How can I monitor for bot accounts accessing drupal paths without permission? On my site, users do not have permission to create content.

However, looking through the watchdog logs, I found several accounts that were attempting to access

node/add/article
node/add/page


and so on.  In this case, all the accounts were registered from @ad.drupaler.org, so it was easy to eliminate them, but in case the same thing happens from a variety of domains in the future, I'd like to set up some way to alert myself that users are attempting to access these paths.

I am thinking about using the Rules module to do this, but I was wondering if there was already a "best practice" for this kind of thing-- since there are automated bots to attack Drupal sites, there might be an automated way to fight back.
You could try adding bot protection to your registration form, 

e.g with reCaptcha

Other worthwhile things are blocking the bots in your webserver, 

e.g nginx 


https://github.com/mariusv/nginx-badbot-blocker or 
https://github.com/oohnoitz/nginx-blacklist/blob/master/blacklist.conf 


Custom options include using the Flood control API, 

e.g flood_is_allowed and flood_register_event with ip blocking (e.g system_ip_blocking_form_submit) or user_block_user_action on the node/add or 403 page.