How Scraping Pipelines Handle Kassandra Bot Detection
Kassandra is a bot detection system that takes a session-centric approach to identifying automation. Rather than evaluating requests in isolation, Kassandra builds behavioral profiles across the full session — tracking the sequence of pages accessed, the timing between requests, the navigation patterns, and the consistency of device signals across multiple interactions. This session-level analysis targets automation that passes individual request checks but exhibits patterns that are statistically inconsistent with real user behavior.
This article explains Kassandra’s session-scoring approach, how it differs from request-level detection systems, and what scraping pipelines need to produce sessions that pass its analysis. For structured data from protected sources, see our API Marketplace. For the broader anti-bot infrastructure picture, see our article on handling anti-bot systems.
Kassandra’s Session-Level Detection Approach
The defining characteristic of Kassandra is that it evaluates session behavior, not just individual requests. This has specific implications for how pipelines need to be designed:
| Detection dimension | What Kassandra scores | Automation failure pattern |
|---|---|---|
| Session navigation flow | Page sequence, entry points, depth of navigation, referrer chain | Direct URL jumping, missing navigation context, non-human page sequences |
| Request timing distribution | Inter-request timing variance, regularity of access patterns | Mechanical regularity — requests at identical intervals — flags as automation |
| Device signal consistency | Consistency of browser fingerprint attributes across session requests | Fingerprint changes mid-session; IP switch within session |
| Content interaction signals | Resource loading patterns, asset requests accompanying page loads | Fetching only HTML content without associated assets (images, CSS, fonts) |
| Session volume anomaly | Pages per session, session duration, content-to-request ratio | Extremely high page volumes or very short session durations inconsistent with human browsing |
The session-level approach means that a single well-configured request may pass all Kassandra’s checks — but a session of one hundred such requests with mechanical timing and direct URL access will be flagged. The unit of analysis is the session, not the request.
What Makes Session-Level Detection Harder to Address
Per-request detection systems (IP reputation, fingerprint checks) can be addressed by ensuring each request looks legitimate in isolation. Session-level detection requires that the entire sequence of requests across the session forms a plausible user journey:
- Navigation must have realistic context. Real users arrive from somewhere — a search result, a referrer page, a direct bookmark. Sessions that begin at a data-dense URL with no prior context, or that navigate systematically through a site in ways no real user would, are anomalous at the session level.
- Timing must have realistic variance. Human session timing has natural variance — reading time varies by page, pauses occur between pages, some pages are skipped quickly. Automation that accesses pages at perfectly regular 2-second intervals produces a timing signature that is statistically impossible for human behavior.
- Full page resources should be loaded. A real browser loads not just the HTML but all associated resources — images, stylesheets, JavaScript, fonts. A collection approach that fetches only the HTML response while skipping all other page assets produces a resource loading pattern with no human equivalent. See our article on headless browser tools for how full browser rendering addresses this.
- Session volumes should be bounded. Real users view dozens of pages per session, not hundreds. Sessions with very high page counts within very short time windows are statistically anomalous, regardless of whether each individual request looks legitimate.
Infrastructure Requirements for Kassandra-Protected Sources
- Realistic session flow design. Collection sessions should follow navigation paths consistent with real user behavior — entry from contextual referrers, navigation through site structure, realistic page sequences before reaching target data points. Direct URL jumping to data pages is the primary session-level anomaly to avoid.
- Randomized request timing with human-plausible variance. Inter-request delays should be randomized within human-plausible ranges, not set to a constant interval. The distribution of timing should resemble human reading and navigation behavior. See our article on scraping at scale for how request pacing is designed in production.
- Session-consistent device and IP assignment. IP and device fingerprint must not change within a session. Kassandra’s device consistency check flags sessions where these change. See our article on FingerprintJS and browser fingerprinting.
- Full resource loading per page. Using headless browsers that load all page assets, rather than HTTP clients that fetch only HTML, produces resource loading patterns consistent with real browser sessions. See our article on headless browser tools.
- Session volume limits. Collection sessions should be designed with realistic page counts per session, with session boundaries and re-initialization reflecting natural session behavior rather than continuous long-running sessions at high volume.
How Webparsers Handles Kassandra-Protected Sources
- We design collection sessions with realistic navigation flows. For Kassandra targets, sessions are designed to follow plausible navigation paths — including contextual entry, navigation through site structure, and realistic page sequences — rather than direct access to target data URLs.
- We apply human-plausible timing distributions to all requests. Request timing is randomized within distributions calibrated to human reading and navigation behavior. Mechanical constant-interval request patterns are never used on Kassandra-protected sources.
- We maintain session consistency throughout collection. IP and device fingerprint assignments are locked per session. Sessions are terminated and re-initialized on natural boundaries rather than running indefinitely at high volume.
- We use full headless browser rendering rather than HTML-only fetching. For Kassandra targets, full browser rendering ensures resource loading patterns match real user sessions, not lightweight HTTP clients.
- Data from Kassandra-protected sources is available through our API Marketplace for supported endpoints. See API Marketplace for available structured data.
Discuss Your Bot Detection Collection Requirements
Frequently Asked Questions
What is Kassandra bot detection?
Kassandra is a session-level bot detection system that builds behavioral profiles across the full session rather than making per-request allow/block decisions. It scores navigation flow, request timing distribution, device signal consistency, resource loading patterns, and session volume anomalies. Pipelines that pass per-request fingerprint checks can still be flagged if the session-level pattern — the sequence and timing of requests across the full session — is statistically inconsistent with real user behavior.
How does Kassandra differ from Cloudflare or Akamai bot protection?
Cloudflare and Akamai evaluate individual requests for automation signals — fingerprint values, IP reputation, header consistency. Kassandra focuses on session-level behavioral patterns — the sequence of pages, the timing between them, and whether the session as a whole is consistent with human navigation. These are complementary approaches: some deployments use both per-request detection (Cloudflare as CDN layer) and session-level detection (Kassandra as application-layer analysis). Addressing Kassandra requires session design, not just per-request configuration.
What is the most common reason scraping pipelines fail Kassandra detection?
The most common failure is mechanical request timing — accessing pages at constant, regular intervals rather than with the natural variance of human reading and navigation. Even a pipeline with perfect per-request fingerprints and clean proxies will be flagged by Kassandra’s timing analysis if requests arrive at identical 2-second or 5-second intervals. The second most common failure is direct URL access without navigation context — jumping to data pages without any prior navigation that a real user would perform.
Does Kassandra require CAPTCHA solving?
Kassandra is a behavioral analysis and bot classification system, not a CAPTCHA provider. It typically produces blocks (403/429 responses) rather than CAPTCHA challenges when it classifies a session as automated. Solving CAPTCHAs is not the response to Kassandra detection — redesigning session behavior (navigation flow, timing, resource loading) is. CAPTCHA solving addresses CAPTCHA-based challenges from systems like reCAPTCHA or hCaptcha; Kassandra blocks are resolved by producing sessions that score within human behavioral norms.