ASM Application DDOS Control

Yes, it is the application DDoS attacks and ASM uses multiple ways of protection.

ASM determines if request is from humans by injecting a special JavaScript snippet into the pages you want to protect. This JavaScript detects things like mouse movements,page scrolls, key presses as well the speed of navigation between pages.

ASM can also send a CAPTCHA challenge to tell a human and a bot apart.

You can find the detailed answers to your questions in the F5 ASM manual here:

https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-6-0/1.html?sr=51704887

Hope this helps,

Sam