CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of Indian Provisional Application No. 201841037449 filed on Oct. 4, 2018, the contents of which are hereby incorporated by reference.

TECHNICAL FIELD

The embodiments herein relate to a field of computer networks. The present invention is particularly related to detecting malicious activities in computer networks, and especially related to detecting bots.

BACKGROUND

A “bot” usually refers to a computer program that is used to access web properties like websites and Application Programming Interface (API)s. Bots are typically used for performing malicious activities like content scraping, spamming, account takeover and advertising fraud. Many bots spoof their user agent to masquerade as a legitimate popular browser running on a legitimate device.

Moreover, a bot detection refers to techniques, which classify a visitor accessing a web property as human or bot. A detection of spoofing of browsers/apps and devices is one of the approaches to bot detection. The bot detection is performed using multiple sources of information. These sources of information include the HTTP headers associated with the requests made by the clients and a profile of the client-side JavaScript or mobile app stack present in the client browser or mobile app. For example, certain HTTP headers are supported only by certain browser versions. Similarly, certain JavaScript® or mobile app features are only supported by certain browser or app versions. Inconsistencies in headers and JavaScript profile are commonly used to detect bots. The prevailing techniques for JavaScript profile-based bot detection are rule-based. In these techniques, rules which catch specific inconsistencies are hand-crafted by a human and these rules are used to detect bots.

However, the Internet consists of billions of users using tens of thousands of web browsers, applications, and device configurations, with numerous versions. New kinds of devices and browsers are also emerging at a high rate. This also increases a diversity of HTTP headers and client JavaScript and mobile app stack associated with the clients/browsers. This high level of diversity and dynamicity limits an applicability of the hand-crafted rule-based solutions to detect spoofing. New rules need to be developed and existing rules need to be improved at a high rate. Maintaining the rule set involves a significant amount of human data analysis and experimentation. Thus, a manual hand-crafting of the rules is not enough to detect spoofing at web scale. Despite the limitation of hand-crafted rules, there has been little attention on automated machine learning-based techniques to detect bots based on the client-side JavaScript or mobile app profile.

In view of the above discussion, there is a need for bot detection techniques that would overcome the deficiencies noted above.

SUMMARY

A summary of several example embodiments of the disclosure follows. This summary is provided for the convenience of the reader to provide a basic understanding of such embodiments and does not wholly define the breadth of the disclosure. This summary is not an extensive overview of all contemplated embodiments and is intended to neither identify key or critical elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later. For convenience, the term “some embodiments” or “certain embodiments” may be used herein to refer to a single embodiment or multiple embodiments of the disclosure.

Certain embodiments disclosed herein include a method for detecting bots. The method includes receiving a request to access a server, the request is being received from a client device, and responsive to the request, causing the client device to download a script code file to the client device. The script code file, when executed, collects a profile, and the profile includes a plurality of parameters. The method also includes receiving the created profile, generating a score based on the plurality of parameters to identify a bot, and initiating a mitigation action based on the identified bot.

Certain embodiments disclosed herein also include a non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting bots. The process includes receiving a request to access a server, the request is being received from a client device, and responsive to the request, causing the client device to download a script code file to the client device. The script code file, when executed, collects a profile, and the profile includes a plurality of parameters. The method also includes receiving the created profile, generating a score based on the plurality of parameters to identify a bot, and initiating a mitigation action based on the identified bot.

Certain embodiments disclosed herein also include a system for detecting bots. The system includes a processing circuitry, and a memory. The memory contains instructions that, when executed by the processing circuitry, configure the system to receive a request to access a server, the request being received from a client device, responsive to the request, cause the client device to download a script code file to the client device. The script code file, when executed, collects a profile, the profile includes a plurality of parameters. The system is also configured to receive the created profile, generate a score based on the plurality of parameters to identify a bot, and initiate a mitigation action based on the identified bot.

