SaTC 2.0: RES: Understanding Bot Farms to Measure and Mitigate Internet Bot Attacks

Malicious bot campaigns increasingly threaten online services that people rely on every day, including ticketing platforms, government services, travel websites, retail stores, and gaming systems applications. These campaigns often use real workers in other countries operating through organized bot farms to bypass modern anti-bot protections and enable fraud at large scale. Despite growing reports of economic losses and service disruption caused by such malicious activities, there is limited scientific understanding of how these ecosystems operate in practice or how they can be effectively measured and mitigated. The project’s novelties are using forensic techniques to improve understanding of the bot farms themselves and combining large-scale measurement with of operations and defensive system design. The project's broader significance and importance are improving the security and resilience of online platforms that millions of users depend on while advancing scientific understanding of emerging human-in-the-loop cybercrime ecosystems. The project also supports broader cybersecurity education and outreach efforts for small businesses and students. This project develops new methods for measuring, characterizing, and mitigating malicious bot campaigns by studying the operational workflows of the bot farms. The research constructs a longitudinal bot farm measurement framework to collect forensic data about real-world campaigns targeting websites across multiple sectors and geographic regions. The project combines qualitative and automated analysis methods to develop taxonomies, identify long-term threat patterns, and study the operational behaviors of bot farms through social media analysis, interviews, and observational studies. The research also develops defensive techniques based on network provenance, browser fingerprinting, timing analysis, and behavioral biometrics to identify bot-farm-assisted traffic. Integrated detection approaches combine these signals to improve defenses against evolving campaigns while generating high-quality labeled datasets for future anti-bot research. The resulting tools, datasets, and insights are disseminated to affected organizations, cybersecurity practitioners, researchers, and educational programs to strengthen defenses against large-scale online malicious campaigns. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.