Using machine learning to detect bot attacks that leverage residential proxies

Cloudflare outlines its Bot Management ML v8 model, which detects sophisticated bot traffic—especially from residential proxy networks and cloud providers—using a combination of latency, behavioral signals, global/local aggregates, and single-request features. The report explains the training pipeline (Airflow-orchestrated datasets, CatBoost, SHAP-based validation), shadow-mode deployment, and measured gains in detecting distributed attacks such as login abuse and scraping. Results indicate significant improvements in per-request detection of residential proxy activity across tens of millions of IPs, with additional uplift against cloud-hosted bots.