www.helpnetsecurity.com Open in urlscan Pro
34.218.126.5  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - editor's choice selection of topics (twice per month)</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1727057525"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Dan Pinto, CEO, Fingerprint
September 20, 2024
Share


HOW TO DETECT AND STOP BOT ACTIVITY



Bad bot traffic continues to rise year-over-year, accounting for nearly a third
of all internet traffic in 2023. Bad bots access sensitive data, perpetrate
fraud, steal proprietary information, and degrade site performance. New
technologies are enabling fraudsters to strike faster and inflict more damage.
Bots’ indiscriminate and large-scale attacks pose a risk to businesses of all
sizes in all industries.



But there are techniques your business can adopt to address this malicious
activity. By leveraging advanced, multi-layered strategies to block bots, the
following categories of techniques will highlight who—or what—is visiting your
website, enabling you to restrict access to unwanted visitors.

Unfortunately, there is no magic, one-size-fits-all solution. Combining these
approaches empowers you to create a robust defense against bots.


TECHNIQUES TO DETECT BOTS

While not all bots are malicious, even “good” bots (such as search engine
crawlers) can potentially hinder performance and skew analytics. Visitor insight
is critical to appropriately managing all threat types and generating accurate
visitor analytics.

To identify bot activity, companies have traditionally relied on red flags like:

 * Traffic spikes
 * High bounce rates
 * Short sessions
 * Strange conversion patterns
 * Impossible analytics (such as billions of page views)

Unfortunately, by the time you spot these signs, it’s often too late to prevent
damage. Advanced bots may not even set off these alarms because many detection
tools fail to keep up with changing bot technology.

Turning to more robust techniques that evaluate technical characteristics and
behavioral data gives you the power to turn back malicious or uninvited bots.


DEVICE CHARACTERISTICS

Browser and device attributes can be an indication of bots. There are several
facets to consider.

IP ADDRESSES

Specific IP addresses and proxies are known to host bots. A robust bot detection
system should leverage a frequently updated database of identified
bot-associated IPs, data centers, malicious proxies, and other sources linked to
automated activity. While constantly changing bot IPs mean this solution is not
foolproof, a dynamic blocklist adds a strong verification signal.

HARDWARE AND SOFTWARE CONFIGURATIONS

Analyzing a device or browser’s characteristics and settings uncovers suspicious
visitors. Sites can examine device attributes like screen dimensions, OS,
storage, memory, processors, and graphics rendering capabilities to identify
configurations that deviate from baselines. Browser-related factors include how
a client executes JavaScript, renders pages, and handles other interactive
tasks.

Significant variances from expected behavior are strong indicators of
bot-generated traffic. Inconsistencies between reported attributes, such as a
mismatched time zone and IP address, also indicate potential manipulation.

LEAKED DATA

Bots leak data that human users do not, such as errors, network overrides, and
API changes. Looking for this information allows websites to block unwanted
visitors.

Device fingerprinting aids bot detection by using device and browser attributes
to create a unique identifier. This approach reveals inconsistencies and unusual
configurations that could signal bot activity. To escape detection, bots would
need to create a different and realistic device fingerprint per visit to the
website.


AUTHENTICATION AND VERIFICATION TECHNIQUES

Robust authentication and verification techniques help block automated bots from
accessing accounts, filling out forms, or contributing content (e.g., product
reviews).

CAPTCHAS AND CHALLENGE-RESPONSE TESTS

These tests are a longstanding strategy against bots, but they may have outlived
their usefulness. We’ve all selected the pictures of cars or typed in characters
from an image. Not only are CAPTCHA tests annoying to users, but they aren’t
that effective. Studies show robots are actually better than humans at solving
these puzzles.

Challenge-response tests can be slightly more secure but still create
significant friction for real users. If you choose to use these tests, you
should also employ additional security measures like risk-based authentication.

MULTI-FACTOR AUTHENTICATION (MFA)

Bots can easily circumvent passwords through credential stuffing. MFA enhances
security by requiring additional verification steps, such as providing a code or
a biometric. Bots may be able to guess a password, but they likely won’t have
access to the second factor, making this a solid additional layer of security.

Device fingerprinting enhances these authentication strategies. When a login
attempt comes from a new device or location, you can enable additional security
steps, such as MFA. This approach also allows you to catch logins for multiple
accounts coming from a single device, which can be another sign of bots.


BEHAVIORAL ANALYSIS

A site visitor’s behavior gives insight into its legitimacy. Automated programs
act much differently than a real person would. There are several ways to
evaluate behavior.

PAGE INTERACTIONS

Mouse movements, scrolling cadence, and page element engagements are key
indicators. Humans complete these actions intermittently and randomly, while
bots are systematic and consistent. Rapid scrolling, clicking, and login
attempts signal potential bot activity.

NAVIGATION

Examine user movement between pages and time spent on each page. Bots quickly
move through many pages, following predictable URL patterns. Humans spend longer
on each page and navigate more randomly as they deliberately search for
information.

FORM COMPLETION

Bots can fill out multiple fields instantaneously, usually with repetitive,
predictable or nonsensical information. Telltale signs of a human filling out a
form include making and fixing typos or skipping optional fields.

However, evaluating behavior manually is slow, prone to error, and
resource-intensive. Detecting bots in real time requires data collection and
analysis tools. Machine learning (ML) enhances the capabilities of these
platforms. By analyzing billions of data points, ML programs continuously learn
and adapt to identify bot-like behaviors as techniques evolve.

You can also exploit bots’ automation by setting traps with a “honeypot.” These
decoy websites mimic real sites but are isolated and monitored. Humans won’t
find them, but bots will. If a visitor interacts with the site, such as clicking
or filling a field, you will know it is an automated program and can take
appropriate action, like blocking the IP address from your site.


A MULTI-LAYERED APPROACH

Relying on only one of these approaches is inadequate to detect bots and has a
high chance of impacting many legitimate users, all while missing a significant
proportion of advanced automated scripts.

The ideal strategy encompasses behavior, device characteristics and
authentication techniques. Bot detection tools leveraging device intelligence
provide detection capabilities by combining fingerprinting with intention
analysis.

When you can assess device attributes and user behavior together, suspicious
user detection becomes more accurate. A solution with ML further enhances
analysis capabilities and keeps pace with growing bot sophistication. With this
level of precision, you can confidently flag or block bots while reducing
friction for legitimate users.

Bots are getting more advanced, but so are the tools to thwart them. Instead of
taking an outdated approach with legacy tools and mindsets that have not kept up
with evolving technology, businesses need to adopt a new, more updated approach
to detect bad bots. Using technology like device intelligence can enable
businesses to proactively take action to prevent malicious activity rather than
just mitigating damage.





More about
 * access management
 * authentication
 * bot
 * cybersecurity
 * device fingerprinting
 * Fingerprint
 * opinion
 * strategy

Share


FEATURED NEWS

 * How to detect and stop bot activity
 * Striking the balance between cybersecurity and operational efficiency
 * Windows users targeted with fake human verification pages delivering malware

eBook: Navigating compliance with a security-first approach



SPONSORED

 * eBook: Cloud security skills
 * Download: The Ultimate Guide to the CISSP
 * eBook: Do you have what it takes to lead in cybersecurity?




DON'T MISS

 * How to detect and stop bot activity
 * Striking the balance between cybersecurity and operational efficiency
 * Rising identity security risks: Why organizations must act now
 * Windows users targeted with fake human verification pages delivering malware
 * Patch this critical Safeguard for Privileged Passwords auth bypass flaw
   (CVE-2024-45488)




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - editor's choice selection of topics (twice per month)
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2024 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×