There's a great resource on the techniques the bots and the bot detectors use, beside rate limiting IP addresses (creepjs is a personal favorite). [1]

[1] https://bot.incolumitas.com/ Expand all Sources/Links under 'More Sources/Information'