Low touch integration of a bot detection service in association with a content delivery network
A server interacts with a bot detection service to provide bot detection as a requesting client interacts with the server. In an asynchronous mode, the server injects into a page a data collection script configured to record interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data to the server. After the client receives the page, the sensor data is collected and forwarded to the server through a series of posts. The server forwards the posts to the detection service. During this data collection, the server also may receive a request from the client for a protected endpoint. When this occurs, and in a synchronous mode, the server issues a query to the detection service to obtain a threat score based in part on the collected sensor data that has been received and forwarded by the server. Based on the threat score returned, the server then determines whether the request for the endpoint should be forwarded onward for handling.
1. A method to integrate bot detection in association with an overlay network customer environment, comprising:
receiving an overlay network customer configuration that includes identification of an endpoint to be protected against a bot attack;
as a page that includes a reference to the protected endpoint is returned to a requesting client, and in an asynchronous mode of operation, injecting into the page a reference to a data collection script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receiving and forwarding collected sensor data to a bot detection service;
responsive to intercepting a request for the endpoint, and in a synchronous mode of operation, issuing a query to the bot detection service to obtain a threat score associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determining based at least in part on the threat score received in response to the query whether the request for the endpoint should be forwarded onward for handling.
2. The method as described in claim 1 wherein the request for the endpoint is not forwarded upon a determination that the threat score is indicative of the requesting client being a bot.
3. The method as described in claim 1 wherein the query is issued while the requesting client continues to interact with the page locally.
4. The method as described in claim 1 wherein the page is associated with an overlay network customer workflow that involves collection of sensitive data.
5. The method as described in claim 4 wherein the workflow is one of: a checkout, a search and a login.
6. The method as described in claim 1 wherein the data collection script is injected into the page by including a JavaScript tag in a response body of the page.
7. The method as described in claim 1 further including enriching the collected sensor data prior to delivering the sensor data to the bot detection service.
8. The method as described in claim 1 wherein the collected sensor data is forwarded to the bot detection service continuously as the collected sensor data is received.
9. The method as described in claim 1 wherein the collected sensor data is delivered to the bot detection service via one or more JavaScript Object Notation (JSON)-formatted POST requests.
10. The method as described in claim 9 wherein a particular JSON-formatted POST request is associated with a behavioral action occurring locally at the requesting client.
11. The method as described in claim 1 wherein the query is issued to an Application Programming Interface (API) of the bot detection service.
12. The method as described in claim 11 wherein the collected sensor data is posted asynchronously to the bot detection service via the API.
13. Apparatus, comprising:
a hardware processor;
computer memory configured to hold computer program instructions executed by the hardware processor to integrate bot detection in association with an overlay network customer environment, the computer program instructions comprising program code configured to:
receive an overlay network customer configuration that includes identification of an endpoint to be protected against a bot attack;
as a page that includes a reference to the protected endpoint is returned to a requesting client, and in an asynchronous mode of operation, inject into the page a data collection script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receive and forward collected sensor data to a bot detection service;
responsive to intercepting a request for the endpoint, and in a synchronous mode of operation, issue a query to the bot detection service to obtain a threat score and other information associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determine based at least in part on the threat score whether the request for the endpoint should be forwarded onward for handling.