That's their trade secret but distills down to measuring all the various factors that a person actually reading a page would do: time, scroll speed/depth, click rate/location, previous history, mouse movements, http, ip, network traffic, browser profiles, etc.

Although these days with headless chrome and how easy it is to just record and replay someone's session, it becomes incredibly hard to detect with accuracy, especially while trying to not affect browsing behavior beyond the typical ad load experience.

There is lots of overlap with this and other security-focused companies that work with financial and government companies to protect their own websites and apps, although it's easier when you own and control the site, proxies and backend.

Pages viewed/clicked per second. Some sites contain tiny little links that no human should every click, but a bot might. Others get more advanced by comparing visors. If a group of visitors all display the same pattern (think near identical behavior) then they are bots.