Managing and Mitigating Bots

Part II. Types of Automated Traffic

As discussed in Part I, there are a wide variety of activities that bots may be accessing your system to carry out. In some cases, these activities might be beneficial to you (or otherwise benign) but often the intent is malicious. When looking at your traffic to identify and manage automated traffic it is essential that you understand the intent of this traffic and how that could impact you as a website owner.

In many cases, even having identified that there is automated traffic hitting your website, it can be difficult to understand what that traffic is up to. Only when you understand the intent is it possible to put in place a management strategy to handle it. Part of understanding the intent is understanding the benefit the bot operators can achieve from the actions they are undertaking.

The chapters in this part will offer some depth in understanding of the most common types of automated traffic and provide background into the intent of that type of traffic.

Alternative Categorization

There are a number of alternative categorizations that have been completed into automated traffic. For example, OWASP’s Automated Threat Handbook groups the threats into 21 different categories (these include security threats that are outside the scope of this book).

To try and further simplify things I have categorized all types of bot traffic under nine broad headings:

• Malicious bots

• Data harvesting

• Checkout abuse

• Credit card fraud

• User-generated content ...