That's their trade secret but distills down to measuring all the various factors that a person actually reading a page would do: time, scroll speed/depth, click rate/location, previous history, mouse movements, http, ip, network traffic, browser profiles, etc.

Although these days with headless chrome and how easy it is to just record and replay someone's session, it becomes incredibly hard to detect with accuracy, especially while trying to not affect browsing behavior beyond the typical ad load experience.

There is lots of overlap with this and other security-focused companies that work with financial and government companies to protect their own websites and apps, although it's easier when you own and control the site, proxies and backend.