Business Context

ShieldGate operates a cloud Web Application Firewall (WAF) protecting 12,000 customer web applications and processing roughly 180 million HTTP requests per day. The security team wants a machine learning classifier that distinguishes legitimate human traffic from malicious bots so the WAF can block or challenge suspicious requests without hurting real users.

Dataset

You are given request-level logs aggregated from 30 days of WAF traffic. Each row represents one HTTP request with engineered session and network context available at scoring time.

• Size: 4.8M requests, 47 features
• Target: Binary label — malicious bot (1) vs legitimate user/request (0)
• Class balance: 7.4% malicious, 92.6% legitimate
• Missing data: 18% missing in JavaScript/browser-derived fields, 6% missing in reputation fields for newly seen IPs

Success Criteria

A good solution should achieve strong bot recall while keeping false positives low enough for production use. Target at least 90% recall on malicious bots with precision >= 70% on the blocked/challenged class, and support threshold tuning for different customer risk profiles.

Constraints

• Inference latency must stay under 15 ms per request at the model layer.
• The model must be explainable enough for security analysts to review top risk factors.
• Features must be available in real time; no future session information or post-request labels may be used.
• The model should be retrained weekly because bot behavior changes quickly.

Deliverables

1. Build a binary classification pipeline for bot detection.
2. Explain which features help separate legitimate users from malicious bots.
3. Choose an evaluation strategy appropriate for imbalanced security data.
4. Propose a decision threshold for block vs challenge vs allow actions.
5. Describe how you would monitor drift and model degradation after deployment.