Internet traffic produced by bots, especially hostile ones, has increased, according to the 2024 Imperva Bad Bot Report published by global IT services and cybersecurity giant Thales Group. In 2023, bots accounted for nearly half (49.6%) of all Internet traffic, marking a 2% increase from the previous year and the highest percentage recorded since Imperva started tracking this phenomenon in 2013.
The rise of bot traffic coincides with a significant increase in harmful online activities, as bad bots alone constituted 32% of total web traffic in 2023. This figure is up from 30.2% in 2022, indicating a persistent upward trend for the fifth consecutive year. Meanwhile, human-generated traffic has diminished, dropping to just over half at 50.4%.
The proliferation of bots, especially those engaging in undesirable activities, can have substantial financial implications for organizations worldwide. They may face billions in potential losses due to attacks on websites, APIs, and applications. These attacks disrupt normal business operations and compromise customer trust.
A notable finding from Thales’ Imperva Bad Bot Report is the geographical variation in bot traffic. Ireland experienced an overwhelming 71% of its Internet traffic from bad bots, followed by Germany at 67.5%, and Mexico at 42.8%. In the United States, the proportion of bad bot traffic rose to 35.4%, up from 32.1% the previous year.
Impact of GenAI technologies
The report also highlights the growing impact of generative AI technologies, including large language models (LLMs), on the rise of simple bots, which surged to 39.6% of bot traffic in 2023, up from 33.4% in 2022. These technologies would often employ web scraping bots and automated crawlers to gather data, feeding training models that enable even nontechnical users to write automated scripts.
Moreover, the threat of account takeover attacks is escalating, according to Thales’ report, with a 10% increase in such incidents in 2023 compared to the previous year. A significant 44% of these attacks specifically targeted API endpoints, highlighting a growing vulnerability in this area. Financial Services, Travel, and Business Services sectors were the most affected, suffering the highest rates of account takeover incidents.
API Security
Because they provide easy access to sensitive data, APIs are increasingly being targeted by automated threats; by 2023, 30% of API assaults will be caused by these attacks. Bad bots exploit business logic vulnerabilities to manipulate legitimate API functionality, gaining unauthorized access to sensitive data or user accounts.
The gaming industry remains the most affected by bad bot activity, according to Thales’ report, with a staggering 57.2% of its traffic originating from such sources. The Retail, Travel, and Financial Services sectors also saw significant bot traffic, underscoring the widespread nature of the cybersecurity issue. Furthermore, advanced bad bots, which mimic human behavior to evade detection, were predominantly found on websites related to Law & Government, Entertainment, and Financial Services.
Additionally, there has been a notable increase in bad bot traffic originating from residential Internet Service Providers (ISPs), rising to 25.8%. Early bad bot evasion techniques often involved masquerading as legitimate user agents. Over the past year, 44.8% of all bad bot traffic disguised itself using mobile user agents, a substantial rise from 28.1% five years ago, according to Thales’ report. Cybercriminals would increasingly leverage residential or mobile ISPs with proxies to make their traffic appear as if it originates from legitimate, ISP-assigned residential IP addresses, complicating the challenge of distinguishing between benign and malicious bot traffic.
This evolving landscape would once again underscore the critical need for enhanced cybersecurity measures and innovative solutions to mitigate the impact of malicious bots and safeguard critical digital infrastructure.
