Bots now account for nearly half of global internet traffic

Unsplash

Thales, Cybersecurity leader protecting critical applications, APIs and data at scale and across the globe, today announced the release of its Imperva Bad Bot 2024 , a global analysis of automated bot traffic on the internet. In 2023, nearly half (49.6%) of all internet traffic came from bots, a 2% increase from the previous year and the highest level reported by Imperva since the company began monitoring traffic in 2013. 

While the proportion of human user traffic fell to 50.4%, malicious bot traffic increased for the fifth consecutive year, from 30.2% in 2022 to 32% in 2023. This automated traffic costs businesses billions of dollars each year due to attacks on websites, APIs, and applications. 

“Bots are one of the most pervasive and growing threats across all industries. From simple automated online data mining 1 From user account takeovers to spam and denial of service attacks, bots negatively impact a company’s financial performance by degrading online services and requiring increased investment in infrastructure and customer support. Organizations must proactively address the threat of bad bots as attackers escalate their API-related abuses, which can lead to user account compromise or data exfiltration.”Nanhi Singh, General Manager, Application Security, Imperva, a Thales company 

Some of the key trends identified in the Imperva Bad Bot 2024 report include: 

• The global average of malicious bot traffic has reached 32%: l Ireland (71%), Germany (67.5%) and Mexico (42.8%) recorded the highest levels of malicious bot traffic in 2023. The United States also recorded a slightly lower ratio. higher (35.4%) compared to 2022 (32.1%). 
• The growing use of generative AI is linked to the increase in the number of simple bots: l The rapid adoption of generative AI and large language models (LLMs) has driven an increase in the volume of simple bots from 33.4% in 2022 to 39.6% in 2023 . The technology uses automated online data extraction bots and indexing robots 2 automated to feed training models and allows non-technical users to write automated scripts for their own usage. 
• User account hacking is a persistent risk for businesses:Account takeover (ATO) attacks increased by 10% in 2023 compared to the previous year. Additionally, 44% of all ATO attacks targeted API endpoints, compared to 35% in 2022. Of all internet login attempts, 11% were associated with an attempt to hijack a user account. In 2023, the industries experiencing the highest number of these attacks were financial services (36.8%), travel (11.5%), and business services (8%). 
• APIs are a prime vector for attacks:Automated threats caused 30% of API attacks in 2023. Of these, 17% were malicious bots exploiting business logic vulnerabilities: a flaw in the API design and implementation that allows attackers to manipulate legitimate functionality to gain access to sensitive data or user accounts. Because they are a direct route to this sensitive data, APIs are a prime target for cybercriminals who use automated bots to find and exploit them. 
• Every sector is affected by bots: for the second year in a row, the gaming sector(57.2%) recorded the highest proportion of malicious bot traffic. Meanwhile, retail (24.4%), travel (20.7%) and financial services (15.7%) suffered the highest number of bot attacks. The proportion of advanced malicious bots, capable of imitating human behavior and evading defense systems, was highest on legal and government (75.8%), entertainment (70.8%) and financial services (67.1%) sites. 
• Malicious bot traffic from residential Internet Service Providers (ISPs) increases to 25.8 % :Early evasion techniques for malicious bots involved impersonating a user web browser commonly used by real human users. These bots accounted for 44.8% of all malicious bot traffic in the past year, up from 28.1% just five years ago. Advanced actors are combining mobile user agents with the use of residential or mobile ISPs. Residential proxies allow bot operators to evade detection by making the traffic appear to originate from a legitimate residential IP address assigned by an Internet service provider.