Does FortiWeb ML Based Bot Protection needs a javascript to be injected and false positives ?

Hi @filiaks1 ,

1-Does the Machine-Learning (ML) Bot Protection module inject JavaScript?

No. FortiWeb’s ML/AI bot engine is a passive classifier: it analyses metadata that is already present in every HTTP/S transaction (URL, method, header mix, response status, request rate, cookie reuse, etc.). Only the two active bot-handling features—Biometric-Based and Deception-Based Bot Protection—insert JavaScript (or a hidden HTML tag) so the client must return a token. The ML profile does not modify the page, therefore it works just as well for:

• Browser traffic
• Pure API/JSON or mobile-app calls (no HTML to rewrite)
• Curl / Postman tests, etc.

The machine-learning model is completely transparent to the client. Unlike Biometric or Deception–Based protection it does not inject any script.

https://docs.fortinet.com/document/fortiweb/7.6.4/administration-guide/600188/configuring-ml-based-bot-detection-policy

2-Will backend 5xx errors during a DoS cause ML bot false-positives?

Backend 4xx/5xx bursts do not, by themselves, trigger blocking. The classifier learns two baselines:

• Request-side features (headers, URI entropy, timing)
• Normal response codes per URL

The ML engine scores more than thirty features (high rate, no cookies, missing Accept headers, etc.); an unexpected 503 is just one dimension. A request is blocked only if the combined score exceeds the threshold. You can even set the response-anomaly weight to 0 if you want the model to ignore status-code changes during an outage.

So, ML Bot Protection is safe for API endpoints, needs no JavaScript beacon, and 5 xx bursts will not automatically create false-positives unless you tighten the scoring thresholds yourself.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781