What is a bot: types and functions

Roughly half of all internet traffic today consists of bots that are used to simulate human communication in social networks, search for content online for companies, perform search engine optimization, automate customer service and carry out criminal activities such as data theft, scams, and DDoS attacks.

Bots are digital tools and, like any tool, can be used for good or for bad. In order to understand how bots can support companies by automating simple, repetitive tasks or in what ways your own cybersecurity needs to be beefed up, you need to be familiar with bots and what they can do.

The term “bot” comes from the English word “robot”. Similar to mechanical robots, internet bots are programmed to perform specific repetitive tasks. To do so, they execute clearly defined commands through algorithms and scripts which they can do faster than any human could. Bots are thus computer programs that operate autonomously and automatically and do not depend on human input or supervision to perform their functions.

The first internet bot was the World Wide Web Wanderer. First deployed in 1993, it measured the growth of the internet and stored data in the Wandex index. Nowadays, the range of applications for bots is much more diverse. They can be used as chatbots for customer service, social bots in social networks, web crawlers to analyze websites or even as botnets for spam and phishing attacks.

The easiest way to explain how bots work is to compare them with physical robots. Unlike physical robots, they do not consist of physical machine parts, such as screws, screw threads, plastic, and wires. They are instead made up of code. The code contains the required commands and instructions for telling the bot how to communicate actively with or in response to human users, systems or other bots.

Designing bots can be very simple. However, modern bots also use complex code and artificial intelligence which can sometimes make them hard to distinguish from human users in a social network. Nowadays, even your average Joe can program a bot. There are numerous tools and interfaces available online that enable users to program both simple and complex bots. For example, Twitter allows you to create your own chatbots for tweets, retweets, and likes.

Below, you will find a snippet of code from a chatbot. In this example, the bot uses the XML-based description markup language AIML, which is frequently used for chatbots.

Bots can perform various simple or complex tasks depending on the algorithms defined in the code. Communication usually occurs via internet-based platforms and services, such as instant messaging (IM) or Internet Relay Chat (IRC).

The functions and tasks a bot can perform are as diverse as the range of applications on the internet. The most common functions of a bot include:

• Supporting communication services on instant messaging platforms (e.g. Facebook, Twitter, and WhatsApp);
   
• Autonomous data scraping (i.e. data collecting) and data crawling in which the information on a website is searched through, analyzed, and indexed using keywords, pattern matching, and hashtags;
   
• Simulating and automating predefined communication using specific keywords, algorithms and hashtags (e.g. in chats, on websites, and in customer service);
   
• Using the interfaces of other applications and bots to perform additional functions (e.g. collecting and presenting data from weather or traffic apps);
   
• Offering and performing automated services, such as translating, personalized advertising, and placing orders;
   
• Performing game functions (e.g. chess); and
   
• Building botnets to create computer networks for the purposes of data theft, scams, and DDoS attacks.

A bot consists of three basic components:

1. Application logic or workflow logic: This is the executable, machine-readable code written by the programmer to define the bot’s functions and tasks.
    
2. Database: This contains essential data and information that the program can access to perform its function. The database can be actively extended, as is the case with search engine bots (i.e. web crawlers).
    
3. API (application programming interface): These programming interfaces enable programmers to access the functions of other applications without having to write them themselves. Using specific code interfaces, APIs can integrate foreign software commands into the bot’s code to extend the bot’s functions. For example, a chatbot can integrate the function of a road traffic app into its code to provide traffic information to its users via the interface.

Simple bots use the concept of rule-based “if-then-else” programming to execute clear, predefined commands and tasks. Modern bots are now able to further evolve using artificial intelligence to extend their own databases and learn new functions and terms. Bots can thus be categorized into rule-based bots and self-learning bots.

Rule-based bots and self-learning bots can be further categorized into five groups based on their primary functions:

1. Entertainments bots
2. Commercial bots
3. Service bots
4. Message bots
5. Malware bots

Bots can be used for a wide range of applications on the internet and are all similar in that they can be used for both legal and illegal purposes.

Commonly used good bots include:

• Social bots: This is a collective term for all bots that operate on social media and perform automated tasks related to online support, FAQs, direct messaging, commenting on posts as well as likes, shares, retweets and follows.
   
• Web crawlers: This type of bot collects and analyzes data and information from websites to extend the functions of search engines and comparison portals, register and index new web content, create links and optimize search requests.
   
• Chat bots: These imitate human chat users and simulate natural communication. For example, they can be used as recognizable bots in customer service to accept customer service requests and process FAQ requests or as covert bots to simulate real users.
   
• Gaming bots: These are bots that appear in video games as fake players (i.e. non-player characters).
   
• Shopping bots: These bots are used to compare online prices and search for the cheapest offers or to select the most popular shopping websites for users.
   
• Monitoring bots: These are used to monitor the status of a website or system.

While bots have many positive functions and numerous services, such as search engines, instant messaging, and comparison portals, would be impossible without them, they generally have a bad reputation due to malware and hacker attacks. This is because many bots are developed specifically for the purpose of performing illegal and harmful activities.

The following are some types of malware or malicious bots:

• Propaganda or manipulative bots: These are social bots that simulate user profiles, shape digital opinions, and spread political messages, fake news, and conspiracy theories. They can also react to comments and posts based on keywords.
   
• Scam/phishing bots: These bots commit data theft through pseudo-links, fake emails and fake websites.
   
• Keylogging bots: These bots are used to log message traffic or to record, store, and forward all activity on a computer.
   
• File-sharing bots: These bots respond to targeted search requests and offer users a link to the desired search term. When the user clicks on the link, the bot can infect the computer.
   
• Spam bots: These bots send large amounts of spam emails and use the address books and contacts of unsuspecting users to expand the reach of their spam in a targeted manner.
   
• Zombie bots: Zombie bots are computers that have been infected by malware or that have been integrated into a botnet to provide computing power for large-scale botnet attacks. It is often difficult to identify compromised computers that are part of a botnet.
   
• Botnets: A botnet is a collection of infected computers that are connected together in a network and employed by malware bot users for DDoS attacks.

Malware bots are used for a variety of illegal activities. These include:

• Carrying out data and identity theft by scraping, phishing and keylogging sensitive information, such as passwords, banking information, and addresses;
   
• Performing distributed denial-of-service attacks (DDoS) which can paralyze servers by overloading them with massive amounts of data traffic;
   
• Using backdoors in computer security systems to infect those systems; and
   
• Retransmitting spam to redirect data packets.

The following are the five most common large-scale bot attacks:

• DDoS attacks: These are used to target and overload servers (see above).
   
• Spamming and traffic monitoring: This is used for overloading mail servers or carrying out large-scale data theft.
   
• Denial of inventory attacks: These attacks target online shops to list their products as “not available”.
   
• Scraping attacks: These are used to steal and sell data.
   
• Credential stuffing attacks: These attacks use stolen account information to carry out automated, large-scale login attempts.