To detect bots, Cloudflare uses several different detection systems including machine learning and rule-based heuristics. In this post, Jeffrey Tang describes Cloudflare’s anomaly detection system, which applies Histogram-Based Outlier Scoring to score global outliers quickly. He provides an overview of this system’s architecture, which consists of microservices running on Kubernetes and uses ClickHouse to collect traffic data and Redis to aggregate and store features. Tang offers insights into why Cloudflare transitioned from a monolithic service and discusses how they optimized Redis to support a growing number of features and visitors. Finally, he previews how Cloudflare might use local outlier factor detection and continues to use model experimentation and advanced deployment tools to support rapid iteration.