Behavioral Fingerprinting & Bot Detection — 5 signal dimensions

2026-03-23

What We Built

Bot detection and behavioral fingerprinting with 5 signal dimensions:

1. Timing regularity: coefficient of variation of request intervals
2. Token variance: input/output token count variability
3. Model diversity: Shannon entropy of model usage distribution
4. Burst score: max/avg requests per second window
5. Time concentration: active hours out of 24

4 classification levels: human, automated_tool, bot, uncertain. Anomaly scoring from baseline (100 requests). <5ms per request.

Lockstep Checklist

• [x] API: Bot detector module + classification
• [x] Tests: 10 tests for observations, classification, timing, anomaly
• [x] Docs: Ship log