Bot Defense Overview
Bot Defense protects your applications from automated attacks by identifying and mitigating malicious bots that target specific application endpoints. Bots are software programs that run automated tasks. Malicious bots cause harm through means such as:
- Credential stuffing
- Fake account creation
- Scraping
- Unauthorized selling, for example, sneaker bots
- Stolen credit card number validation
- Gift card cracking
- Other automated threats identified by OWASP
For more information about the types of attacks that Bot Defense protects against, see Types of Attacks.
Bot activity accounts for about 50% of all internet traffic, and can negatively impact your users, your data and revenue for your organization.
Rather than use CAPTCHAs or other methods, which are easily bypassed and negatively impact the user experience, Bot Defense uses JavaScript to collect telemetry from client browsers and a native Mobile SDK to collect telemetry from mobile devices. This telemetry is then attached in the form of HTTP headers or included in the POST body to the protected requests. Bot Defense examines the telemetry collected from requests before they are permitted to reach your application. You can configure Bot Defense to monitor automated traffic or to prevent automated traffic from reaching your application by blocking or redirecting the traffic.
Bot Defense provides integrated dashboard and reporting functionality to view detailed information about all analyzed traffic. For example, use the Bot Defense Dashboard to view and filter traffic and transaction statistics. You can also see which traffic is malicious and how that traffic was mitigated.
Figure: Bot Defense Dashboard
Configure Automated Threat Summaries to deliver insights to you automatically each month, while additional dashboards provide you with instant, detailed access to analysis of your data.
Figure: Automated Threat Summaries
Bot Defense and Bot Defense Advanced Bundles
When you select Bot Defense or a Bot Defense Advanced Bundle, F5 Managed Services Technical Account Managers and Solution Architects partner with your team to quickly deploy Bot Defense. This helps ensure that all features of your apps are protected from bots with maximum efficacy and performance.
Important: Bot Defense Advanced Self-Service Policy Management is an Early Access feature. If you do not have access to this feature, contact F5 Support for assistance.
Bot Defense is integrated with the F5 Distributed Cloud Services, which allows you to manage configurations on the Distributed Cloud Console or with APIs. You can use Bot Defense Advanced Self-Service Policy Management in the Distributed Cloud Console to perform the following tasks:
- Configure and deploy Bot Endpoint Policies, Bot Allowlist Policies, and Bot Network Policies.
- View bot policy status.
- View details and status of your provisioned bot infrastructure. Your bot infrastructures view contains all of your bot inference engines that process telemetry to determine if a request is human or automation.
- Manage bot detection rules. A bot detection rule contains criteria that Bot Defense uses to determine whether a transaction is from a human or automated source. Turn rules on and off depending on the needs of your organization.
Order Bot Defense and choose specific add-ons that fit your business needs, or order a Bot Defense Advanced Bundle to take advantage of the entire suite of Bot Defense features, including additional transactions, custom threat intelligence rules and managed service support. Either selection gives you the option to protect web-based endpoints, mobile endpoints, or both.
| Feature | Bot Defense | Advanced Bundles |
|---|---|---|
| Mitigates advanced bots targeting your applications. | X | X |
| Protects against OWASP automated threats. | X | X |
| Uses sophisticated code obfuscation to prevent adversaries from reverse engineering and tampering with signal collection. | X | X |
| Enables addition of mobile endpoints to the protection on the fly without requiring a mobile app release. | Add-On | X |
| Control bot detection rules. | X | X |
| Device fingerprinting - Uniquely identify user interactions with your application over time to confirm repeat visitors. | X | X |
| Content scraping protection - Prevent bots from collecting data, such as text and images, from your web applications to reuse elsewhere. | Add-On | X |
| Threat Intelligence Managed Services (24x7 SOC monitoring and detection, custom bot detection rules, periodic threat briefings where threat intelligence experts share industry insights and review attack vectors observed in your traffic, on-demand Tactics team support). | Add-On | X |
| Different levels of managed services to support your team through onboarding and ongoing security management, including dedicated Security Specialists to analyze attack traffic and develop targeted mitigation strategies, and Aligned Technical Account Managers and Solutions Architects dedicated to guiding projects to completion, regardless of infrastructure complexity. | Add-On | X |
| Supports up to 500,000 transactions per day with additional capacity available at tiered pricing. | X | - |
| Supports up to 1 million transactions per day with additional capacity available at tiered pricing. | - | X |
| Data Intelligence for data collection and analysis. | Add-On | Add-On |
Deploy Bot Defense in inline mode or in API mode. In inline mode, traffic is proxied to Bot Defense where it is transparently evaluated to determine if traffic is human or automated. For human traffic, Bot Defense adds a custom HTTP request header to the request and allows the traffic to continue to the origin. For automated traffic (bots), Bot Defense applies the configured mitigation action to monitor, block or redirect the traffic.
Note: To deploy Bot Defense in API mode, contact your F5 Operations team.
Figure: Bot Defense Traffic Routing
To plan your Bot Defense deployment, see Get Started with Bot Defense.
Bot Defense Standard
Bot Defense Standard is natively integrated in F5 Distributed Cloud Console. If your applications already route traffic through an HTTP load balancer configured with Distributed Cloud Services, this integration allows you to configure Bot Defense through your HTTP load balancer configuration.
Bot Defense Standard is also integrated with BIG-IP. You can configure Bot Defense natively in BIG-IP 17.0 or later. For BIG-IP versions 14.0-16.0, you can download a BIG-IP iApp template to configure Bot Defense.
Bot Defense Standard also provides prebuilt integrations with the following platforms:
For applications that do not have a prebuilt integration with Bot Defense, you can configure a custom integration.
Figure: Bot Defense Overview
To plan your Bot Defense Standard deployment, see Plan Your Bot Defense Standard Deployment.