Task 1: Summary of Bot Mitigation Modules
| |
|---|
| Goal | Review Bot Mitigation Modules available in FortiAppsec Cloud. |
| Task | Read the summary provided below. If you need additional information please ask instructor. |
| Verify task completion | N/A |
FortiAppSec Cloud offers multiple bot mitigation techniques, each targeting different aspects of automated threat detection and prevention.
1. Biometric-Based Detection
Monitors browser interactions such as mouse movements, screen touches, and scroll actions within a set timeframe.
This helps confirm that requests are coming from a real human rather than an automated process.
2. Threshold-Based Detection
Lets you define detection rules for suspicious behaviors based on occurrence, time period, severity, and trigger policy.
Common use cases include:
- Crawler Detection – Identifies excessive crawling behavior that may signal automated indexing or scraping.
- Vulnerability Scanning – Detects automated scans looking for application or infrastructure weaknesses.
- Slow Attack Detection – Flags slow-rate requests designed to evade detection or overwhelm servers.
- Content Scraping Detection – Recognizes automated scraping of web content for unauthorized use.
- Illegal User Scan Detection – Catches scanning activity aimed at finding and exploiting vulnerabilities.
3. Bot Deception
Inserts hidden links into HTML response pages.
Legitimate users never see or click these links, but automated bots often will.
Requests to these hidden resources are strong indicators of bot activity.
4. Known Bots
Protects websites, mobile apps, and APIs from both harmful and legitimate bots—covering DoS bots, spam bots, crawlers, and more—without blocking critical automated traffic.
Includes two predefined rules, plus the ability to create custom ones tailored to your needs.
Once a Known Bot rule is triggered, its traffic can bypass additional scans.
5. Machine Learning (ML)-Based Bot Detection
Uses AI-driven detection alongside signature and threshold rules to identify sophisticated bots that might otherwise slip through.
The model analyzes user behaviors across 13 dimensions, such as request frequency, HTTP version compliance, and resource access patterns.
How It Works
FortiAppSec Cloud uses the Support Vector Machine (SVM) algorithm to:
- Learn traffic profiles of legitimate clients.
- Compare new client behavior to known patterns.
- Flag anomalies as potential bot traffic.
The process runs in three phases:
Phase 1 – Sample Collection
- Captures behavioral data (samples) during visits.
- Splits into 75% training data and 25% testing data.
Phase 2 – Model Building
- Analyzes training samples to create behavior profiles.
- Adjusts SVM parameters to remove outliers and refine accuracy.
- Selects the best model based on accuracy, cross-validation, and test results.
Phase 3 – Model Running
- Compares incoming traffic to established profiles.
- Flags significant deviations as anomalies.
- Triggers actions like alerts or blocking for repeated anomalies.
- Runs bot confirmation checks to reduce false positives.
- Updates the model automatically if legitimate traffic patterns change.
By combining these techniques—biometric tracking, threshold rules, deception, known bot filtering, and ML-based detection—FortiAppSec Cloud delivers a layered and adaptive defense against automated threats.
Task 3: Simulate Bot Traffic
| |
|---|
| Goal | Run traffic to test the FortiAppSec Cloud configuration |
| Task | Use the provided script to simulate bot traffic |
| Verify task completion | If successful, simulated bot traffic will be flagged and blocked in FortiAppSec Cloud |
We’ve provided a tool called bots that will simulate a mix of bot and legitimate traffic.
Log into Kali Linux: https://{{Kali IP}}:8443
Open the terminal emulator by clicking the black box icon at the top of the Kali home screen.
At the prompt, type:
You will be prompted with the following menu: ( notice most of the values are default values)
- Load a saved profile:
Y - Target URL:
https://<FortiAppSecStudentID>.fwebtraincse.com - Optimize for OWASP Juice Shop?
Y - Choose number:
6 - CSV log file: (leave blank)
- Total run duration:
4m - Concurrency:
20 - HTTP timeout per request:
12s - Progress interval:
10 - Use one sticky IP in
X-Forwarded-For: n - Force HTTP/1.0:
n - Requests per second:
20 - Start now:
Y
Once the tool starts running, you’ll see progress updates approximately every 10 seconds.
The bots tool will send traffic to your application protected by FortiAppSec.
Wait about 4 minutes, then start checking the dashboard and log files in FortiAppSec.
Details
If you lose access to the FortiAppSec Console, open an Incognito browser and use the link below to log back in:
https://customersso1.fortinet.com/saml-idp/proxy/demo_sallam_okta/login/
check the FortiAppsec Dashboards and Log Files
There are multiple ways to review the logs. We’ll start with the “big picture” view using incidents on the dashboard.
From the FortiAppSec Cloud Console, select *** Threat Analytics*** from the left-hand menu.
In the Top Attack Types pane click on Bot Attacks (scanner) to view incident details.
Several drill-down options will show source IP, source country, URL attacked, and more.
You’re encouraged to explore these options.
Under Threat Analytics, click on Attack Logs to view individual log entries with detailed information.
we can now look at individual log entries. Logs can be Filtered by Application, URL, Source Country etc. Logs can also be filters by time period.
please click on any log entry and investigate the detailed information provided.
Bot Mitigation Review
Review
In this module, we performed a simple bot attack to demonstrate the capabilities of the FortiAppSec solution.
FortiAppSec Cloud also offers additional bot mitigation features powered by machine learning, which we will cover in a later chapter.
The provided bots tool includes many options for delivering different types of bot attacks.
You can run additional simulations to see how FortiAppSec Cloud can detect and mitigate these attacks.
