

Bot Detection¶

There is a possibility that hackers may invoke services without any proper authentication by using tools such as port scanning. Therefore, WSO2 API Manager (WSO2 API-M) provides a bot detection mechanism in place. There is an unadvertised service deployed in the gateway that logs and sends events to that API-M Analytics if it receives any traffic. These events can then be configured to send e-mail alerts and also to be shown in the bot detection dashboard via the Admin Portal. Thereby, this helps Publishers to protect their data from bot attackers and improve the security of the data.

If hackers (e.g., bot attackers) try to invoke the unadvertised service, WSO2 API Manager will log the API calls in the <API-M_HOME>/repository/logs/wso2-BotDetectedData.log file. The following is a sample log record.

INFO BotDetectionMediator MessageId : urn:uuid:535437f1-a178-4722-a232-164e4a7e0207 | Request Method : POST | Message Body : <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><jsonObject/></soapenv:Body> | client Ip : 127.0.0.1 | Headers set : [Accept=*/*, activityid=4b932127-d07e-43c3-bee2-4f5344074185, Content-Length=2, Content-Type=application/json, Host=localhost:8243, User-Agent=curl/7.58.0]

Info

You can view the above logs without configuring API Manager Analytics

If you enable WSO2 API Manager Analytics with WSO2 API Manager, you can enable email notifications for all unauthorized API calls that you receive and also view the bot detection data easily via the Admin Portal.

Note

If you wish to work with a third-party monitoring tool, then you can use the details in the /repository/logs/wso2-BotDetectedData.log trace log and build an alert mechanism to receive alerts.

Enabling email notifications for bot detection¶

Follow the instructions below to enable email notifications for bot detection:

Enable WSO2 API Manager Analytics.

Follow steps 1, 2, and 3 of the quick setup in Configuring API Manager Analytics.

Share your API-M database (AM_DB).

Modify the AM_DB related datasource configurations in the <API-M_ANALYTICS_HOME>/conf/worker/deployment.yaml file as follows.

- name: AM_DB
   description: "The datasource used for APIM MGW analytics data."
   jndiConfig:
     name: jdbc/AM_DB
   definition:
     type: RDBMS
     configuration:
       jdbcUrl: 'jdbc:mysql://localhost:3306/apimgt_database'
       username: username
       password: password
       driverClassName: com.mysql.jdbc.Driver
       maxPoolSize: 50
       idleTimeout: 60000
       connectionTestQuery: SELECT 1
       validationTimeout: 30000
       isAutoCommit: false

Enable Alerts.
Follow the instructions below to configure an email address to send email alerts to subscribers.
- Open the <API-M_ANALYTICS_HOME>/conf/worker/deployment.yaml file.
- Navigate to the extensions configuration under siddhi configurations.
- Add a new extension to configure the sender email address. The sample code is shown below.
```
    siddhi:
      extensions:
    ...
        -
          extension:
            name: email
            namespace: sink
            properties:
              username: [email protected]
              address: [email protected]
              password: password 
    ...
```
Warning

Note that you might have to bypass a security warning to configure this with a private email address.
- Go to the <API-M_ANALYTICS_HOME>/resources/apim-analytics/ directory. Copy the APIM_ALERT_BOT_DETECTION_EMAIL.siddhi file and paste it in the <API-M_ANALYTICS_HOME>/wso2/worker/deployment/siddhi-files directory.
Start the WSO2 API Manager Analytics server.

Navigate to the <API-M_ANALYTICS_HOME>/bin directory in your console and execute one of the following scripts based on your OS.
- On Windows: worker.bat --run
- On Linux/Mac OS: sh worker.sh
Start the WSO2 API Manager server.

Navigate to the <API-M_HOME>/bin directory in your console and execute one of the following scripts based on your OS.
- On Windows: wso2server.bat --run
- On Linux/Mac OS: sh wso2server.sh
Sign in to the API Manager Admin Portal.

https://<IP_Address>:9443/admin
Click BOT DETECTION.
Click CONFIGURE EMAILS.
Add the recipient's email address and click Add.

If a hacker (e.g., bot attacker) tries to invoke an open service API, WSO2 API Manager will send emails to the email alert recipients. The following is a sample email notification.

Viewing bot detection data via the Admin Portal¶

Follow the instructions below to view the bot detection data for the unauthorized API calls via the Admin Portal.

Note

Skip steps 1 to 7 if you have already enabled API Manager Analytics, configured the AM_DB database, configured Alerts, started the WSO2 API Manager Analytics and WSO2 API Manager servers, and signed in to the Admin Portal.

Enable WSO2 API Manager Analytics.

Follow steps 1, 2, and 3 of the quick setup in Configuring API Manager Analytics.

Share your API-M database (AM_DB) by modifying the AM_DB related datasource configurations in the <API-M_ANALYTICS_HOME>/conf/worker/deployment.yaml file as follows.

- name: AM_DB
   description: "The datasource used for APIM MGW analytics data."
   jndiConfig:
     name: jdbc/AM_DB
   definition:
     type: RDBMS
     configuration:
       jdbcUrl: 'jdbc:mysql://localhost:3306/apimgt_database'
       username: username
       password: password
       driverClassName: com.mysql.jdbc.Driver
       maxPoolSize: 50
       idleTimeout: 60000
       connectionTestQuery: SELECT 1
       validationTimeout: 30000
       isAutoCommit: false

Enable Alerts.
Follow the instructions below to configure an email address to send email alerts to subscribers.
- Open the <API-M_ANALYTICS_HOME>/conf/worker/deployment.yaml file.
- Navigate to the extensions configuration under siddhi configurations.
- Add a new extension to configure the sender's email address. The sample code is shown below.
```
    siddhi:
      extensions:
    ...
        -
          extension:
            name: email
            namespace: sink
            properties:
              username: [email protected]
              address: [email protected]
              password: password 
    ...
```
Warning

Note that you might have to bypass a security warning to configure this with a private email address.
- Go to the <API-M_ANALYTICS_HOME>/resources/apim-analytics/ directory. Copy the APIM_ALERT_BOT_DETECTION_EMAIL.siddhi file and paste it in the <API-M_ANALYTICS_HOME>/wso2/worker/deployment/siddhi-files directory.
Start the WSO2 API Manager Analytics server.

Navigate to the <API-M_ANALYTICS_HOME>/bin directory in your console and execute one of the following scripts based on your OS.
- On Windows: worker.bat --run
- On Linux/Mac OS: sh worker.sh
Start the WSO2 API Manager server.

Navigate to the <API-M_HOME>/bin directory in your console and execute one of the following scripts based on your OS.
- On Windows: wso2server.bat --run
- On Linux/Mac OS: sh wso2server.sh
Sign in to the API Manager Admin Portal.

https://<IP_Address>:9443/admin
Click BOT DETECTION DATA.

If a hacker (e.g., bot attacker) tries to invoke an open service API, the Bot detection data details, which appear in the <API-M_HOME>/repository/logs/wso2-BotDetectedData.log trace log, will appear.

Top