Here at Incapsula we actually use some of these methods for bot detection (i.e. JS and Cookie challenges) but I`m not sure about the page-view-time metric.
For one thing, you want to detect and block malicious bots as quickly as possible and there are better things you can do then to wait around, even if it's just for a short while.
I also have to agree (+1) with @yfeldblum about the Expire headers and their ability to interrupt resource-load based tests. Having said that, CND and Multiple servers are not an issue if the challenges are performed by the CDN provider himself.
I also wanted to contribute few other ideas for bot detection:
- Behavior (early access to robots.txt of lack of it)
- HTTP Header order/missing parameters
Also, I would like to suggest not to rely exclusivity on any of these methods because this will lead to false positive identification. Instead, try to combine them into a step-by-step cross verification process.
(i.e. JS challenge -if failed-> Cookie challenge -if failed->Robots.txt access and so on....)
Finally, at some point you'll have to start collecting and relying on signatures to minimize redundancy.
After all, you can't keep testing Baidu bot every time it visits, this is just one step away from a self-inflicted DDoS. :)