Cloudflare Launches Adaptive Intelligence to Shift Bot Attack Economics

Cloudflare Launches Adaptive Intelligence to Shift Bot Attack Economics Cloudflare has introduced Adaptive Intelligence, a bot detection engine that continuously adapts to threats, aiming to make automated attacks economically unviable rather than relying on static, perimeter-style defenses. Adaptive Intelligence replaces static, deterministic defenses with continuous machine learning retraining and non-deterministic statistical judgments. The architecture introduces disposable rules that appear and expire at random intervals, depriving attackers of clear feedback to reverse-engineer protections. A four-stage loop (observe, train, deploy, validate) tests model updates in shadow mode against live traffic to prevent real users from being blocked. Reversing Attacker Economic Advantages Traditional bot mitigation relies on deterministic rule sets that provide attackers with predictable feedback, making adaptation cheap for bot operators while defensive updates lag behind. Because determined attackers eventually find workarounds through residential proxy pools and automated tools, Adaptive Intelligence shifts strategy: instead of attempting an impenetrable wall, it makes bypassing defenses sufficiently slow, unpredictable, and expensive that attacks cease to be economically worthwhile. Continuous Retraining and Disposable Rules Launching initially with continuous model retraining behind Cloudflare's bot score, the engine updates directly from live traffic without waiting for scheduled releases. Upcoming components include disposable rules that target specific attacks and retire quickly to prevent attackers from finding fixed edges, as well as an active memory system that retains historical attack patterns so threat actors cannot simply cycle through previously used configurations. Automated Loop and Safe Validation The engine operates across an observe, train, deploy, and validate cycle. It ingests network-wide telemetry—including TLS fingerprints, request structures, and client-side behavioral signals from tools like Precursor—and evaluates traffic across multiple time windows. To protect legitimate visitors, candidate detections run in shadow mode on live traffic, verifying solve rates and precision before rolling out automatically to enterprise customers.

Cloudflare 推出 Adaptive Intelligence 引擎，通过重构攻防经济学打击自动化威胁 Cloudflare 发布全新 Bot 检测引擎 Adaptive Intelligence，转变传统“筑高墙阻挡所有攻击”的确定性静态防御思路，转而通过持续重训、生成一次性规则并剥夺攻击者反馈，大幅增加攻击成本与迟滞时间，逆转防守方在经济层面的劣势。 传统确定性规则系统迭代缓慢且会为攻击者提供探测边界的确定反馈，使防守方处于经济劣势。 Adaptive Intelligence 假定攻击终会穿透，核心目标是让攻击变得极其缓慢且代价高昂，最终失去经济价值。 首发上线基于全网实时流量持续重训的机器学习模型，后续将引入一次性规则生成与跨站点自动学习机制。 系统通过“观察、训练、部署、验证”四步闭环运行，并在灰度影子模式下验证误杀率后自动更新权重。 结合宏观网络信号与 Precursor 客户端行为遥测，跨多时间窗口挖掘信号关联以识别低频分布式攻击。 传统 Bot 防御的经济学困境 现代 Bot 威胁多由分工明确的专业团伙或商业黑产驱动，AI 工具与住宅代理网络的普及更进一步降低了攻击配置门槛。攻击者常利用大量轮换 IP 低频发起凭据撞库或自动化流程，绕过单 IP 速率限制并潜伏在正常流量中。传统的确定性规则或固定发布周期的机器学习模型更新周期长达数月，不仅向攻击者提供了固定的攻击靶标，且每次拦截的明确反馈反而训练了黑产的绕过工具，导致防守方陷入“适应成本高于绕过成本”的被动局面。 Adaptive Intelligence 核心设计与三大特性 Adaptive Intelligence 采用统计学判断代替硬性确定性规则，通过多信号综合加权消除单点逻辑漏洞，甚至在识别 Bot 后不立即显式反馈以破坏攻击者的试错循环。该引擎包含三大关键特性：第一是即日上线的模型持续重训，根据实时网络流量与最新绕过框架动态更新，无需等待版本排期；第二是即将推出的一次性规则生成机制，以随机间隔部署并销毁针对特定攻击的规则，注入对抗噪声让黑产逆向工程失效；第三是跨数百万站点的反馈学习，基于用户纠错与漏报信号动态优化防御基准。 闭环运行机制与多时间窗口关联分析 该引擎建立在“观察、训练、部署、验证”的自动化闭环上。系统汇总 JA4 TLS 指纹、会话行为、网络信誉以及 Turnstile、Precursor 等客户端遥测数据；随后基于实时数据持续微调模型；新权重经自动化流程推送到全网，无需用户手动升级。在流量分析维度上，系统同时评估多个时间窗口：短时间窗口防范流量突增与抓取峰值，长时间窗口则负责将分散在成千上万独立 IP 间的异常协同模式关联起来，识别并锁定低频分布式的撞库尝试。 安全验证部署与产品联动 为防止自动化更新导致正常用户被误封，新检测模型在全网上线前均在影子模式下并行打分，通过比对验证码通关率等核心指标证明其精确率与召回率优于旧版本，否则不予发布。同时，引擎保留历史攻击记忆，防止攻击者利用轮换配置逃避检测。该引擎与连续会话行为分析引擎 Precursor 协同工作，企业版用户只需在控制台启用“自动更新机器学习”即可无缝接入保护。

Modern bot threats are increasingly driven by determined, sophisticated attackers. Often it is not even one person, but a group trading techniques with each other or a commercial service sold to anyone willing to pay. For many of them, getting past bot detection is a full-time job they genuinely enjoy. Block them and they get to work, finding a workaround. AI has simplified this further, making it even easier to set up complex configurations for attackers, lowering the overhead of an attack. This shift puts defenders at an economic disadvantage. Responding and adapting to new attacks takes care, evidence, and effort to ensure efforts to block attackers don’t impact real users on the way. Attackers have no such concerns and are primarily constrained by their time and their pool of proxies, and ensuring their infrastructure providers don’t shut down their accounts. Their advantage is the cost of adaptation. Attackers can adapt as often and continuously as they need, while most defenses are deployed in discrete, managed releases. Cloudflare analyzes more than a trillion requests a day for signs of automated abuse, so we see how fast attackers change tactics. That gap in responsiveness is widening. The inconvenient truth: bot detection across the industry often rests on a hopeful assumption that if you make the wall tall enough, attackers stay out. In reality, a determined attack always finds a way through. **The question is not whether a determined attacker can get through. They will. The question is what happens when they do.** Today we are launching Adaptive Intelligence, a new bot detection engine that starts from the opposite idea. Rather than betting on a wall that keeps every attacker out, Adaptive Intelligence makes getting through so slow and costly that the attack stops being worth running. We believe that no other bot detection works this way. Not every attack is obvious to spot. The most sophisticated ones are built to disappear into ordinary traffic. An attacker can spread requests across a large residential proxy network, keep the rate from each address low, and move patiently through a login, checkout, or account-recovery flow. Every request comes from a different address, often with a fresh user agent or a new bot fingerprint, so each one looks like a new visitor. No single source ever crosses a rate limit. This is what makes the shape so hard to stop. Tighten the thresholds too far and real customers are turned away, which is the outcome you are trying hardest to avoid. The attack lives in the space between one request and the next, and a defense that studies each request on its own will never see it. The challenge with rule-based systems is that they hand the attacker a stationary target. They iterate in days while the model waits months for its next update, so by the time it catches up, the tooling has already moved on. Bot detection has always answered a new attack technique by writing a rule to catch it. That works, until the attacker studies the signal, learns how to circumvent it, and forces another rule to be written. Some of the most advanced attackers have even created tooling to semi-automate this process. The defender appears permanently disadvantaged. This kind of detection is “deterministic”, meaning that the same input always produces the same output. A defense that never changes teaches the attacker how to beat it and indirectly drives bot operators to build more capable automated attacks. Against a deterministic defense, automated probes return a clean yes or no, and over enough attempts that feedback teaches an attacker exactly where the edges of the system are. The economics are in the attacker’s favor. Adaptive Intelligence aims to reverse the economics and put them back in the defender's favor. A defense that keeps changing flips that calculation, but only if two things are true at once. First, it has to cost the defender less to react than it costs the attacker to work around it. Second, attackers must be starved of the feedback they use to adapt, so they cannot simply learn their way back in. Get both right and the attacker's own loop turns against them: nothing they learned stays true, and each new attempt costs more than the last, until the attack is no longer worth running. Part of that is giving an attacker less to learn from. Adaptive Intelligence can recognize a bot from a signal without visibly reacting to it, so the attacker keeps relying on a tell they do not realize we can see. And it treats detection as a statistical judgment rather than a fixed rule. That makes it non-deterministic. It weighs many signals at once, so there is no single piece of logic for an attacker to isolate and beat. Your bot score already comes from several detection methods working together: machine learning, behavioral validation, JavaScript fingerprinting, a library of heuristics, and checks that recognize known, verified bots like search crawlers. Adaptive Intelligence is a brand new bot detection engine that sits behind bot score. Where every other system is built to keep attackers out by accumulating rules, Adaptive Intelligence is built with the assumption that attackers will eventually get in, and makes that attempt as costly as possible. Below, we explain three components our Adaptive Intelligence detection engine will have, that are unique when compared to traditional models: improving itself, disposable rule generation, and learning from the traffic it protects. Launching today is its first component: the machine learning at the center of your bot score, now retraining continuously instead of shipping as a fixed version. It aggregates network signals from across Cloudflare's network and measures the probability of automated abuse for every request. Where a fixed model sits still, Adaptive Intelligence keeps moving. The second and third components explained below are soon to follow. The engine retrains continuously on live traffic. As new bypass tools and bot frameworks appear, it learns from them and folds that knowledge into the model behind your bot score, without waiting for a scheduled release. A technique that shows up this week is one the engine can recognize this week. The score you already build on stays close to what attackers are actually doing, rather than drifting further from reality between updates. A disposable rule is a rule that we expect the attacker to adapt to, but doesn’t improve the attacker's bot in the process. Adaptive Intelligence is designed to create disposable rules aimed at a specific attack, deploy and retire them at random intervals, and never leave them in place long enough to become a fixed target. Because the rules keep appearing and vanishing, they inject noise into the very signal an attacker relies on to train against us, so an attacker never gets the steady yes-or-no that a static defense leaks. No single rule has to be perfect or unbeatable. It only has to last long enough to do its job, then make way for the next one. By the time an attacker has reverse-engineered a specific pattern, the engine has already moved on, rendering their engineering effort worthless. Adaptive Intelligence will also learn from the patterns it sees across millions of sites. When a customer flags a real visitor we scored incorrectly, or our own measurement catches a miss, that correction becomes a training signal. Over time the engine tunes to the problems Cloudflare's customers are actually facing, so the protection you get reflects the current threat landscape instead of a snapshot of an older one. Adaptive Intelligence runs in a loop: observe, train, deploy, validate. The range of signals it draws on keeps growing as we connect more of the network into it. | **Observe.** The engine aggregates Cloudflare network signals, such as JA4 TLS fingerprints, request structures, challenge outcomes, session behavior, network reputation, and higher-level meta signals, alongside client-side telemetry from Turnstile and Precursor. A client that looks ordinary on any single request but moves like a script across a whole session is caught by its behavior over time, even when each request looks legitimate. | **Train**. We retrain the ML system continuously on live traffic, including the newest bypass tools and bot frameworks as they appear in the wild. The training set is refreshed often, so the system can react much faster to new attack techniques. | | **Deploy**. New model weights roll out across the network on their own. There is no version to choose and no upgrade to schedule, and once you are on it, nothing for you to do. The model scoring your traffic reflects the threats we are seeing right now. | **Validate**. Before a new version becomes your primary defense, it runs in shadow mode alongside the current one, scoring live traffic without affecting a single visitor. We compare the two and watch signals like challenge solve rates. If a new version would score real people worse, it does not go live. | Cloudflare has run this kind of automated loop against DDoS attacks for years: sample traffic, TLS fingerprint the patterns behind an attack, push protections out across the network, and keep measuring so they can be adjusted or retired as the traffic changes. Bots are a harder version of the problem, because the signals are quieter and the story only shows up over time. Any one signal can look perfectly normal on its own. It is the relationships between them, and the company they keep, that reveal a bot hiding in normal traffic. Adaptive Intelligence evaluates traffic over several time windows at once. A short window catches a sudden burst as it develops. A longer window reveals the behavior that repeats across thousands of addresses, clients, and sessions that have no reason to behave alike, and ties those scattered requests back to a single source. The same engine that spots an obvious scraping spike also surfaces a slow, distributed credential-stuffing attack sending only a handful of requests from each address. As the next parts of Adaptive Intelligence come online, mining systems will search recent, labeled traffic for combinations of signals that separate an emerging attack from real users. Often, a useful detection comes from the relationship between signals we already know, rather than a signal we have never seen before. A client might claim to be one browser while producing the network or JavaScript signals of another. A request might look normal on its own but form an odd sequence alongside the rest of the session. Automated mining lets us test many of these combinations and turn the strongest into candidate detections. These candidates are deliberately narrow. They do not need to catch every bot on the Internet, or even every request in the current attack. That makes them quick to build and easy to replace when an attack changes tactics. Attackers do not attack once. They pause, retool, and come back. Retiring a detection does not mean forgetting the pattern behind it. The engine keeps a memory of past attacks even after their detections stop firing, so an attacker cannot escape just by flipping between two profiles and betting the second one looks new. That memory gives the system a head start when a familiar attack returns or a related one appears. A detection can expire when it stops earning its place, while the evidence behind it stays available to build the next one. Nothing piles up as stale rules in production, and the system never has to learn an old attack from scratch. The result is one automated loop that can react to an obvious spike or quietly gather evidence on a patient, distributed attack that stays under traditional thresholds. Constant change only helps if every change is safe, and the bar is high. Customers can live with the occasional bot slipping through, but a real visitor wrongly turned away is the failure that actually costs. That is the worry that makes teams cautious about automatic updates, so a new detection has to earn its place before it affects anyone. We test each candidate against recent real traffic and measure how much known automation it catches and how often it would flag a genuine visitor by mistake. It rolls out gradually as an input to your bot score while we watch score distributions, challenge outcomes, and customer feedback, and we can pause or roll it back before it reaches your whole network. Every update has to prove it is at least as good as the one it replaces, on the measures that matter for this kind of system, precision and recall among them. This engine does not work alone. Last month we introduced [Precursor](https://blog.cloudflare.com/introducing-precursor/), a continuous behavioral validation engine for bot management built with privacy in mind, which measures automated abuse based on how a visitor behaves once they reach the browser: the timing, the movement, the small human signals that automation struggles to fake. Precursor and Adaptive Intelligence were built as two parts of one idea to detect malicious automation. Precursor does so through measuring continuous session-behavior; Adaptive Intelligence learns from bot detection signals across the whole network, and the signals from one make the other harder to fool. It also reflects how we think about the problem: the bot detection engine should shrink what gets through, and keep adapting faster than the attacker on the other side. Continuous retraining is the foundation, and more of the engine comes online from here. We are expanding automatic detection generation for bots, connecting more of what Cloudflare sees across the network, the challenge, and the browser into a single view of a session, and giving you more ways to act on what the engine finds. Knowing that no defense will keep every determined attacker out lets us aim for something more useful: making each attempt short-lived while costing the attacker more than it will ever return. Adaptive Intelligence reacts faster to new techniques, and gives attackers less to learn from each time it makes a change. The attacker who never quits now faces a defense that is different each time they return, so their persistence stops paying off. Enterprise customers should turn on "Auto Update Machine Learning" in the [Bot Management dashboard](https://dash.cloudflare.com/?to=/:account/:zone/security/settings?tabs=bot-traffic). With it on, you get Adaptive Intelligence automatically, with no version to migrate and nothing to configure, and the bot score you already build on keeps working unchanged. If you are not sure it is enabled, check now so you are covered from day one.