The behavior of AI crawlers is essentially application-layer (L7) resource exhaustion, and because their request patterns more closely resemble those of legitimate users, they are harder to identify and mitigate through traffic characteristics than traditional DDoS attacks.