WAF and bot detection

Design a WAF and bot-detection system fronting an e-commerce platform that sees 3M requests/sec, including aggressive scrapers, inventory-hoarding bots, and credential-stuffing attacks. It must block malicious traffic inline with <5ms added latency, distinguish sophisticated headless-browser bots from real shoppers, and avoid blocking legitimate users (false positives cost revenue). Cover the inline filtering pipeline, the signals you use to score traffic, and the precision-vs-recall trade-off.