# Design a bot detection system: system design interview question

> Fast request decisions with uncertain signals, approved automated clients, adaptive attackers, and measurable limits on detection errors.

Source: https://sysround.com/questions/design-bot-detection-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a system that detects abusive automated traffic to a large website. Make fast request decisions while limiting disruption to legitimate users."

## What to clarify first

- Traffic scale
- Read and write mix and telemetry
- Decisions and approved clients
- Signals and privacy
- Latency and availability
- Errors against legitimate clients
- Abuse success
- Evaluation and labels
- Freshness and durable state
- External services and exclusions

## Scope of a strong answer

Core requirements:

- Evaluate requests with request patterns, browser signals, and behavior features
- Return an allow, challenge, or block decision
- Stop abusive automation within error limits for legitimate users
- Support approved automated clients without human challenges

Usually out of scope:

- Build a challenge provider
- Build a full web application firewall
- Research new machine learning methods
- Track users across unrelated websites

## What interviewers probe

### Request decisions

Each request needs a fast decision and a durable event, even during traffic peaks and downstream outages.

### Patterns across requests

Many legitimate users share addresses, while attackers spread requests across addresses and replace session identifiers.

### Legitimate clients

Approved clients need access without human challenges, but an attacker can copy their names and browser signals.

### Results after policy changes

Detector actions do not prove prevention, and aggregate results can hide harm to a small client group.

## Common mistakes

- Candidates treat every automated client as malicious.
- Candidates trust a crawler name or partner claim without identity verification.
- Candidates use one address threshold for all users and endpoints.
- Candidates route approved clients into human challenges when verification becomes stale.
- Candidates claim durable telemetry without an outage capacity and recovery calculation.
- Candidates measure success by detector actions instead of prevented abuse and legitimate-session errors.

## The bar by level

- **Senior:** Budgets latency and durable event capture. Handles shared addresses, distributed attacks, bounded state, and approved clients during verification failures. Calculates outage capacity and recovery. Enforces prevention and error limits.
- **Staff+:** Defines failure envelopes and resolves conflicts among access, identity trust, latency, and event durability. Tests label bias and metric uncertainty. Establishes safe production evidence, regional recovery, and policy rollback.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=bot-detection


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.