What are bots and how do they work?

You interact with bots—short for internet robots—every day. Ever issued a command or question to Siri or Alexa? Then say hello to a bot right there on your phone or in your home.

Bots are automated computer software programmed to perform tasks humans deem repetitive and time-consuming, such as website indexing and customer service. They’re very useful, so much in fact that more than half of all internet traffic is made up of bots. However, not all bots are created equal. Some bots are malicious, sometimes designed to infect devices with malware, disrupt an online business, or simply annoy users.

It’s crucial to know how to spot both good and bad bots. But before that, let’s first take a look at how bots work and why they’re used.

How do bots work?

Bots are created from sets of algorithms. These algorithms help decide a bot’s function. Before being set loose online, a human is required to decide and direct the bot’s action. Once given its orders, the bot will carry out the task on its own.

Most bots are team players, usually operating over a network. This allows them to communicate with one another using internet-based services, such as instant messaging or via Internet Relay Chat.

Why use internet bots?

Simply put, bots save time and money. They’re faster and more efficient than humans. This helps free up resources for organizations using bots. People who would otherwise spend countless hours performing repetitive tasks can now be assigned to duties requiring more precision and expertise. Or they could be replaced entirely, depending on the company.

Bots are also highly customizable, multi-purpose, and are available 24/7. They can also be mass-deployed, giving users the power to reach large numbers of people with little effort. However, there are several negatives to using bots.

While they can perform a whole host of functions, bots aren’t suitable for tasks that require precision. They’re prone to misunderstanding a user’s intentions, often leading to frustration for the person interacting with the bot. And as alluded to above, bots can be programmed to be malicious or deployed as spam.

Types of bots: Good bots vs. bad bots

Bots don’t really have a moral compass. They’re just algorithms. However, bots are often labeled as either “good” or “bad” depending on their script functions, who’s using them, and what that person/organization’s intentions are.

Good bots

While there can be ambiguity over what constitutes a “good” bot, they are generally ones designed to help internet users or provide a useful service that often would not be possible with human efforts alone. Here are some of the most common you’ll encounter.

Chatbots

Ever noticed those chat boxes that pop up while you browse certain websites like banks or retailers? Those are chatbots. They simulate human conversations, responding to any relevant questions you ask.

Crawlers or spiders

Also known as web crawlers or search engine bots, this set of bots scan and index web pages on search engines such as Google and Bing. There’s also a more nefarious version of web crawlers, but we’ll get to that later.

Monitoring bots

Monitoring bots sound creepy, but the term is used to describe bots that keep an eye on the health and performance of a website in real time. If a problem is detected, such as an outage, the monitoring bot will send out an alert. Check out downdector.com to see monitoring bots at work on your favorite sites and games!

Shop bots

Shopping around for the best prices takes time. Too much time. That’s where shopping bots come in. They scour the internet for you in search of the best prices for a particular product you’re looking for. Flight and hotel booking sites frequently offer such features.

Marketing bots

The role of these bots is to track ads, look out for trending keywords, monitor customer reviews, and a whole lot more. They’re used by marketers looking to quickly gather market data.

Bad bots

Bad bots can be used to send spam, steal financial data, and engage in many other malicious activities.

DDoS bots

Bad actors use DDoS bots to flood a server with traffic. This flood of requests overwhelms the server, causing it to slow or even shut down. It is a common practice among hacktivists.

Spam bots

The bane of the internet, spam bots operate by harvesting email addresses from compromised contact pages and sending spam to them. They also pop up in forums and comments sections to post promotional content or drive traffic to selected websites.

Credential stuffing bots

When usernames and passwords are leaked, these bots take that information and use it to try and access other accounts on services such as Facebook, Amazon, or Netflix. Once in, they hijack accounts and sell them on the dark web. This is one reason websites use CAPTCHA to verify that users on their sites are humans.

Web scraping bots

Web scrapers copy vast amounts of data from a website. Scraping is legally dubious and can violate a website’s terms of service by gathering sensitive or copyrighted information.

Denial of inventory bots

These bots find specific items and add them to their shopping cart without completing the transaction. Used against competitors, this process tricks the website into listing the product as out of stock. When real customers try to buy the product, it’s listed as unavailable, even though it’s in stock.

Should you be concerned about bots?

There are situations where bots might affect a website visitor, but these are often nuisances rather than real threats. DDoS and denial of inventory bots, for instance, could make a website or product you are looking for inaccessible. The main victims in many cases are the businesses that cannot run as usual.

And when it comes to spam bots, knowing how to spot fake messages, links, and emails will help protect you against the malware they distribute. However, things can be a little more problematic when it comes to bots designed to impersonate humans.

How to tell you’re talking to a bot

As bots become more advanced, it’s getting harder to know if you’re interacting with a real person or an algorithm. This might not be a big problem when it comes to using a website’s customer service chatbot—but the implications are creepier on, say, social media sites or dating apps. Here are some basic steps you can take to check if you’re communicating with a bot.

• Checking their profile picture is a good place to start. Bots often use photos swiped from other sources, such as stock photos or legitimate profiles. Perform a reverse image search to be safe.
• Bots are often limited in the language department. Try asking them questions like, “What’s your favorite breakfast cereal?”. This’ll confuse most bots, as they’re not programmed to answer these sorts of questions.
• Pay attention to what they’re posting. Bots will often post the same stuff again and again. Also, if someone comments on a bot’s post, the bot will often not respond.

However, while these tips are useful for many of the bots you’ll find on places like Twitter, continued advances in AI are making it tough to tell the difference between real humans and bots.

How can companies protect against bad bots?

Businesses are prime targets for bad bots. Coordinated bot attacks can overwhelm company servers, disrupting services and impacting revenue. Thankfully, companies can protect themselves using bot management software. These tools are able to sort the good bots from the bad, blocking the naughty ones while letting humans and good bots in.