Bot Protection va antifrod API
1) Nima uchun bu zarur?
Botlar va tajovuzkorlar o’sish va pul o’sish nuqtalariga hujum qilishadi: ro’yxatdan o’tish, login (ATO), depozitlar/xulosalar, promo-mexanika, o’yinlar/koeffitsiyentlar kataloglari. Qo’l qoidalari va sof rate limit etarli emas: ko’p darajali signallar, real vaqt skoringi va biznes voqealaridan (charjbeki, chargeback-ratio, KYC-feyl) fikr-mulohazali yechimlarni (allow/deny/challenge/throttle) nazorat qilish kerak.
2) Tahdidlar taksonomiyasi
Ro’yxatdan o’tish/onbording: ommaviy akkauntlar, bir martalik e-mail/sim-banklar, qurilmalar fermalari.
ATO (Account Takeover): credential stuffing, password spraying, session hijack.
Bonus-abyuz: multiakkauting, geo/yurisdiksiya arbitraji, self-exclusion aylanma.
Karting/to’lov frodlari: kartalar testi, o’g "irlangan hamyonlar, mablag’larni qaytarish.
Skreyping/inventar: kontent, narxlar, koeffitsiyentlarni tajovuzkor tortish.
Past intensivlikdagi API-DoS: toshbaqa hujumlari, slow-POST, mobil SDK emulatsiyalari.
Vebxuka/integratsiya: HMAC/mTLSsiz xabarnomalarni qalbakilashtirish, replay.
3) Himoya arxitekturasi
3. 1 qatlamlar
1. Edge (CDN/WAF/shlyuz): erta nosozliklar (ASN/Geo/IP-obro’si), engil challenglar, limitlar, PoW.
2. Risk API (risk bo’yicha PDP): qoidalarning markazlashtirilgan dvigateli/ML; ответ — `decision`, `score`, `reason`, `ttl`.
3. App-daraja: domen invariantlari, biznes-mantiq (limitlar, KYC, AML), asinxron revyu.
4. Voqealar oqimi: Kafka/Kinesis → feature store/model → to’lovlar/munozaralardan fikr.
3. 2 Yechim konturi
[Request] → Edge Plugins → (enrich) → Risk API (rules+ML) → Decision:
allow deny throttle challenge(type=captcha sms PoW biometry)Yechim’ttl’soniyada (masalan, device × account × route) kesh qilinadi.
4) Signallar va boyitish
Tarmoq/kanal: IP/ASN, proksi/VPN/Tor, rdns, rtt/jitter, SYN-rate, TLS-fingerprint (JA3/JA4), HTTP/2/3 xulq-atvor.
Qurilma/brauzer: canvas/audio/WebGL FP (ehtiyotkorlik bilan), platforma/SDK, timezone/locale, ruxsatnoma, shriftlar, WebDriver/headless indikatorlari, mobile attestation (SafetyNet/DeviceCheck, iloji boricha).
Xulq-atvori: kiritish tezligi, sichqoncha/tach trayektoriyalari, ekranlar ketma-ketligi, dwell-time, urinishlar chastotasi, brauzer identifikatorlari orasidagi oʻtishlar.
Kontent/so’rov: e-mail/domen shakli, disposable-provayderlar, telefon HLR/yoki raqam turi, BIN kartalar, sank-reyestrlardagi hisob/IBAN, F.I.O./manzillarning o’xshashligi.
Hisob/tarix: hisob yoshi, KYC-maqomi, retenshn, ARPPU, depozitlar/xulosalar/bonuslar bo’yicha velocity.
Tashqi manbalar: kompromatatsiya ro’yxatlari (HIBP-ga o’xshash), to’lov tavakkalchilik signallari (PSP), ASN-obro’si.
5) Yechim: qoidalar + ML
5. 1 Qoidalar (determinirlangan)
Velocity: «N registrov s/24 v 10 min», «M loginov s tek devaysom k X schyotov», «K 3DS-faylov podryad».
Geo/yurisdiksiya: IP-geo ziddiyatlari vs manzil/hujjat, manzilning to’satdan sakrashi.
Biznes-invariantlar: mas’ul to’lovlar limitlari, self-exclusion, sanksiya ro’yxatlari.
5. 2 ML-skoring (real-taym)
Yengil model (GBM/logreg) onlayn belgilarida:’ip _ risk’,’device _ age’,’account _ age’,’pwd _ fail _ rate’,’bin _ risk’,’velocity _’,’behavioral _’.
ATO uchun alohida model va to’lovlar/xulosalar uchun alohida model.
Yurisdiksiya/tenant bo’yicha segmentatsiya (per-bozor chegaralarini kalibrlash).
5. 3 Qaror qabul qilish
if ip_blacklisted or bad_asn then deny else if rule_severe then challenge(hard)
else if score >= 0. 9 then deny else if 0. 7 <= score < 0. 9 then challenge(soft)
else allow’challenge’ da o’tish/muvaffaqiyatsizlik faktlarini saqlash; ishqalanishni dinamik ravishda kuchaytirish/kamaytirish.
6) Velocity va kvotalar (kalitlar va derazalar)
Ключи: `ip`, `ip/24`, `device_id`, `account_id`, `payment_instrument`, `email_domain`, `bin`.
Oynalar: sirpanadigan (1m/5m/1h/24h) + alohida «burst «/« sustained ».
Siyosatlar: issiq marshrutlarda «qattiq» deny (login/depozit), kontentda yumshoq throttle.
pseudo allow, retry_after = gcra_allow(key="login:ip:"+ip, rate=60/min, burst=30)
if not allow:
return 429, {"Retry-After": retry_after}7) Challenglar va «insoniylikni» tekshirish
CAPTCHA/turnstile: как soft-challenge; «sof» sessiyaga yuqori ishonchdan keyin olib tashlash.
Proof-of-Work (PoW): API/skriptlar uchun - belgilangan murakkablikdagi xeshni hisoblash; yuklamaning o’sishida dinamik murakkablik.
OTP/SMS/Email/Push: ATO/tanqidiy operatsiyalar uchun; suiiste’mol qilmaslik (qiymati/UX).
WebAuthn/biometriya: cash-out/payout-detallarni o’zgartirish bo’yicha yuqori darajadagi ishonch.
Tasdiqlangan qurilmaga Device trust: bind akkaunt; yangi qurilmalar → challenge.
8) Shlyuzga/proksiga integratsiya
8. 1 Envoy: ext_authz → Risk API (psevdo)
yaml http_filters:
- name: envoy. filters. http. ext_authz typed_config:
http_service:
server_uri: { uri: http://risk-api:8080, cluster: risk, timeout: 80ms }
authorization_request:
allowed_headers:
patterns:
- exact: "x-tenant"
- exact: "x-device-id"
- exact: "user-agent"
authorization_response:
allowed_upstream_headers:
patterns: [{ exact: "x-risk-score" }, { exact: "x-risk-decision" }]
- name: envoy. filters. http. router8. 2 NGINX/Lua: engil PoW va velocity
nginx lua_shared_dict vel 20m;
access_by_lua_block {
local ip = ngx. var. remote_addr if not gcra_allow("reg:ip:"..ip, 20, 40) then ngx. header["Retry-After"] = 30; return ngx. exit(429)
end
local pow = ngx. req. get_headers()["X-POW"]
if not verify_pow(pow, ngx. var. request_id, 18) then ngx. status = 401; ngx. say('need-pow'); return ngx. exit(401)
end
}9) Risk API kontrakti
So’rov (boyitilgan):json
{
"tenant":"eu-1",
"route":"POST /v1/login",
"subject":{"account_id":"a123","email":"u@d. com"},
"device":{"id":"d-xyz","fp":"...","ja3":"...","headless":false},
"network":{"ip":"203. 0. 113. 10","asn":12345,"country":"DE","rtt_ms":42},
"context":{"fail_5m":3,"pwd_reset_24h":1}
}json
{ "decision":"challenge", "score":0. 83, "reason":"high_velocity+new_device", "ttl_sec":900, "challenge":"captcha" }10) Ma’lumotlar, chichlar va modellar
Feature Store (onlayn): Redis/Scylla/KeyDB - hisoblagichlar/velocity/vaqt belgilari.
Batch/oflayn: DWH (BigQuery/S3 + Athena) o’qitish/refitlar uchun; chiqib ketish belgilari, chargeback, qo’l shovqini saqlang.
Modellar: real-time uchun oddiy (logreg/GBM); og’ir (XGBoost/NN) - PGMs/shkalalash va keyinchalik distillash bilan oflayn.
Driftni nazorat qilish: PSI, AUC/PR, mintaqalar/kanallar bo’yicha ostonalarni kalibrlash.
11) Kuzatuvchanlik va operatsion konturi
Metriklar:- `risk_requests_total{route,decision}`
- `risk_score_bucket` (distribution)
- `waf_block_total`, `velocity_block_total`, `challenge_pass_rate`
- `ato_incidents`, `carding_detected`, `cashout_denied`
- biznes-metriklar:’chargeback _ rate’,’bonus _ abuse _ rate’,’false _ positive _ rate ’
- Loglar (tahrirlangan):’decision’,’score’, asosiy signallar,’trace _ id’, PII/sirlarsiz.
- A/B va Shadow: shadow rejimida yangi siyosat (yechimlarni logga olamiz), so’ngra canary (1-5%), SLO/FP bo’yicha avtorollbek.
- Playbooks: eskalatsiya, vaqtincha kuchaytirish, orqaga qaytish, «virtual patchlar».
12) Maxfiylik va muvofiqlik
PII ni minimallashtiring; barqaror identifikatorlarni (masalan, email SHA-256 tuz bilan) xeshlash.
Mintaqaviy yurisdiktsiyani hurmat qiling (ma’lumotlarni mahalliylashtirish, rozilik).
Qo’l qisqichlari uchun yechimlarning shaffof tushuntirishlari; faqat kerakli va TTL bilan saqlang.
13) iGaming/Moliya xususiyatlari
Roʻyxatdan oʻtish: disposable e-mail/VoIP, velocity po/24, devays-fermalar → challenge/deny.
Login/ATO: yangi qurilmalar/geo-poygalar → OTP/WebAuthn; password spraying → throttle/deny.
Bonuslar: «yuvish yo’li» uchun limitlar (depozit → bonus → minimal aylanma → chiqish), affillashuvning graph-tahlili (manzil/qurilmalar/kartalar).
To’lovlar/xulosalar: BIN-tavakkalchilik, country-mismatch, PSP-signallar; cashout yangi vositaga → yuqori chegara va chekap KYC.
PSP/KYC vebxuklari: HMAC + mTLS, tor IP-allow-list, anti-replay (’X-Timestamp’, deraza ± 5 daqiqa).
14) Antipatternlar
Bitta universal captcha «hamma joyda va har doim» → yuqori FP/konversiya pasayishi.
Faqat xulq-atvor/devays signallarsiz rate limit.
«Xom» izlar va PIIlarni saqlash muddatsiz.
Yangi siyosatlar uchun shadow va canary mavjud emas.
O’z validatsiyasisiz tashqi «obro’li» belgilarga to’liq ishonch.
Server tekshiruvisiz mijozda (JS/mobil SDK) qarorlar qabul qilish.
15) Qoidalar va soxta hujjatlar namunalari
15. 1 Kompozit qoida (real-taym)
pseudo score = 0 if ip_asn in bad_asn_list then score += 0. 5 if device_age < 1d and route in {login, withdraw} then score += 0. 3 if velocity("login:account", 5m) > 10 then score += 0. 3 if geovelocity(last_login_loc, current_loc) > 800km/h then score += 0. 2 decision = score>=0. 9? "deny": score>=0. 7? "challenge": "allow"15. 2 Aloqa grafasi (multiakkaunt)
edge(accountA, deviceX)
edge(accountB, deviceX)
edge(accountB, cardY)
edge(accountC, cardY)
Threshold by common nodes → investigation/deny bonus16) Prod-tayyorlik chek-varaqasi
- Ko’p darajali arxitektura: Edge → Risk API → App, voqealar oqimi.
- Signallar: tarmoq, qurilma, xulq-atvor, kontent, to’lov; PII ni minimallashtirish.
- Velocity/GCRA ip/device/account/payment oynalari.
- Yechimlar: allow/deny/challenge/throttle; TTL bilan yechimlar keshi; challenge faktlari ombori.
- Challenglar: captcha/PoW/OTP/WebAuthn; dinamik murakkablik.
- Risk API: SLA <100 ms, kesh, «minimal xavfsiz» rejimga buzilish.
- Kuzatish darajasi: risk metrikasi, FP/FN, dashbordlar, alertlar; biznes-metrika (chargeback/bonus-abuse).
- Shadow → canary → enforce; eskalatsiya va qaytish pleybuklari.
- PSP/KYC vebxuklari: HMAC + mTLS + anti-replay + allow-list.
- Mintaqaviy talablar va sezgir ma’lumotlar uchun TTL.
17) TL; DR
Erta edge-filtrlar va challenglar, markazlashtirilgan Risk API + ML qoidalari va fikr almashish uchun voqealar oqimini qatlamli himoya qiling. Velocity limitlari, tarmoq/qurilma/xatti-harakatlar signallari, dinamik challenge (captcha/PoW/OTP/WebAuthn) dan foydalaning. allow/deny/challenge/throttle qarorlarini qabul qiling, FP/FN va biznes effektini o’lchang, shadow/canary orqali yuguring. To’lov/bonus yo’llari uchun - alohida qattiqlashtirilgan profillar va KYC/AML bilan bog’lanish.