ReBotDetector: A Detection Model with LSTM Feature Extractor for Session-Replay Web Bot Attacks

In the ever-evolving digital landscape, cyberattacks are becoming increasingly intricate and adept at bypassing detection. Session-replay web bot attacks, where attackers leverage pre-recorded human mouse movements to mimic user behavior on targeted websites and applications, exemplify this growing threat. This paper proposes ReBotDetector, a specialized ML-based system designed to identify malicious replay sessions. In the first stage of its operation, ReBotDetector utilizes a Long Short-Term Memory (LSTM) network to extract the most critical features from human-generated dynamic mouse-movement dataset. Subsequently, it employs Cosine similarity to pinpoint sessions exhibiting a high degree of similarity with previously observed legitimate human sessions. The effectiveness of ReBotDetector is evaluated through experiments utilizing our proprietary state-of-the-art replay bot software (ReBot), which is designed to faithfully replicate authentic human sessions. Experimental results demonstrate that ReBotDetector is highly effective at identifying malicious replay sessions generated by ReBot against genuine human sessions. The high accuracy achieved in detecting these replay sessions underscores our proposed model's potential as a robust defense against session-replay bot attacks in real-world systems.