F5 Networks added a tool to its Silverline application security services platform that uses artificial intelligence (AI) to protect websites from fake internet traffic.

Silverline Shape Defense is a managed service that uses recently acquired Shape Security’s technology to protect against bots, credential stuffing, scraping, and other automated attacks. F5 bought Shape for $1 billion late last year. Shape’s network blocks more than 1 billion application attacks daily.

The new F5 security service uses AI to determine in real-time if an application request is from a human or a bot, and it also differentiates between a bad actor and authorized individual. This stops bad traffic without adding login friction for legitimate users.

The Silverline application services platform already provided managed distributed denial of services (DDoS) protection, a web application firewall, and threat intelligence. “And now we have the fraud [prevention] capability using Shape’s artificial intelligence and machine learning capabilities. It’s really a huge step up in benefits for customers,” said Gail Coury, Silverline VP and GM at F5.

One of these customers, Kinecta Federal Credit Union in Manhattan Beach, California, started seeing a massive influx in bot attacks in mid-May despite implementing several attack monitoring and blocking services. The $5 billion credit union has less than 100,000 mobile banking users, “and normally, on a good day, we have 7,000 to 8,000 successful logins,” said CIO Sharon Moseley. When the bot attacks started, “we were having 210,000 failed logins per hour,” she added. “It was really ridiculous.”

These attacks also hurt legitimate banking customers’ experience because of failed login attempts, webpages timing out, and slow performance. Moseley described it as a mess. “When I say a mess, I mean escalated member calls to our CEO, horrible [website] performance, and sometimes not being able to get in to look at your bank account, which is pretty alarming to people when they expect their money to be safe and secure.”

Meanwhile, Moseley’s team had been working on a data center migration project, and had moved about 70 of 100 applications to the new facility. “But for that entire month, nothing got moved,” she said. “It was all hands on deck trying to solve this.”

Moseley had heard about Shape, recently acquired by F5, through a chance phone call, and she asked if the vendor had a security tool to stop credential stuffing. After checking out a Silverline Shape Defense reference — a larger credit union in Alberta, Canada, that had experienced similar bot attacks and stopped them using F5’s new service — Kinecta Federal Credit Union deployed Shape Defense.

“By Tuesday, folks were starting to implement it, and by Thursday night at 6 p.m. it was up and running and working and solved our problem,” Moseley said. “It was like heaven. Traffic immediately slowed down to normal. By Saturday, the bots were trying a new approach, and we could start to see the traffic up again. The solution was tweaked on Sunday, and that slowed it down to once again to just normal, legitimate numbers logging in, and pretty much all of the failed attempts were gone.”