There are two approaches to countering bots. They are client-side protection and server-side analysis.
Client-side protection is the most obvious approach - brute force, in a sense. You make all efforts to ensure that the game client is fully legitimate, has not been tampered with, and no other programs affect it. Now this is a difficult problem, and impossible to fully solve. But many games try, and have some success with this method. I know there exist some ready-made solutions for client protection, and suggest you look for them. Implementing one yourself is a daunting task.
In addition to being less then 100% effective, client-side protection has the drawback of being extremely annoying for your players. Usually it implies things like disabling alt-tab task switching, antivirus programs, etc.
Server-side analysis is less intrusive. In this approach, you have some server code that analyses patterns in players' behavior. Most often, bots play demonstrably different. For example, human players have varying time between actions (such as shooting), and this time obeys a bell-curve distribution. Primitive bots will have constant time, or distributed evenly over some interval. Fun fact: using this method, we once caught a player with a mechanical bot - a clever device that pushed buttons on his physical keyboard. Needless to say, not amount of client protection can catch that. Still, this analysis is not perfect. More advanced bots will fool your systems, and the more checks you implement, the more advanced bots would become.
For best protection, you can combine both these methods. Client protection will make it harder to develop bots, and server analysis will stop simple bots that were developed quickly. But whatever you do, you can never stop bots entirely. Well, unless you send your representatives to players' homes, to supervise their playing and report violations. (Which is not unheard of, by the way. I've definitely read a story about online poker company sending people to a very successful player's home, to confirm he was playing legitimately. But I can't seem to find it now.)
There are two more dubious recommendations for fighting bots. One, encrypt your network traffic. I don't think this is gonna work. With your client in the hands of an enemy, traffic can be and will be decrypted... or you own client will be used for encryption. On the other hand, encryption adds lag, and that is really bad for a "real-time shooter". Second recommendation is "just design your game around this". While this seems like a sound idea, I've yet to see a single game that managed this.