Hidden within a company’s online traffic, malicious bots attempt to silently blend in with otherwise benign activity as they carry out DDoS attacks, spam campaigns, click fraud and other cybercrimes. But it’s not such a “Silent Night” anymore, because one company has found a way to demonstrate to its customers what a bad bot sounds like — sort of.
Introducing Botronica, a new online tool from bot management company Kasada, which uses sonification technology to translate malicious bot traffic into sounds. Kasada then layers this on top of genuine human traffic and “good bot” traffic, to create some rather trippy three-part synth-pop harmonies.
It’s essentially a creative way to generate awareness of and interest in malicious bot activity, which has become increasingly prevalent across the internet.
“One of big changes that we've seen is the accessibility of a lot of these tools, which were previously pretty gated, either directly because the folks writing bots wanted to keep them to themselves, or it was just a very high skill barrier,” said Sam Crowther, founder and CEO of Kasada, in an interview with SC Media. At one time, “you needed to have a good understanding of web development and automation engineering to get started. Whereas [now], it's very much been democratized.”
Indeed, Crowther estimated that about 50 percent of a customer’s online traffic is comprised of malicious bots.
In the spirit of the holidays, Kasada gave the Botronica tracks titles inspired by a number of popular holiday standards: “It’s Beginning to Look a Lot Like [Data] Scraping,” “Jingle Bell Bot,” “All I Want for Christmas is Fraud,” and “Credential Stuffing Is Here Again.”
But here’s the key question: Can this technology one day evolve from gimmick to practical application?
“I think there could be,” said Kasada co-founder Sam Crowther, founder and CEO. “When you have a large enough data set, sometimes it can be quite difficult to figure out what's actually going on. If you're processing, let's say, a billion transactions every day, where do you even start the journey of figuring out where the problems potentially are?”
“I think you could potentially leverage the idea of sonification and attach it to certain traffic types or request patterns so that instead of having to go and manually dig for this sort of activity, you'd actually be able to quite literally, hear the attack, even though there's just a huge amounts of noise,” Crowther said.
Developed by Kasada Engineering Team Lead Mackenzie Etherington, Botronica was borne out of a hackathon event that the company held last month. When Etherington was looking at a visualization of a customer organization’s traffic, he noticed something: “When you zoom out enough, it's almost like a beautiful pattern. It's repeating very consistently. And yet, you look at the bad traffic, and it's all over the place. It doesn't follow any patterns. It’s a bit sporadic,” said Crowther.
This prompted an idea: translate the visual patterns into rhythms and sounds as a means of giving bot communication a “voice.”
“People behave in certain ways and bots behave in other ways. And we figured audio could be a great avenue for [expressing] that,” said Crowther. “And so what we attempted to do is… almost create an orchestra.” Humans, good bots and bad bots would all be assigned different tones or instruments, and the Botronica tool would then “vary their pitch and volume based on how much of the traffic had been generated by them” over a given sample of time.
Although the samples on the Botronica website do not go into this level of specificity, it also turns out that different types of malicious bots – for instance, DDoS bots vs spam bots – all sound differently from each other, as each requires varying volumes of requests, resulting in unique sound patterns.
Crowther said Kasada’s customers appreciated the demonstration. “It was a good way for them to share with their colleagues what was actually going on in their systems in a way that's just a bit more interesting than ‘Here’s a graph.’”
The company is also toying with the issue of illustrating bot attacks via a 3D attack model, perhaps even in the form of a large art installation, “where we take the soundtracks that we generate” via Botronica, “and actually plot them on a 3D graph, which create some very interesting effects. And it’s an even more insightful way… to visualize what's going on.”
Of all the Botronica-generated Christmas songs, Crowther has a personal favorite: “Jingle Bell Bot,” played at 80 bots per minute on holiday mode, with all the bot traffic filtered out so that you only hear the human activity. “It almost sounds like jazz, which is probably insulting to everyone who loves jazz,” said Crowther. “But I actually quite enjoy it.”
