Bot Definition

What is a Bot?

A bot is an automated program designed to achieve a particular purpose. Bots can be used for both benign and malicious purposes; however, most bots are designed for malicious ones, so organizations commonly implement anti-bot defenses on their websites.

How Does a Bot Work?

A bot is a program that is designed to automatically perform some function. Bots can browse and interact with websites, have conversations with users, and scrape information from the Internet. Almost anything a human can do on the web, a bot can be programmed to do as well.

Bots take advantage of the fact that websites have a structure that can be analyzed by a program. For example, in the HTML standard, hyperlinks within a page can be identified by the <a> tag. A bot could use this knowledge to navigate and map out connections between pages on a website.

Alternatively, a bot could explore a website and copy the content from each of its web pages. This practice — called scraping — can have various applications. For example, a web scraper could be used to set up a fake copy of a website for use in phishing attacks. Alternatively, a company could scrape the websites of its competitors to undercut them on prices or find ways to defeat their marketing strategies.

Good Bots vs. Bad Bots

Bots can be used for a variety of different malicious purposes. They are key to many automated attacks such as credential stuffing and distributed denial of service (DDoS) attacks. Since bots can perform actions much more quickly than human users, they make these attacks faster and more scalable.

However, not all bots are bad. In fact, bots are essential to the operation of certain key parts of the Internet. For example, Search engines like Google and Bing rely on bots to crawl and map out the Internet for them. After mapping and indexing available websites, these search engines are able to respond to your search queries by pointing you to the right site. Without bots, keeping up with the evolution of the Internet (including the creation of new pages and updates to existing ones) would be impossible for these search engines.

Protecting Against Malicious Bots

While bots have legitimate applications, many bots are malicious. Even if a bot isn’t actively attempting to attack an organization and its customers, passive activities like web scraping consume the resources of a web server tasked with responding to a bot’s requests. Every bot — benign or malicious — costs an organization money and decreases its ability to respond to the requests of legitimate, human users.

For this reason, many websites implement defenses designed to differentiate between bots and human users. Some examples of anti-bot defenses include:

• CAPTCHA: The Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) differentiates between bots and humans by setting problems that are easy for humans or hard for computers. This could involve identifying text in a messy image or images that contain a bus, bicycle, or other feature.
• Browser Fingerprinting: Websites may collect information from HTTP headers to attempt to fingerprint the browser that is making the request. Requests from browsers that are known to be used by automated software or that don’t match legitimate browsers may be blocked.
• Event Tracking: A website may monitor for events triggered by the use of a mouse or keyboard on a website. If a user doesn’t use either of these, it’s probably a bot.

Conclusion

Bots are automated tools that have both legitimate and malicious applications. Many websites implement anti-bot defenses to ensure that their resources are only consumed by legitimate, human users and to protect against potential automated attacks such as credential stuffing, DDoS, and web scraping.