More than two fifths of all online traffic in the travel industry is driven by malicious ‘bots’ following a sharp rise in the last year and only half of all traffic is ‘human’, according to a report by cybersecurity specialist Imperva.
Bots are automated software applications and the 2024 Bad Bot Report by Imperva, a subsidiary of IT group Thales, suggests 51.1% of internet traffic in the travel sector is driven by humans, while 44.5% comes from malicious bots – up from 37% the previous year.
Imperva classifies two thirds of these bad bots (66%) as ‘evasive’ and “employing advanced techniques to mimic human behaviour”.
The overall level of automated malicious traffic across all sectors rose for the fifth year in succession last year to account for one third (32%) of all internet traffic – up by one third or eight percentage points since 2019.
Imperva suggests the increase has been driven in part by increasing use of artificial intelligence (AI) and the large language models (LLMs) used in generative AI ‘training’, which is also affecting the level of bot sophistication.
The report found half (49.6%) of all internet traffic comprises bots, and automated traffic surpassed human traffic in four months of last year – April, June, July and August – with the proportion of online human traffic at the lowest level yet recorded.
Travel is now the fourth most-targeted industry by automated malicious traffic, behind gaming, telecommunications, and computing and IT, but ahead of 13 other sectors including gambling, financial services and business services.
The industry is also the fourth most targeted by ‘advanced’ malicious traffic with almost 61% of bad bots in the sector as classed ‘sophisticated’.
Worse, travel is the second most targeted by bot attacks, suffering 20.7% of all online attacks, behind only the retail sector on 24.4%. Financial services was the only other sector where attacks hit a double-digit proportion of the total (15.7%).
More than one in 10 of all online account-takeover attacks were targeted at travel (11.5%), a proportion only exceeded by financial services (36.8%), and 17% of all login attempts in travel were classed as malicious – with the UK the second-most targeted country for such attacks behind the US.
The travel sector also suffered the third highest level of compromised user accounts.
Imperva noted: “The travel industry always struggled with complex bot problems [and] airlines are particularly targeted . . . [by bots which] scrape data, disrupt services and sometimes commit fraud.”
It suggests malicious bots impact the travel sector by scraping fares and other data, seat ‘spinning’ – holding airline seats to release or resell these at a premium – stealing loyalty points and facilitating card fraud.
Nanhi Singh, Imperva general manager for application security, warned: “The travel sector faces a growing threat in the form of malicious bots [which] poses significant risks to customer data.”
He recommended “changing the way organisations approach building and protecting their websites and applications”, saying: “Organisations in the travel industry must invest in bot management and API security tools to safeguard against these threats.”
‘Bad’ bots perform tasks with malicious intent, such as extracting data without permission. So-called ‘good’ bots index site content for search engines and monitor the performance of sites.
Imperva suggests users look out for unusual price fluctuations, slow website performance, frequent CAPTCHA challenges, unexpected availability changes and suspicious emails or messages as signs of malicious bot activity.