Low touch integration of a bot detection service in association with a content delivery network
A server interacts with a bot detection service to provide bot detection as a requesting client interacts with the server. In an asynchronous mode, the server injects into a page a data collection script configured to record interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data to the server. After the client receives the page, the sensor data is collected and forwarded to the server through a series of posts. The server forwards the posts to the detection service. During this data collection, the server also may receive a request from the client for a protected endpoint. When this occurs, and in a synchronous mode, the server issues a query to the detection service to obtain a threat score based in part on the collected sensor data that has been received and forwarded by the server. Based on the threat score returned, the server then determines whether the request for the endpoint should be forwarded onward for handling.
1. A method to integrate a detection operation in association with an overlay network customer environment, comprising:
as a page that includes a reference to a protected endpoint is returned to a requesting client, and in a first mode of operation, injecting into the page a reference to a script, the script configured to record one or more interactions at the requesting client, to collect sensor data about the interactions, and to send the collected sensor data;
receiving and forwarding collected sensor data to a detection service;
responsive to intercepting a request for the endpoint, and in a second mode of operation, issuing a query to the detection service to obtain a threat score associated with the requesting client, the threat score based at least in part on the collected sensor data; and
determining based at least in part on the threat score received in response to the query whether the request for the endpoint should be forwarded onward for handling.
2. The method as described in claim 1 wherein the request for the endpoint is not forwarded upon a determination that the threat score is indicative of the requesting client being a bot.
3. The method as described in claim 1 wherein the query is issued while the requesting client continues to interact with the page locally.
4. The method as described in claim 1 wherein the page is associated with an overlay network customer workflow that involves collection of sensitive data.
5. The method as described in claim 1 wherein the data collection script is injected into the page by including a script tag in a response body of the page.
6. The method as described in claim 1 further including enriching the collected sensor data prior to delivering the sensor data to the detection service.
7. The method as described in claim 1 wherein the collected sensor data is forwarded to the detection service continuously as the collected sensor data is received.
8. The method as described in claim 1 wherein the collected sensor data is posted to the detection service asynchronously.
9. The method as described in claim 1 further including forwarding the request for the endpoint onward to an origin server associated with the overlay network customer environment.
10. The method as described in claim 9 wherein the injecting, receiving and forwarding, issuing a query and determining operations occur at a server associated with the overlay network, the server located between the requesting client and the origin server associated with the overlay network customer environment.