Azion Bot Manager
Azion Bot Manager uses advanced intelligent algorithms that allow machine learning and Reputation Intelligence to analyze the behavior of incoming data. This enables the detection of suspicious traffic and bad bots, facilitating the implementation of preventive measures against malicious activities such as credential stuffing, vulnerability scanning, and site scraping.
This Edge Firewall add-on assigns a score to every request based on rules, behaviors, and Reputation Intelligence. If the score exceeds a predetermined threshold, Bot Manager executes the predetermined action.
By using Bot Manager, you can:
-
Enhance user experience
- Reducing the impact of bots on the entire infrastructure.
- Providing bot protection by IP reputation.
- Defining custom rule management to act on individual bots based on previous content extraction activity from requests.
-
Increase visibility
- Measuring the amount and characteristics of the bot traffic trying to access your website, APIs, and applications.
- Using the observability tools provided by Azion to monitor the malicious activity.
- Combining other integrations to enhance Bot Manager efficiency, through the use of fingerprint, captchas, JavaScript injection, or SDKs, to create robust rules.
-
Reduce financial risk
- Protecting your website and applications against credential abuse, card balance verification, and other forms of online fraud.
Implementation
Azion provides the Bot Manager add-on, a comprehensive solution for bot management. Contact the Sales team for more details on the Bot Manager subscription.
Additionally, a lite version is also available in the Marketplace.
How Azion Bot Manager works
On a high-level, Azion Bot Manager works this way:
- A request reaches a domain using Bot Manager.
- Edge Firewall receives the request.
- Bot Manager starts all the analytics processes, including:
- Retrieving the requested data, including device, browser, and network data, fingerprint, among others.
- Identifying and classifying the request according to advanced intelligent algorithms and Reputation Intelligence.
- Defining the behavior according to the rules engine criteria.
- Bot Manager assigns a score to the request.
- If the score is equal to or higher than the predetermined threshold, the predefined preventive action is executed.
Bot Manager is able to execute 7 different actions whenever the request’s score is greater or equals than the defined threshold:
allow
: allows the continuation of the request.deny
: delivers a standard Status Code 403 response.drop
: terminates the request without a response to the user.redirect
: allows the request to be redirected to a new URL/location when the security threshold is reached.custom_html
: allows customized HTML content to be delivered to the user in case of a threshold violation.random_delay
: makes the function wait for a random period between 1 and 10 seconds before allowing the request to proceed.hold_connection
: holds the request, keeping the connection open for 1 minute before dropping it.
All these actions can be configured for web and mobile applications, as well as APIs, offering protection in different environments.
Use cases
Bot Manager was developed by Azion to attend to use cases involving common practices of malicious bots and traffic.
- Reputation Intelligence
- Bot attacking
- Account takeover
- Credential stuffing
- Vulnerability scanning
- Brute force attacks
- Web scraping
Features
Azion Bot Manager is composed by different features that you can take advantage of.
Reputation Intelligence
By using Reputation Intelligence, Bot Manager establishes an additional security perimeter, cataloging the inbound and outbound traffic, based on Network Lists, maintained and constantly updated by Azion. Through these lists, Bot Manager is able to identify the profile of each request trying to reach your site.
Network Lists used by Bot Manager include criterias such as:
- Tor Exit Nodes
- Reputation
- Proxies
- Malware
- Fraud
Bot classification
Based on the scores and Reputation Intelligence, Bot Manager is able to classify different types of bots and traffic.
-
Legitimate traffic
-
Good bots
- Social network bot
- Monitoring bot
- Aggregator bot
- Enterprise bot
- Search engine bot
-
Bad Bots
- Bad bot signatures
- Malicious intent detected
- Scripted bots
- Malicious browser behavior
- Reputation Intelligence
Device identification
Bot Manager leverages advanced techniques to identify and distinguish between legitimate devices and potentially malicious bots attempting to access your digital assets. It’s capable of generating a user ID for each device.
To further enhance its protective capabilities, it allows for the incorporation of additional security layers through other integrations and resources, such as SDKs, JavaScript injection, and Fingerprint to collect more granular data.
Redirect
One of the actions Bot Manager is able to execute is redirect
. It allows the request to be redirected to a new URL/location, specified in the JSON args, when the security threshold is reached.
Custom HTML
Bot Manager allows customized HTML content to be delivered to the user in case of a threshold violation, thanks to the custom_html
action. You can create a custom message to exhibit to users in case of threshold violation.
Delayed response
This action allows for introducing delays in responses in cases where bots attempt to make requests. It increases the cost of the attack by holding the attacker for a longer time in a request that won’t return a valid response, thereby increasing the probability that the attacker will abort or give up on the attack.
Modes
Azion Bot Manager allows you to define the environment in which the function is expected to run, being API or a web application the possible modes. The default mode is web
. If any value other than the string api
(case-sensitive in lowercase) is provided, the web
mode will be used as the default configuration.
By enabling the api
mode, no Set-Cookie
will be executed, and any rules related to the use of cookies in Bot Manager will be ignored.
Logs
The requests will generate logs that can be seen in Real-Time Events and Data Stream. By analyzing the logs generated by Bot Manager, you can get insights to understand if any changes in the function instance’s JSON Args are needed.
Go to Data Stream referenceGo to real-time events reference
You can also check the Bot Manager graphs in Real-Time Metrics
Additional resources
SDKs
Azion Bot Manager can work together with Software Development Kits (SDKs), for both Android and iOS systems, allowing you to customize and tailor security protocols to meet the specific needs of your mobile applications. With SDKs and Bot Manager, you can implement fine-grained controls, address application-specific vulnerabilities, and adapt to evolving threats more effectively.
You can use SDKs to track mobile devices and identify behaviors (such as touching the screen) and device data (model, manufacturer, operational system, etc.) to use as insights for Bot Manager detect and mitigate malicious threats.
JavaScript injection
When the JavaScript file is inserted in your edge application, it collects data on the actions made by the device used in a request. It’s available for use with web browsers. With JavaScript injection, more data will be collected, such as manufacturer and hardware used, to execute request rules.
This data can be used to create more robust rules and behaviors on the Bot Manager args in order to detect and mitigate threats more effectively.
Rate Limiting
Rate limiting integration establishes thresholds for the number of requests a user or system can make within a specified timeframe, effectively mitigating the impact of brute force attacks or excessive bot activities. By working jointly with rate limiting, the bot management measures gain an additional layer of defense against automated threats.
Fingerprint
A set of information (IP, User-Agent
header) creates a hash for devices accessing your edge applications. The information is gathered by tracing the device’s session and provides a more accurate detailing of the request’s device, increasing the precision of Bot Manager logs.
If you use Fingerprint with Bot Manager, you can also enable the use of Azion Real-Time Metrics to query consolidated data via GraphQL API related to the access to the application protected by Bot Manager, facilitating the identification of patters and use this intelligence to optimize the rules. With this feature, you can define a threshold and take a specific action when the threshold is violated and the device or user is identified as malicious, based on the fingerprint data.
Captcha
By using the redirect
action, the defined URL/location can contain a Captcha integration to add an additional security layer. It helps you to increase security and malicious traffic detection, challenging all the request previously violating any threshold to guarantee is legitimate.
Custom rules
Azion will provide you with easy-to-go configurations, that should be enough for most of the cases. If you need a more detailed configuration, you can add new custom rules based on your business needs. It’s also possible to add more criteria and behaviors to be executed by the Rules Engine, building more comprehensive responses to possible attacks.