Bot management is software that tells real people apart from automated scripts on a website or app, and blocks or slows down the scripts. A bot is a program that visits a website and acts on it automatically, much faster than a person can. Bot management lets good bots in, such as the ones that search engines use to read websites, and stops the bad ones.
Bad bots do many kinds of work. They buy up concert and match tickets in seconds, to resell them at higher prices. They create thousands of fake accounts to collect sign-up bonuses. They try millions of leaked usernames and passwords on a login page, to find the accounts where people reused a password. This is called credential stuffing. They also copy prices and product details from websites, which is called web scraping.
A bot can be hard to spot. A modern bot uses a real browser. It sends each request from a different home internet connection, so the requests do not all come from one address. So bot management looks at many signals together. Device fingerprinting recognises the same phone or browser when it comes back, even from a new address. Behavioural biometrics checks how the screen is touched and how the mouse moves. People move unevenly, while scripts move in straight lines or not at all. The software also checks how fast the requests arrive, and from where.
When the signals look suspicious, the software sets the visitor a challenge, such as a picture puzzle. A real person solves it in a few seconds. For a bot, each puzzle costs time and money. Some products make the puzzles harder for visitors who look more suspicious. The aim is to make the attack too expensive to be worth running.
Imagine the sale of 25,000 tickets for a cricket final, opening at 12 noon on an online ticketing platform. A reseller has prepared scripts on 40,000 devices to grab tickets in the first ten seconds. Bot management finds that 31,000 of the visitors show no real touch or mouse movement, and have identical browser settings. It sends them puzzles that get harder each time. Most of the scripts fail to get past them. The real fans wait in a virtual waiting room and buy their tickets.
Bot management usually runs together with the web application firewall (WAF), on the security company's network. It also protects login and sign-up pages built with customer identity and access management (CIAM). Attackers now use AI to make their bots behave more like people, and defenders use AI to catch them. The page on AI in cybersecurity explains this contest.