Shifting Sands: The Ever-Changing Code That Keeps Bots at Bay

At DataDome, we’ve developed an innovative approach to protect our detection scripts through a system of dynamic rebuilds that continuously transforms our code while maintaining its functionality. This blog explores how this system works and why it’s so effective against sophisticated bot attacks.

The challenge: protecting detection logic

DataDome embeds JavaScript code in several components, such as our Device Check. This code runs sophisticated bot detection checks that identify whether a page is being accessed by an automated system and blocks malicious bots from proceeding.

The effectiveness of these detection mechanisms relies in part on their opacity to attackers. If bot operators were able to reverse engineer our code and gain valuable insights into our detection logic, they might then craft attacks to attempt to bypass our security measures by sending falsified data that mimics legitimate traffic patterns.

Our solution: the dynamic daily build system

To counter reverse engineering attempts, we’ve implemented a dynamic build mechanism that completely rebuilds our script artifacts regularly.

How it works

When a build occurs, the core detection behavior remains consistent, but the script undergoes a complete transformation across multiple dimensions:

1. Code structure transformation: The overall architecture changes dramatically – like remodeling a house by moving the furniture, appliances, but also the doors and the walls.
2. Execution flow alteration: The sequence the code follows during execution changes – like taking different roads to reach the same destination every day.
3. Identifier regeneration: All names and labels in the code are completely replaced – like a movie with the same plot but entirely different actors.
4. Data representation changes: How information is formatted and structured is randomized – like expressing the same concept in a brand new language.
5. Hidden keys integration: Each build contains unique embedded validation markers – like an invisible watermark.

The result is that each build’s script is functionally equivalent to the previous one but appears fundamentally different at the code level.

A Race Against Time

Any attempt to reverse engineer our JavaScript becomes a race against time. The moment an attacker starts analyzing a script, their work is rendered obsolete when the next build rolls out.

By automatically invalidating reverse engineering efforts on a periodic basis, we create a moving target that is incredibly difficult for attackers to hit, and expensive to maintain. What worked yesterday won’t work today, and what works today won’t work tomorrow.

Future enhancements

To stay ahead of increasingly sophisticated attacks, we are continuously refining our rebuild system. Future improvements include:

• Increasing build frequency
• Implementing regional build variations
• Adding deeper structural transformations
• Leveraging AI to generate code transformations

Staying one step ahead

At DataDome, protecting our detection logic is a top priority in our mission to combat sophisticated bot attacks. Our dynamic builds mechanism exemplifies how innovation can outpace attackers by continuously evolving defenses. By regenerating our scripts periodically, we ensure that reverse engineering efforts are rendered futile, keeping our detection logic secure and effective.

As threats continue to grow in complexity, so too must our defenses. Dynamic builds are just one example of how we stay ahead in this ongoing battle against bots.

Curious how dynamic builds fit into a broader strategy to detect and stop bots in real time? Schedule a demo to see how DataDome protects your applications—no matter how quickly attackers adapt.