Implemented Architecture

Telemetry Detection Pipeline

The implemented flow connects the Cloudflare Pages website, beacon.js, Cloudflare Worker, Azure-hosted Flask /predict API, Cloudflare D1, and Streamlit Dashboard.

Overview Live Stats Dashboard GitHub

High-Level Process Flow

The browser sends minimized telemetry to the Cloudflare Worker. The Worker validates the payload, prepares the approved 14-feature input, sends it to Azure for dual-model prediction, applies the final risk logic, stores the result in Cloudflare D1, and makes the event available to the Streamlit Dashboard.

1. Static Website Visitor interacts with the Cloudflare Pages site.
2. beacon.js Browser sends limited privacy-preserving telemetry events.
3. Cloudflare Worker Intake Worker receives the event and validates the JSON payload.
4. Privacy and Feature Validation Only approved non-sensitive fields are kept and normalized into the 14-feature model schema.
5. Azure Flask /predict API The Worker sends the validated feature vector to the Azure-hosted prediction endpoint.
6. Dual-Model Prediction Gradient Boosting returns a traffic class and confidence, while Isolation Forest returns an anomaly result and decision score.
7. Worker Decision Engine The Worker combines the supervised prediction, confidence, and anomaly result to calculate risk score, risk level, and action.
8. Cloudflare D1 Stores minimized telemetry, model outputs, and the final risk assessment.
9. Streamlit Dashboard Reports classifications, anomaly results, risk levels, actions, and evaluation evidence.
Worker sends 14 features to Azure /predict Gradient Boosting + Isolation Forest Worker applies final risk logic Cloudflare D1 event storage Streamlit reporting dashboard

Pipeline Steps and System Ownership

Stage Owner Output
Collect Static website + beacon.js Minimized telemetry event
Intake Cloudflare Worker Accepted JSON event payload
Validate Cloudflare Worker privacy logic Approved non-sensitive fields
Prepare Features Cloudflare Worker Normalized 14-feature model input
Predict Azure App Service Flask API Supervised class, confidence, probabilities, anomaly result, and decision score
Decide Cloudflare Worker risk logic Risk score, risk level, and recommended action
Store Cloudflare D1 Stored telemetry and completed assessment
Report Streamlit Dashboard Dashboard analytics and evaluation evidence

Worker and Azure Communication

Azure performs machine-learning inference only. The final risk decision remains in the Cloudflare Worker.

Worker to Azure

The Worker sends a validated 14-feature telemetry object to the Flask /predict endpoint.

  • Page category
  • Interaction type
  • Scroll-depth category
  • Request interval
  • User-agent category
  • Session, error, TLS, and connection features
  • No raw IP address
  • No persistent personal identifier

Azure to Worker

Azure returns the outputs from both trained models.

  • Gradient Boosting prediction
  • Prediction confidence
  • Class probabilities
  • Isolation Forest prediction
  • Anomaly-detected value
  • Isolation decision score
  • Calibrated anomaly threshold

Detection Methods

The prototype uses two trained machine-learning models in Azure and a deterministic risk-decision function in the Cloudflare Worker.

Method Learning type Purpose Implementation
Gradient Boosting Supervised classification Classifies each event as human, good bot, bad bot, or scanner and returns confidence and class probabilities. gradient_boosting_model.pkl in Azure Flask API
Isolation Forest Unsupervised anomaly detection Determines whether the event differs from expected benign behaviour using a calibrated anomaly threshold. isolation_forest_model.pkl in Azure Flask API
Risk Decision Logic Deterministic rules Combines the supervised class, confidence, and anomaly result to assign a final risk score, risk level, and recommended action. Cloudflare Worker calculateRisk() function

Risk Assessment and Recommended Actions

The current prototype produces advisory actions for monitoring and review. It does not automatically block visitors or apply a CAPTCHA.

Example Condition Risk Level Recommended Action
Human prediction with no anomaly Low Allow
Good bot prediction with no anomaly Low Allow with monitoring
Unknown prediction or a low-risk event marked anomalous Medium Monitor
Bad bot or scanner prediction High Flag for review

Stored Event Record

Each completed event is stored in Cloudflare D1 after the Worker receives the model outputs and calculates the final assessment.

Telemetry

  • Page and interaction categories
  • Request timing
  • Pages per session
  • Error rate
  • Coarse connection features

Model Outputs

  • Supervised prediction
  • Isolation prediction
  • Anomaly-detected value
  • Isolation decision score

Final Assessment

  • Risk score
  • Risk level
  • Recommended action
  • Event timestamp

Project Boundaries

In Scope

  • Professional static website + beacon
  • Cloudflare Worker intake endpoint
  • Privacy validation + minimized 14-feature schema
  • Synthetic dataset + feature engineering pipeline
  • Isolation Forest + Gradient Boosting
  • Worker-based risk scoring and recommended actions
  • Azure-hosted Flask prediction API
  • Cloudflare D1 storage
  • Streamlit Dashboard + evaluation report

Out of Scope

  • Real sponsor production data
  • Production-grade blocking or CAPTCHA enforcement
  • Rate limiting or active mitigation
  • Third-party attacks or adversarial testing
  • Invasive tracking or browser fingerprinting
  • Formal end-to-end latency benchmarking
  • Commercial-ready security product