What is Bot Detection?
Fraudsters are in the business of cybercrime to make money. They are willing to put in efforts and resources commensurate with the profit they can make from an attack. A handy and cost-effective tool that allows them to launch attacks at scale and speed is automation scripts and bots.
A bot is an automated application or script that can mimic human behavior - to varying degrees of sophistication - and come in all shapes and sizes, both legitimate and malicious. Bot scripts are widely and cheaply available-some of them even come with customer support!
There are some estimates that bots now constitute nearly half of all internet traffic. Since they can be powerful tools in delivering web services at scale and low cost, they are similarly exploited by fraudsters looking to maximize their profits. The ability to launch thousands of attacks in parallel makes bots much more scalable than humans. This also makes it possible for wannabe fraudsters-with little or no technical knowledge-to launch large-scale attacks.
The Six Stages of a Bot Attack
Fraudsters study the fraud defenses businesses deploy to exploit the loopholes. This knowledge also allows them to tailor their attacks using appropriate resources that fetch them maximum gain with the least investment. A bot attack, typically, follows the six stages explained below:
- Stage 1: In the first stage, a site administrator updates the workflows and introduces a web security product. This update detects all existing bots as their default scripts cannot keep up with the changed workflow.
- Stage 2: To overcome this latest hurdle, bot operators scale their botnet to thousands of nodes that are hosted in cloud providers across diverse countries. This enables them to randomize their HTTP header signature.
- Stage 3: When the attacks continue to fail, fraudsters re-evaluate the workflow and study the latest web security protection introduced by the business. They identify the type of information that the security product collects; and use it to update the bot script with a 'good fingerprint'. They also try to juggle or randomly change the data points and evaluate the results. If they find that the security product uses persistent ID or cookies, they try to harvest them from legitimate user sessions and replay them from a botnet.
- Stage 4: If the efforts in stage 3 fail, fraudsters try to send random data to trigger an exception, which can cause the product to 'fail safe' and disable the defense.
- Stage 5: Fraudsters use selenium or headless chrome to upgrade the botnet to a headless browser-one that can run JavaScript-and simulate human behavior, which includes key presses, mouse movements, and clicks.
- Stage 6: In an instance where all the techniques fail against the upgraded security product, fraudsters may switch over to human-driven fraud-of course if it is cost-efficient.
Bot-Driven Fraud Attacks Are On The Rise
It is estimated that more than 74% of attacks in Q1 2020 were bot-driven. This is primarily because consumers now use multiple digital channels-desktops, laptops, mobiles, and gaming consoles-to transact. Further, APIs have opened up yet another attack surface. As a result, fraudsters have found multiple entry points to target. Fraudsters target this increasing traffic using bots and automated scripts not only to scale their attacks but also to make the attacks more cost-efficient. Bots and scripts are easily available on the internet and don't cost a lot.
Bots are generally used for credential testing, credential stuffing, spam and abuse, and card testing. However, depending on the defenses deployed by the target businesses, fraudsters can choose the sophistication of the bots and use them in multiple ways to tailor their attacks. These include:
-
High-Volume Attacks:
Often, basic bots are used to scale up the attacks. Even when using basic or unsophisticated bots, fraudsters can pile up their exploits. This is because of the volume these bots help achieve. When the volume is high, even a fraction of bots succeeding can translate into massive financial gain for fraudsters. For instance, spam, which is a low-value, high-volume activity needs only a few users to click malicious links to make the attack profitable.
-
Low and Slow Attacks:
To orchestrate a long-term attack, fraudsters often lie low initially. They deploy bots for the initial groundwork. These bots copy human behavior and spoof identifying characters to evade bot mitigation solutions. For instance, attacking peripheral customer touchpoints such as fake reviews, up/down voting videos, and abusing in-game economies, which fetches fraudsters money.
-
Evading Detection:
Sophisticated, advanced bots are automated scripts that use machine vision technology to circumvent detection. These bots can impersonate true users with a fairly high accuracy rate. Therefore, fraudsters use them to fool bot mitigation solutions.
-
Hybrid Attacks:
This is a combination of bots and human fraud farms-low-wage laborers who launch attacks on behalf of the fraudsters. Sweatshops takeover when bots fail to overcome fraud-prevention mechanisms that need more nuanced human interaction.
Why Must Businesses Address This Threat?
Digital is the flavor of global commerce, today. This increased digital interaction is becoming the cannon fodder for increased fraud. Combine this with the fact that bots are becoming cheaper, easily available, more sophisticated, and easily deployable; and you have a perfect recipe for a large-scale bot-driven attack.
To make matters worse, fraudsters are in the know of the parameters that businesses use in detection and mitigation of bot-driven attacks. They have devised ways to manipulate and circumvent these defenses at scale. They can use the anonymity of the internet to hide their true location and spoof IP addresses and legitimate customer devices. Today, bots are well-trained in machine vision technology that enables them to easily bypass CAPTCHAs. Further, mass manipulation of digital identities can successfully fool data-driven solutions, as bots can mimic genuine users.
Businesses, therefore, have become more vulnerable to bot-driven attacks and they must make every effort to stop this onslaught to protect the business and preserve customer experience.
Limitations of Traditional Approaches
Traditionally, businesses have followed three main approaches to detect and fight bot-driven attacks. However, the inherent limitations of these approaches make it difficult to effectively ward off the threats of evolving bots:
- Blocking Traffic: Some of the prevalent bot defense solutions block all traffic that appears suspicious. However, with bots impersonating true users and true users displaying anomalous behavior, there is a high probability of good customers getting blocked while bots pass through. Blocking good customers can also cause dissatisfaction and customer churn, which in turn, can damage the bottom line and brand reputation.
- Risk scoring traffic: As bot attacks evolve to become more sophisticated, traditional risk scoring is losing its efficacy. Mass manipulation of digital identities has rendered risk scores less reliable. Further, since this method involves manual review of the scores that aren't explicitly accepted or rejected, it delays decisioning, allowing bots to pass through. In addition, many organizations are struggling to deal with an information overload emanating from complex tech stacks.
- CAPTCHA: Initially designed to stop automated attacks, innovations in bot technology have rendered CAPTCHAs near-redundant-they can now be solved with easily available (and possibly free) automatic solvers. Instead of blocking bots, CAPTCHAs end up causing unnecessary friction for good customers. Further, they are ineffective against a hybrid attack, which uses a combination of bots and humans. Since most CAPTCHAs are free or nearly-free, they neither come with support services nor provide businesses with any insights into the attack patterns.
Creating an online business ecosystem that enjoys the trust of the customers is critical to thriving in the digital economy. Digital businesses are, therefore, obliged to offer a seamless and safe digital experience to their customers.
A layered approach to bot detection
Arkose Labs offers a new approach to eliminating automated fraud and bot-driven attacks. Traditional mitigation-focused strategies sacrifice eliminating bot activity for user experience - or vice versa. Arkose Labs, however, eradicates bot activity while also improving customer throughput rates. This is critical to creating customer trust and loyalty and ensuring business success.
The efficacy of the Arkose Labs approach means it is the only vendor to provide a 100% commercial SLA against automated attacks. The platform combines real-time intelligence, rich analytics, and sophisticated step-up challenges to eliminate the ROI of fraud. As fraudsters are forced to consume more time and money to attack a site, they will abandon their efforts once it becomes economically unfeasible. The platform also constantly adapts to evolving attack patterns.
The hallmarks of the Arkose Labs platform include:
- Continuously evolving detection methods that detect patterns using probabilistic, statistical, and machine learning-based models.
- Presents challenges based on the risk assessment of a user and adapts to the growing risk of the user.
- Utilizes a feedback loop between the dynamic risk engine and challenge-response mechanism to facilitate improved risk predictions.
- Provides clients with actionable insights, which include analysis of and visibility on bot vs human traffic.
Click here to learn more about how Arkose Labs can help your business eliminate automated attacks.
