Every checkout session lands with three behavioral features, each scored 0 (looks human) to 1 (looks automated):
- V — request-velocity anomaly: how much faster the add-to-cart→submit timing is than plausible human input.
- I — interaction-entropy deficit: how little natural randomness the mouse/keystroke/scroll trace has (headless browsers script perfectly straight paths).
- D — device/network anomaly: datacenter ASN, spoofed or missing device fingerprint, TLS/JA3 mismatch.
risk = (V + I + D) / 3 (equal-weight rule scorer)
if risk < challenge_threshold → ALLOW
if challenge_threshold ≤ risk < block_threshold → CHALLENGE (step-up, e.g. CAPTCHA/OTP)
if risk ≥ block_threshold → BLOCK
The two translucent planes in the scene are the literal decision surfaces V+I+D = 3·threshold — every session plotted at (V, I, D) above a plane crosses that risk tier. Real-world bot-management stacks (used by payment gateways and checkout platforms) run the same idea with dozens of weighted signals feeding a logistic or gradient-boosted model instead of a simple average, plus rate limiting per IP/device as a second independent layer.
Bot sophistication pulls the simulated bot cluster's feature centroid toward the human centroid and adds mimicry noise — modelling residential-proxy, headful-browser automation that is harder to separate from real users. Human friction is the share of genuine human sessions that get challenged or blocked — the metric fraud teams trade off against catch rate when moving the thresholds.