How to Tell Legitimate Visitors from Bots: Non-Obvious Cases
It is very important to clearly define what signs can be used to identify legitimate requests so that the anti-DDoS provider can accurately identify the beginning of an attack on the application and defend against illegitimate requests. Application developers and their customers should have an idea of how a DDoS defender thinks and acts, and ensure up front that it can detect and disable bots.