How does it 'learn' what is illegitimate traffic? (An actual explanation rather than just vague claims/graphs would be truly "frickin' awesome".)

What's the risk it misclassifies real surges in interest as illegitimate traffic?