Rock ‘Em Sock ‘Em Robots: Bot Swatting Like the Pros
summary
Claims that bot traffic skews analytics, steals data, and causes downtime; detection targets behavioral deviation not UA strings. Uses log centralization (Splunk/Logstash/SumoLogic), Kafka/Cassandra/Spark pipelines, fingerprintjs and Navigator checks, WAFs, rate limits and rep sheet (Nginx + Redis lookup) for inline blocking. Example: carding bots show a 1 second cadence, thousands of attempts (one case 1,878 requests with 0% success in 24h, or runs of 10,000), goal is 80-90% mitigation. Built systems at Groupon that visualize and drop bot traffic and improve metric quality.
AI-written summary · about
chapters (9)
- 0:00Introduction to bot traffic
- 1:05Asking the right questions
- 5:22Common types of robots
- 14:12Detecting malicious scanners
- 21:41Anomaly detection basics
- 35:09Machines vs humans behavior
- 41:27Building a detection system
- 47:20Why intentional security matters
- 50:28Q&A on blocking methods
related talks
40mRock 'Em Sock 'Em Robots: Bot Swatting Like the Pros
54mDetecting and managing bot activity more efficiently
48mHow to Thwart Malicious Automation and Kick Bot Butt for $0
23mBot or human? Detecting malicious bots with machine...
34mArchitecture of an Anti-Bot Protection
48mWho’s in control: Human or Machine?
12mSpeed, scale & stealth: Securing against ATO events
31mStrategies for Identifying and Mitigating Bot Threats