A network device comprising: a network interface configured to receive packets of a network session; a flow table to store packet flow information for the network session; and a control unit having one or more processors, the control unit comprising: a reassembly module configured to assemble network session data for the network session from the packets, the network session data comprising application-layer data and packet flow data for the network session; a bot detection module configured to: calculate a plurality of scores for the network session based on a plurality of metrics applied to the network session data, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, and wherein each of the scores represents a likelihood that the network session is originated by an automated software agent; apply each of a plurality of weighting values to a respective one of the plurality of scores based on at least one of an application or protocol of the network session; aggregate the plurality of scores to produce an aggregate score, wherein the aggregate score is produced after having applied the weighting values to the plurality of scores for the aggregate of the plurality of scores; determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold; and an attack detection module configured to execute a programmed response when the network session is determined to be originated by an automated software agent. a network interface configured to receive packets of a network session; a flow table to store packet flow information for the network session; and a control unit having one or more processors, the control unit comprising: a reassembly module configured to assemble network session data for the network session from the packets, the network session data comprising application-layer data and packet flow data for the network session; a bot detection module configured to: calculate a plurality of scores for the network session based on a plurality of metrics applied to the network session data, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, and wherein each of the scores represents a likelihood that the network session is originated by an automated software agent; apply each of a plurality of weighting values to a respective one of the plurality of scores based on at least one of an application or protocol of the network session; aggregate the plurality of scores to produce an aggregate score, wherein the aggregate score is produced after having applied the weighting values to the plurality of scores for the aggregate of the plurality of scores; determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold; and an attack detection module configured to execute a programmed response when the network session is determined to be originated by an automated software agent. a control unit having one or more processors, the control unit comprising: a reassembly module configured to assemble network session data for the network session from the packets, the network session data comprising application-layer data and packet flow data for the network session; a bot detection module configured to: calculate a plurality of scores for the network session based on a plurality of metrics applied to the network session data, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, and wherein each of the scores represents a likelihood that the network session is originated by an automated software agent; apply each of a plurality of weighting values to a respective one of the plurality of scores based on at least one of an application or protocol of the network session; aggregate the plurality of scores to produce an aggregate score, wherein the aggregate score is produced after having applied the weighting values to the plurality of scores for the aggregate of the plurality of scores; determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold; and calculate a plurality of scores for the network session based on a plurality of metrics applied to the network session data, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, and wherein each of the scores represents a likelihood that the network session is originated by an automated software agent; apply each of a plurality of weighting values to a respective one of the plurality of scores based on at least one of an application or protocol of the network session; aggregate the plurality of scores to produce an aggregate score, wherein the aggregate score is produced after having applied the weighting values to the plurality of scores for the aggregate of the plurality of scores; determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold; and an attack detection module configured to execute a programmed response when the network session is determined to be originated by an automated software agent.