot traffic share 35%

Bot sophistication (mimicry) 0.30

Risk Thresholds

Challenge threshold 0.40

Block threshold 0.72

Live Decisions

Allow0

Challenge0

Block0

Bot catch rate

Human friction

Sessions processed

How it works

Every checkout session lands with three behavioral features, each scored 0 (looks human) to 1 (looks automated):

V — request-velocity anomaly: how much faster the add-to-cart→submit timing is than plausible human input.
I — interaction-entropy deficit: how little natural randomness the mouse/keystroke/scroll trace has (headless browsers script perfectly straight paths).
D — device/network anomaly: datacenter ASN, spoofed or missing device fingerprint, TLS/JA3 mismatch.

risk = (V + I + D) / 3   (equal-weight rule scorer)

if  risk < challenge_threshold        → ALLOW
if  challenge_threshold ≤ risk < block_threshold → CHALLENGE (step-up, e.g. CAPTCHA/OTP)
if  risk ≥ block_threshold             → BLOCK

The two translucent tilted planes are the literal decision surfaces V+I+D = 3·threshold, drawn with a hand-rolled orthographic projection (no WebGL) — every session plotted at (V, I, D) above a plane crosses that risk tier. Drag the scene to rotate the view; the math underneath is identical to a full 3D renderer, just projected by hand each frame. Real-world bot-management stacks (used by payment gateways and checkout platforms) run the same idea with dozens of weighted signals feeding a logistic or gradient-boosted model instead of a simple average, plus rate limiting per IP/device as a second independent layer.

Bot sophistication pulls the simulated bot cluster's feature centroid toward the human centroid and adds mimicry noise — modelling residential-proxy, headful-browser automation that is harder to separate from real users. Human friction is the share of genuine human sessions that get challenged or blocked — the metric fraud teams trade off against catch rate when moving the thresholds. The rolling chart at bottom-left tracks both rates over the last processed sessions so a threshold change's effect is visible immediately.

Drag to rotate view

Allow Challenge Block Human session Bot session

Catch % (green) / Friction % (red)