FortiWeb's bot detection machine learning (ML) model is fundamentally different from its anomaly detection model in its analytical scope. The bot detection model analyzes traffic from a source over a period of time, examining patterns across multiple connections to distinguish between human and automated (bot) behavior. In contrast, the anomaly detection and API protection models typically evaluate each HTTP request as a single, independent unit. They compare the individual request's parameters, structure, and values against a pre-established mathematical model of what is considered "normal" for the application.

B. Bot ML models are specifically designed to identify and classify actual threats (malicious bots), not just flag undefined anomalies.

C. While the specific properties may differ, both model types inspect a wide range of connection properties. The core difference is the analytical scope (time-series vs. single transaction), not the quantity of properties.

D. All FortiWeb machine learning models are designed to learn continuously and update periodically from new traffic data to adapt to application changes and evolving threats.

1. Fortinet FortiWeb 7.0.0 Administrator Guide

Page 39

Section: "Machine Learning".

Regarding Anomaly Detection: "FortiWeb builds a mathematical model of the normal behavior of each of your web applications... It analyzes each request..."

Regarding Bot Detection: "For bot detection

FortiWeb uses a different machine learning model... It analyzes traffic from a single source IP over a period of time to determine if the traffic is generated by a human or a bot." This directly supports the distinction made in option A.