System and method for detecting bots using semi-supervised deep learning techniques
A system of method of detecting bots are presented. The method includes receiving access patterns of a visitor accessing a protected web property, encoding each of the access patterns into a fixed length feature vector, determining an offline-trained model based on past data, generating an anomaly score based on the fixed length feature vector and an offline-trained model, and determining the visitor to be a bot, when the generated anomaly score associated with the visitor reaches a predetermined threshold.
1. A method for detecting bots, comprising:
receiving access patterns of a visitor accessing a protected web property;
encoding each of the access patterns into a fixed length feature vector;
generating an anomaly score based on the fixed length feature vector and an offline-trained model;
determining the visitor to be a bot, when the generated anomaly score associated with the visitor reaches a predetermined threshold;
identifying a cluster based on the fixed length feature vector; and
taking a mitigation action against the determined bot and the identified cluster.
2. The method of claim 1 , wherein the mitigation action includes at least one of: displaying a blocking page, displaying a Completely Automated Public Turing Test (CAPTCHA) challenge, or enforcing multi-factor authentication.
3. The method of claim 1 , further comprising:
providing a feedback to construct a model setting, the model setting includes the predetermined threshold for the anomaly score.
4. The method of claim 1 , further comprising:
employing intent deep behavior analysis (IDBA) to capture common patterns present in the determined bot.
5. The method of claim 1 , wherein the access pattern of the visitor is received by collecting information gathered from any one of: an application parameter and a JavaScript parameter through a server-side Application Programming Interface (API) call.
6. The method of claim 1 , further comprising:
determining an offline-trained model based on the past data; and
generating the anomaly score and the cluster based on the offline-trained model.
7. The method of claim 1 , wherein the offline-trained model is trained using labeled data.
8. The method of claim 1 , wherein a plurality of botnets are identified as the cluster using Density-Based Spatial Clustering of Applications with Noise (DBSCAN).
9. A method for detecting bots comprising:
receiving access patterns of a visitor accessing a protected web property;
encoding each of the access patterns into a fixed length feature vector;
generating an anomaly score based on the fixed length feature vector and an offline-trained model;
determining the visitor to be a bot, when the generated anomaly score associated with the visitor reaches a predetermined threshold; and
employing intent deep behavior analysis (IDBA) to capture common patterns present in the determined bot.
10. A system for detecting bots, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
receive access patterns of a visitor accessing a protected web property;
encode each of the access patterns into a fixed length feature vector;
generate an anomaly score based on the fixed length feature vector and an offline-trained model; and
determine the visitor to be a bot, when the generated anomaly score associated with the visitor reaches a predetermined threshold;
identify a cluster based on the fixed length feature vector; and
take a mitigation action against the determined bot and the identified cluster.
11. The system of claim 10 , wherein the mitigation action includes at least one of: displaying a blocking page, displaying a Completely Automated Public Turing Test (CAPTCHA), or enforcing multi-factor authentication.
12. The system of claim 10 , wherein the system is further configured to:
provide a feedback to construct a model setting, the model setting including the predetermined threshold for the anomaly score.
13. The system of claim 10 , wherein the system is further configured to:
employ Intent Deep Behavior Analysis (IDBA) to capture common patterns present in the determined bot.
14. The system of claim 10 , wherein the access pattern of the visitor is received by gathering information gathered from any one of: an application parameter and a JavaScript parameter through a server-side Application Programming Interface (API) call.
15. The system of claim 10 , wherein the system is further configured to:
determine an offline-trained model based on the past data; and
generating one of the anomaly score and the cluster based on the offline-trained model.
16. The system of claim 10 , wherein the offline-trained model is trained using labeled data.
17. The system of claim 10 , wherein a plurality of botnets are identified as the cluster using Density-Based Spatial Clustering of Applications with Noise (DBSCAN).