On May 11th, one of my Pandorabots unexpectedly soared to the top of the Most Active/Popular list… without any effort from me.  Not just to the top, but way over the top, due to one conversation comprised of 96972 interactions.  The log is so large that the Training Interface can’t seem to open it.

Usually when that happens, you might receive a cautionary email from Pandorabots, or if they can’t contact you, they might even place a message on your bot so that all replies will state that your bot is taking up a lot of resources on their free server, and that the activity indicates that this bot may be connected to other automated bot scripts and that it is using up resources at a rapid rate.

I share their concern.  Overloading enough bots like that could amount to a Denial of Service Attack.

When I’ve analyzed unusually large logs in the past, they’ve almost always shared similar characteristics.  Often they come from the same IP addresses.  When I research the IP addresses, they frequently appear at sites such as http://www.projecthoneypot.org/ or http://www.stopforumspam.com/ that list known forum spammers.  Although they’re very long, they may take place in a relatively short amount of time, less time than shorter conversations.  In some cases., many of the responses are known ALICE answers.

The conversations might be repetitious, or fall into a loop, asking and answering the same things over and over again.  And, even though my bot has stopped replying because the visitor has engaged in bad behavior, the questioning goes on, when humans normally give up and leave after they’ve realized the bot is no longer responding.

Lastly, I’m confident that I’m not the only Pandorabot botmaster experiencing this.  I regularly see bots come out of nowhere and shoot to the top of the MostActive/Popular list.  I see bots that are always on that list, yet they have nothing to offer and haven’t had a word changed since they were first acquired.  One day, as I was viewing my chatlogs, I saw one of my bots logs almost double in size as I was watching.

05/12/2013 05:19:08 AM GMT 05/12/2013 09:21:53 AM GMT 615 / 615  3192563

05/12/2013 05:19:08 AM GMT 05/12/2013 12:20:35 PM GMT 1082 / 1082  3192563

I don’t know what the solution is because I don’t know all that’s possible from the standpoint of Pandorabots.  Merely blocking IPs might not always be the best remedy because some users could subscribe to a Internet Provider that affords them a dynamic or rotating address.  However, at the very least, reporting such people to their IP might be better than doing nothing.