Bot attacks have continued to evolve over the years. From the days of having bot attacks being triggered using scripts, using headless browsers and IPs with bad reputation which target the login pages for example to now with the advent of Generative AI and cheap automation, attackers being able to launch a sophisticated bot attack and make it look extremely genuine.
Attackers can now pair AI agents that plan and run multi-step tasks with residential proxy networks, CAPTCHA-solving services and browsers built to look human. These attacks look very genuine, and it becomes hard to differentiate between a genuine user driven request vs a malicious attack triggered by an attacker. At the center of this shift is a fast-growing class of tooling: anti-detect browser automation frameworks. They are built to beat the very checks most bot defenses still rely on.
The New Wave of Anti-Detect Automation Frameworks
Anti-detect Browser automation frameworks have progressed quite fast and a lot of them are even available as open source with the right set of tooling and community support too. That means that access to these advanced frameworks is now there for the attackers and with the use of AI, the effort required to initiate an attack using these frameworks has also become close to zero. The different categories of these Anti-detect browser automation frameworks can be listed below:
- Stealth-patched automation libraries. Plugins and forks of Puppeteer and Playwright that remove well known automation markers such as navigator.webdriver, headless user-agent strings and missing browser plugins
- Patched driver frameworks. Projects such as undetected-chromedriver, Patchright that change how the automation tool talks to the browser, hiding the Chrome DevTools Protocol leaks that detection scripts have long relied on
- WebDriver-less and CDP-minimal drivers. Frameworks such as nodriver that drive a normal, not instrumented Chrome install, leaving very little automation footprint
- Hardened browser forks. Modified browsers such as Camoufox, a Firefox fork that spoofs fingerprint values at the engine level rather than through JavaScript overrides
- Commercial anti-detect browsers. Commercially available anti-detect browsers such as Incognition, Octo browser etc. that can offer advanced anti-detect capabilities.
Adding to these advanced anti-detect browser automation frameworks, if we now add the capability of being able to run attacks from multiple residential proxies that are easily available, advanced CAPTCHA-solving services and now off-late use of AI Agents that can plan and execute multi-step tasks, we can imagine the scale of attack that an attacker can spin up in a matter of few hours.
Why detecting these anti-detect browser automation frameworks is not straight-forward?
Anti-detect browser automation frameworks are engineered to answer in the affirmative the very question that a typical bot detection solution tries to decipher which is "Does this source look like a real browser or not". Typical way of looking to detect these involves checking browser properties, automation flags, fingerprint values or network signatures but we all do know that these can be bypassed by using a patched version that is available almost immediately. The newer frameworks also change fingerprint values inside the browser engine itself, making it even harder to detect these.
Hence detecting and blocking these anti-detect browser automation frameworks becomes a cat and mouse game where the defender tries to find ways to detect these, but the attacker finds ways to bypass these and hence this becomes a tough challenge to solve for the bot vendors.
What is needed is a more nuanced way to detect these anti-detect browser automation frameworks by not relying on just a single signal but looking for other signals that rely on behavioral analysis of the interaction within the browser context and then be able to isolate these accurately and efficiently.
How Radware Bot Manager Detects these Anti-detect browser automation tools?
Anti-detect frameworks are good at faking what a browser is but they cannot fully fake how a genuine user behaves when accessing an application. This is where the more advanced solutions such as Radware Bot Manager come into play which investigate the actual behavioral fingerprint in the way mouse movement and clicks happen and based on that decipher whether it's coming from a genuine user or an automation tool.
Radware Bot Manager basically provides a two-layered approach towards this. Layer one is a thin set of hard signatures that block the tools that could be blocked at a near-zero false-positive rate. Layer 2 is basically a client-side composite bot-score that catches the rest of the tools. A combination of these 2 layers is what goes into deciding whether to block that source or not. Multiple behavioral signals are investigated which include tracking the mouse movement (the speed micro-wobble along the path, irregularity of the speed profile and speed asymmetry), pointer and reaction (Idle settle before the click, first action after challenge appears and more) and timing cadence (variability of the inter-event interval etc.). Because detection is based on behavior and consistency rather than relying on a fixed list of signatures alone, anti-detect browser automation frameworks are detected and blocked with minimal False Positives.
What This Means for Your Business
Anti-detect browser automation is not a niche bot problem. It can sit behind the attacks that hurt revenue and customer trust most directly. All different bot attack threats listed below can become tougher to detect if attackers use these anti-detect browser automation frameworks.
- Account takeover: With anti-detect browsers and residential proxies, ATO Attacks can be mean each attempt can appear to come as separate genuine user like behavior, spread across devices and multiple IPs, at volumes that stay under rate limits
- Fake account creation: Attackers can create hundreds of accounts that pass device-uniqueness checks using these anti-detect browsers, then use them to abuse sign-ups, create fake accounts ultimately also leading to an ATO type attack
- Scraping: With anti-detect browsers, attackers can browse at human pace through rotating profiles, collecting prices, content and proprietary data over days or weeks.
Staying Ahead of the Next Framework
With the proliferation of AI in the last few years and the tremendous power attackers have at their disposal to run advanced sophisticated attacks, we will always see a next stealth plugin, a next patched driver and a next hardened browser fork. Defenses against these need to continue to evolve as attackers evolve.
The way to look at this is to stop looking at answering whether a source looks like a browser and start asking whether the session behaves like a genuine legitimate user driven one. That is the shift Radware Bot Manager is built on to look at behavioral and intent-based detection rather than focusing on static signatures.
To know more about Radware Bot Manager, go to https://www.radware.com/products/bot-manager/ or contact us.