Malicious bots are getting more sophisticated and bot blocking companies are raising more cash – the arms race is in full swing.
One such company, Distil Networks, announced $21 million in Series C funding on Tuesday as part of its bid to keep combating what CEO Rami Essaid called “a growing problem.”
The round, led by new investor Silicon Valley Bank and existing investors Bessemer Venture Partners, Foundry Group and TechStars, brings Distil’s total funding to $65 million. This Series C follows Distil’s $21 million Series B in June 2015.
“The biggest, broadest issue we see is that bots are getting smarter and smarter,” said Essaid, who co-founded Distil in 2011 when bot operators ran less savvy operations.
“There was a time a few years ago when maybe less than a quarter of bots were able to execute JavaScript and mimic real people,” he said. “But we’ve found that around 88% of what’s out there today are what we refer to as ‘advanced persistent bots.’”
Advanced persistent bots are considered advanced because they can convincingly imitate human behavior, load JavaScript, spoof IP addresses, mess with cookies and perform browser automation like mouse manipulation. They’re persistent because they know how to evade detection by using peer-to-peer proxies or dynamic, rotating IP addresses that make it difficult to pin down their source.
These more cunning bot creations are evidence that traditional detection methods aren’t cutting it anymore, said Essaid. But, albeit somewhat ironically, increased scrutiny of the bot problem is part of what’s forcing bot operators to get smarter.
“The bad guys are evolving, so we have to invest more and more everyday to stay ahead of them,” he said.
Distil’s machine learning technology works by analyzing website traffic and tracking anomalies in real time to determine whether an incoming http request is a bot or not. If the request looks like it’s being generated by a bot, it’s blocked. Distil also creates a fingerprint for each bot it blocks so that the bot is still detectable even if it changes its IP address. That information is then shared across Distil’s client base.
That’s the automated part of Distil’s solution. The company shored up its offering with ScrapeSentry, a Swedish team of cybersecurity analysts it acqui-hired in January to help provide “a human touch,” Essaid said.
“An automated solution like ours can catch a lot, but we need to close that last mile gap,” he said. “Layering in real people helps us do that.”
Because bots are tricky little beasts and they’re perpetrating more than just digital ad fraud. Bots also scrape data, hijack accounts, conduct unauthorized vulnerability scans, skew analytics, run man-in-the-middle attacks and commit a host of other unsavory acts.
That’s part of why Distil is starting to take more of a community approach to fraud. Security and fraud companies need to collaborate and share knowledge across customers if they have any real chance of making a series dent, Essaid said.
“We know bots, but there is a large spectrum of things publishers need to be on the lookout for that have nothing to do with bots like cookie stuffing and off-screen ads. And, frankly, those are products we don’t want to build ourselves,” he said. “It’s not a good things when companies in our space work in silos.”
As for what Distil has on tap for its Series C, most of the cash will go toward fueling growth. Essaid claims Distil is doubling its revenue year over year.
Right now, Distil’s headcount stands at just under 150. By the end of 2017, Essaid is hoping to double that number with a mix of marketing and sales people, engineers and data scientists.
On the immediate road map is a project to unify several of Distil’s products – its API security solution and its web-based bot detection and mitigation tool – into a single dashboard. In the longer term, Distil will continue working on the notion of combining human security analysis with automation, à la ScrapeSentry.
Like it did after its Series B last year with ScrapeSentry, Distil will put aside a portion of its funding for a “strategic acquisition.” One area of interest is figuring out how to tie native mobile apps data together with the web. “Mobile users are the same as web users, and more needs to be done to bring them together,” Essaid said.
In addition to its headquarters in San Francisco, Distil has offices in North Carolina, Virginia, London and Stockholm (ScrapeSentry’s stomping ground). There’s a plan to expand these locations to accommodate the swelling headcount, but not to open new ones.
