Advertisement traffic cheating interception method and device, server and storage medium

Abstract

The application provides an advertisement traffic cheating interception method and device, a server and a storage medium. Download request data sent by a user by clicking an advertisement link is received to enable the user to download target program software. A software development kit for monitoring cheating is preconfigured in the target program software. When the user installs the target program software, installation request data is received, and an authorization code of the target program software is verified. When the user operates the target program software, operation request data is received. The download request data, the installation request data and the operation request data are analyzed to form quality report data. When the quality report data is abnormal, the abnormal quality report data is determined to be cheating data, and the cheating data is intercepted. The advertisement traffic cheating interception method verifies the authorization code and filters abnormal data when the user downloads and installs the target program software. The method can effectively intercept advertisement traffic cheating behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an advertisement traffic cheating interception method and device, a server and a computer readable storage medium. BACKGROUND

[0002] With the development of network technology, websites have become a relatively effective platform for promotion. Many enterprises or companies use websites to promote their products (such as applications or application software). In order to achieve better results, some advertisers will place their advertisement codes (i.e. Internet advertisements) on websites with more traffic for customers to browse, so as to achieve the expected promotion effect.

[0003] Internet advertising has become an extremely important monetization mode. At the same time, there are numerous cheating methods in the advertising industry, such as installation hijacking, device farming, Bots, and other cheating methods are increasingly incubated. Some even develop various cheating tools in order to carry out larger-scale cheating behavior, which constantly challenges the healthy development of the industry. It is particularly important to intercept advertisement traffic cheating. SUMMARY

[0004] Therefore, the present application provides an advertisement traffic cheating interception method, device, server and computer readable storage medium.

[0005] In a first aspect, the present application provides an advertisement traffic cheating interception method, which comprises:

[0006] receiving download request data sent by a user by clicking an advertisement link, so that the user downloads a target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating;

[0007] receiving installation request data when the user installs the target program software, and verifying an authorization code of the target program software;

[0008] receiving operation request data when the user operates the target program software;

[0009] analyzing the download request data, the installation request data and the operation request data to form quality report data;

[0010] when the quality report data is abnormal, determining that the abnormal quality report data is cheating data and intercepting the cheating data.

[0011] In a second aspect, the present application provides an advertisement traffic cheating interception device, which comprises:

[0012] The downloading request receiving module is configured to receive downloading request data sent by a user by clicking an advertisement link, so as to enable the user to download target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating;

[0013] The installation request receiving module is configured to receive installation request data when the user installs the target program software, and verify an authorization code of the target program software;

[0014] The operation request receiving module is configured to receive operation request data when the user operates the target program software;

[0015] The data analyzing module is configured to analyze the downloading request data, the installation request data and the operation request data, so as to form quality report data;

[0016] The data intercepting module is configured to determine abnormal quality report data as cheating data and intercept the cheating data when the quality report data is abnormal.

[0017] In a third aspect, an embodiment of the present application provides a server, comprising: a memory; one or more processors coupled with the memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more application programs are configured to execute the method for intercepting advertisement traffic cheating provided in the first aspect.

[0018] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores program codes, and the program codes can be invoked by a processor to execute the method for intercepting advertisement traffic cheating provided in the first aspect.

[0019] The method, device, server and computer readable storage medium provided by the embodiments of the present application receive downloading request data sent by a user by clicking an advertisement link, so as to enable the user to download target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating; installation request data is received when the user installs the target program software, and an authorization code of the target program software is verified; operation request data is received when the user operates the target program software; downloading request data, installation request data and operation request data are analyzed, so as to form quality report data; and when the quality report data is abnormal, abnormal quality report data is determined as cheating data and the cheating data is intercepted.

[0020] The method for intercepting advertisement traffic cheating in the embodiments of the present application verifies an authorization code and filters abnormal data when a user downloads and installs target program software. The method can effectively intercept advertisement traffic cheating behavior. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the accompanying drawings in the following description only only the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0022] Figure 1 The application scenario diagram of the advertisement traffic cheating interception method provided by an embodiment of the present application is shown in the figure.

[0023] Figure 2 The flowchart of the advertisement traffic cheating interception method provided by an embodiment of the present application is shown in the figure.

[0024] Figure 3 The structural diagram of the advertisement traffic cheating interception device provided by an embodiment of the present application is shown in the figure.

[0025] Figure 4 The structural diagram of the server provided by an embodiment of the present application is shown in the figure.

[0026] Figure 5 The structural diagram of the computer readable storage medium provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely as follows. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the accompanying drawings in the following description only only the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0029] Please refer to Figure 1 , Figure 1A schematic diagram of an application scenario of the method for intercepting advertisement traffic cheating provided in the embodiments of the present application is shown, and the application scenario includes a terminal device 102 and a server 104 provided in the embodiments of the present application, wherein the server 104 is provided with a network with the terminal device 102. The network is used as a medium for providing a communication link between the terminal device 102 and the server 104. The terminal device 102 interacts with the server 104 through the network to receive or send messages, and the server 104 can be a server providing various services. The server 104 can be used to execute the method for intercepting advertisement traffic cheating provided in the embodiments of the present application. A user can use the terminal device 102 to click an advertisement link on an advertisement platform to send request data to the server, and download a target program software. When the user installs and operates the target program software, the user also sends corresponding request data to the server. The server analyzes the request data to determine whether there is cheating data, and intercepts the cheating data when the cheating data exists.

[0030] Optionally, the terminal device 102 can be various electronic devices with a display screen, including but not limited to a smart phone and a computer device. The computer device can be at least one of a desktop computer, a portable computer, a laptop computer, a tablet computer, and the like. The terminal device 102 can generally refer to one of a plurality of terminal devices.

[0031] It should be understood that the number of terminal devices, networks, and servers is only illustrative. According to the implementation needs, there can be any number of terminal devices, networks, and servers. For example, the server can be a server cluster composed of multiple servers.

[0032] Based on this, the embodiments of the present application provide a method for intercepting advertisement traffic cheating. Please refer to Figure 2 , Figure 2 A flowchart of a method for intercepting advertisement traffic cheating provided in the embodiments of the present application is shown. The method is applied to a server in Figure 1 for example, and includes the following steps:

[0033] In step S110, download request data sent by a user by clicking an advertisement link is received, so that the user downloads a target program software.

[0034] The target program software is pre-configured with a software development kit for monitoring cheating.

[0035] Specifically, the Internet advertisement is an advertisement of an advertiser's application displayed on an Internet platform or a publisher's application. A user can click the advertisement link to download the corresponding program software in the advertiser's application store, and install and use the program software. In this process, the Internet platform or the publisher provides corresponding advertisement traffic, and thus can collect corresponding advertisement fees. In order to collect more advertisement fees, the Internet platform or the publisher often fakes or cheats the advertisement traffic. Based on this, the embodiments of the present application monitor and analyze the advertisement traffic, so as to determine whether there is cheating data, and intercept or filter the cheating data.

[0036] The target program software refers to a program software that needs to be promoted by an advertisement of an advertiser displayed on an Internet platform or a publisher's application.

[0037] A software development kit (Software Development Kit, SDK) is a collection of development tools used by software engineers to create applications for a specific software package, software framework, hardware platform, operating system, etc.

[0038] In the embodiment, the target program software is pre-configured with a software development kit for monitoring cheating. When a user clicks the advertisement link to download, install and use the target program software, the SDK can collect and send the related request data to the server; the server analyzes the data to determine whether there is an anomaly, i.e., whether there is cheating data, and if so, intercepts and filters the cheating data.

[0039] The download request data is the request data sent by the user when the user wants to download the target program software, including but not limited to the ip, model type, device id, country of origin and use language of the terminal device (such as a mobile device) used by the user.

[0040] Step S120, when the user installs the target program software, the installation request data is received, and the authorization code of the target program software is verified.

[0041] Step S130, when the user operates the target program software, the operation request data is received.

[0042] After the user completes the download of the target program software, the target program software is installed and operated (such as registration, login and recharging, etc.). The SDK sends the installation request data and the operation request data to the server through the terminal device used by the user.

[0043] Additionally, when the user installs the target program software, it is necessary to verify whether the authorization code of the target program software is valid, i.e., to verify whether the actual authorization code of the target program software installed by the user is consistent with the real authorization code of the target program software (i.e., the authorization code carried by the user from the download of the target program software in the application store of the advertiser), if consistent, the authorization code is valid, and the target program software is installed successfully. If the authorization code is invalid, the target program software is not installed successfully, and the download request data and the installation request data corresponding to the target program software are marked as abnormal data or cheating data.

[0044] In step S140, the download request data, the installation request data, and the operation request data are analyzed to form quality report data.

[0045] In step S150, when the quality report data is abnormal, the abnormal quality report data is determined as cheating data and the cheating data is intercepted.

[0046] Specifically, the server can analyze the download request data, the installation request data, and the operation request data to generate quality report data. And analyze whether the quality report data is abnormal, when there is an abnormality, the abnormal data is recorded as cheating data, and the cheating data is intercepted or filtered.

[0047] The method for intercepting advertisement flow cheating provided by the embodiment of the application receives download request data sent by a user by clicking an advertisement link, so that the user downloads target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating; when the user installs the target program software, installation request data is received, and the authorization code of the target program software is verified; when the user operates the target program software, operation request data is received; the download request data, the installation request data, and the operation request data are analyzed to form quality report data; when the quality report data is abnormal, the abnormal quality report data is determined as cheating data and the cheating data is intercepted.

[0048] The method for intercepting advertisement flow cheating in the embodiment of the application verifies the authorization code and filters abnormal data when the user downloads and installs the target program software. The method can effectively intercept the behavior of advertisement flow cheating.

[0049] In one embodiment, analyzing the quality report data includes a software basic parameter; when the quality report data is abnormal in step S150, the abnormal quality report data is determined as cheating data and the cheating data is intercepted, including: when the software basic parameter is abnormal, the abnormal software basic parameter is determined as cheating data, and the cheating data is intercepted.

[0050] Specifically, the quality report data contains software basic parameters, including but not limited to the ip, model, device id, country of origin and language of the terminal device (such as a mobile phone device) used by the user. The actual software basic parameters of the target program software (i.e. the software basic parameters used when the target program software is actually installed) are matched with the software basic parameters contained in the download request data (i.e. the software basic parameters present in the quality report data). When the match is successful, the verification is passed; when the match is not successful, it indicates that there is an abnormality in the software basic parameters, indicating that there is a cheating behavior, and the abnormal software basic parameters are determined to be cheating data, and the cheating data is intercepted.

[0051] In one embodiment, the quality report data includes a click-to-activation time indicator; when the quality report data is abnormal in the execution step S150, the abnormal quality report data is determined to be cheating data and the cheating data is intercepted, including: when the software basic parameters are normal, the click-to-activation time indicator is analyzed; when the click-to-activation time indicator is greater than a first preset threshold value or less than a second preset threshold value, the abnormal click-to-activation time indicator is determined to be cheating data and the cheating data is intercepted.

[0052] In one embodiment, the quality report data includes a click-to-activation time indicator; when the quality report data is abnormal in the execution step S150, the abnormal quality report data is determined to be cheating data and the cheating data is intercepted, including: when the software basic parameters are normal, the click-to-activation time indicator is analyzed; when the click-to-activation time indicator is greater than a first preset threshold value or less than a second preset threshold value, the abnormal click-to-activation time indicator is determined to be cheating data and the cheating data is intercepted.

[0053] In this embodiment, the first preset threshold value and the second preset threshold value are both pre-set values, which can be set according to actual use. For example, the first preset threshold value can be 24h, and the second preset threshold value can be 10 seconds.

[0054] The above method can quickly and accurately filter out cheating data.

[0055] In one embodiment, the quality report data includes a new machine probability indicator; when the quality report data is abnormal in the execution step S150, the abnormal quality report data is determined to be cheating data and the cheating data is intercepted, including: when the click-to-activation time indicator is less than the first preset threshold value and greater than the second preset threshold value, the new machine probability indicator is analyzed for matching; when the new machine probability indicator matches, a new machine flag is marked.

[0056] Specifically, the new probability, i.e. the new device ratio, also referred to as the new device proportion, refers to the percentage of new devices in the target program software installation. The appearance of new devices is of course normal, such as new users installing applications or old users replacing devices. However, it is necessary to closely observe whether the new device proportion based on the device ID is reasonable. Because the new device proportion is easily affected by the cheating means of device ID resetting, which is a common cheating means.

[0057] When the new probability matches, it means that the percentage of new devices in the target program software installation is within a normal range. At this time, the new device is marked, and when the new device appears later, it can be compared with the marked new device to avoid device ID resetting and thus form cheating.

[0058] Further, an embodiment of cluster detection is given, which is described in detail as follows:

[0059] In one embodiment, the method further comprises: collecting all quality report data within a preset time period to form a quality report data set; dividing the quality report data set according to sub-channel information to form multiple sub-channel data; and for each sub-channel data, filtering cheating data when the cheating data in the sub-channel data exceeds a preset number.

[0060] Specifically, in the advertising role positioning, there are an advertiser (or an advertising party) and a channel party (or an advertising publisher); the advertiser refers to a party that has a target program software (i.e. an app) to be put; the channel party refers to a party that puts the target program software of the advertiser into an Internet platform in the form of an advertisement, wherein the channel has multiple sub-channels.

[0061] For each quality report data, the channel and sub-channel information to which it belongs can be tracked. In this embodiment, all quality report data within a period of time (i.e. within a preset time period) is collected to form a quality report data set, and then the quality report data set is divided by sub-channel as a dimension, and when the cheating data of a certain sub-channel exceeds a preset number, the cheating data is filtered.

[0062] The preset data is also referred to as a warning line, which is calculated by an algorithm based on cheating number, cheating proportion per unit time, cheating time frequency, etc., and is used to filter abnormal data by sub-channel dimension.

[0063] In one embodiment, when the cheating data in the sub-channel data exceeds a preset number, the cheating data is filtered, including: comparing whether the proportion interval of the click-to-activation time index and the new device proportion in the sub-channel data exceeds the corresponding preset number; if so, filtering the corresponding click-to-activation time index and new device data.

[0064] Specifically, the quality report data is analyzed in the sub-channel dimension, and whether the CTIT proportion interval and the new machine proportion are abnormal is observed. If abnormal, the filtering is performed.

[0065] In this embodiment, the quality report data is analyzed in the sub-channel dimension, so as to further process the cheating data.

[0066] Next, an implementation of attribution processing is also given, which is described in detail as follows:

[0067] In one embodiment, the method further comprises: performing attribution analysis on each sub-channel data after filtering the cheating data by using a machine learning method, so as to form a post-attribution quality report.

[0068] Specifically, after the quality report data set is processed in the sub-channel dimension, post-attribution analysis is performed on each processed sub-channel data, so as to form a post-attribution quality report. In simple terms, attribution is to monitor the advertising effect or operation action through the matching of the directable and traceable data, so as to verify the behavior relationship between the user behavior and the product conversion.

[0069] In this embodiment, the machine learning method can be used for attribution analysis to form a post-attribution quality report. The attribution analysis can be to analyze the quality report data with conversion in the same channel, which is concentrated in a certain time frequency band, and the CTIT (i.e. the time from user click to app installation) is concentrated in an interval. Then, it is considered as a key marker with high probability of batch machine brushing behavior. When performing attribution analysis, the channel can be scored according to the abnormality, and when the channel score is ideal, the attribution passes, and when the channel score is not ideal, a channel warning notification is issued.

[0070] In this way, the post-attribution cheating can be intercepted, and the cheating behavior can be further filtered.

[0071] It should be understood that, although Figure 2 the steps in the flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in sequence according to the arrows. Unless otherwise specified in this article, the execution of these steps has no strict sequence limitation, and these steps can be executed in other orders. Moreover Figure 2 at least part of the steps in the flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with other steps or sub-steps or stages of other steps.

[0072] The method for intercepting advertisement flow cheating is described in detail in the embodiments of the present disclosure, and the method can be implemented in various forms of devices. Therefore, the present disclosure further discloses an apparatus for intercepting advertisement flow cheating corresponding to the method. The specific embodiments are given below for detailed description.

[0073] Please refer to Figure 3 The apparatus for intercepting advertisement flow cheating disclosed in the embodiments of the present disclosure mainly comprises:

[0074] The download request receiving module 310 is configured to receive the download request data sent by the user by clicking the advertisement link, so that the user can download the target program software. The target program software is pre-configured with a software development kit for monitoring cheating.

[0075] The installation request receiving module 320 is configured to receive the installation request data when the user installs the target program software, and verify the authorization code of the target program software.

[0076] The operation request receiving module 330 is configured to receive the operation request data when the user operates the target program software.

[0077] The data analysis module 340 is configured to analyze the download request data, the installation request data, and the operation request data to form quality report data.

[0078] The data interception module 350 is configured to determine the abnormal quality report data as cheating data and intercept the cheating data when the quality report data is abnormal.

[0079] In one embodiment, the quality report data includes software basic parameters; and the data interception module 350 is configured to determine the abnormal software basic parameters as cheating data and intercept the cheating data when the software basic parameters are abnormal.

[0080] In one embodiment, the quality report data includes a click-to-activation time index; the data interception module 350 is configured to analyze the click-to-activation time index when the software basic parameters are normal; and determine the abnormal click-to-activation time index as cheating data and intercept the cheating data when the click-to-activation time index is greater than a first preset threshold or less than a second preset threshold.

[0081] In one embodiment, the quality report data includes a new machine probability index; the data interception module 350 is configured to analyze whether the new machine probability index matches when the click-to-activation time index is less than the first preset threshold and greater than the second preset threshold; and perform a new machine marking when the new machine probability index matches.

[0082] In an embodiment, the apparatus further comprises: a cheating data filtering module, configured to: collect all quality report data in a preset time period to form a quality report data set; divide the quality report data set according to sub-channel information to form a plurality of sub-channel data; and for each sub-channel data, filter cheating data when the cheating data in the sub-channel data exceeds a preset number.

[0083] In an embodiment, the cheating data filtering module is configured to: compare whether a proportion interval of a click-to-activation time indicator and a new machine proportion in the sub-channel data exceeds a corresponding preset number; and if so, filter the corresponding click-to-activation time indicator and new machine data.

[0084] In an embodiment, the apparatus further comprises: an attribution module, configured to: perform attribution analysis on each sub-channel data after filtering cheating data by using a machine learning method to form an attribution quality report.

[0085] The specific limitations of the interception apparatus for advertisement traffic cheating can be seen from the limitations of the method described above, and will not be repeated here. Each module in the apparatus described above can be realized by software, hardware and a combination thereof in whole or in part. Each module described above can be embedded in or independent of the processor in the server in hardware form, or can be stored in the memory in the server in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0086] Please refer to Figure 4 , Figure 4 which shows a structural block diagram of a server provided by an embodiment of the present application. The server 40 can be a computer device. The server 40 in the present application can include one or more of the following components: a processor 42, a memory 44, and one or more application programs, wherein the one or more application programs can be stored in the memory 44 and configured to be executed by the one or more processors 42, and the one or more application programs are configured to perform the method described in the above-mentioned interception method embodiments applied to advertisement traffic cheating.

[0087] The processor 42 can include one or more processing cores. The processor 42 connects various parts within the server 40 by various interfaces and lines, performs various functions of the server 40 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 44, and calling data stored in the memory 44. Alternatively, the processor 42 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 42 can be integrated with a combination of one or more of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes operating systems, user interfaces, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 42, but be implemented separately by a communication chip.

[0088] The memory 44 can include a random access memory (RAM) and can also include a read-only memory (ROM). The memory 44 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 44 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing various method embodiments described below, etc. The data storage area can also store data created by the server 40 in use, etc.

[0089] Those skilled in the art can understand that the structure shown in the above-mentioned embodiments is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the server to which the scheme of the present application is applied. The specific server can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement. Figure 4

[0090] In summary, the server provided by the embodiments of the present application is used to implement the corresponding advertisement traffic cheating interception method in the foregoing method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described here.

[0091] Please refer to Figure 5 ​FIG. 5 shows a structural block diagram of a computer readable storage medium according to an embodiment of the present application. The computer readable storage medium 50 stores program codes, which can be invoked by a processor to execute the method described in the above embodiment of the method for intercepting advertisement flow cheating.

[0092] The computer readable storage medium 50 can be an electronic storage such as a flash memory, an EEPROM (Electrically Erasable Programmable Read-Only Memory), an EPROM, a hard disk, or a ROM. Alternatively, the computer readable storage medium 50 comprises a non-transitory computer readable storage medium. The computer readable storage medium 50 has a storage space for program codes 52 for executing any of the method steps described above. These program codes can be read from or written to one or more computer program products. The program codes 52 can be compressed in a suitable form, for example.

[0093] In the description of the present specification, the description referring to the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific feature, structure, material or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present application. The illustrative expressions of the above terms in the present specification do not necessarily refer to the same embodiment or example. Moreover, the specific feature, structure, material or characteristic described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples, without contradiction.

[0094] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An advertisement traffic fraud interception method, characterized by, The method comprises: receiving download request data sent by a user by clicking an advertisement link to enable the user to download target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating; receiving installation request data when the user installs the target program software and verifying an authorization code of the target program software; receiving operation request data when the user operates the target program software; analyzing the download request data, the installation request data and the operation request data to form quality report data; when the quality report data is abnormal, determining that the abnormal quality report data is cheating data and intercepting the cheating data; wherein the quality report data comprises a new machine probability indicator; when the quality report data is abnormal, determining that the abnormal quality report data is cheating data and intercepting the cheating data, comprising: when a click-to-activation time indicator is less than a first preset threshold and greater than a second preset threshold, analyzing whether the new machine probability indicator matches; when the new machine probability indicator matches, performing a new machine marking.

2. The method of claim 1, wherein, The quality report data comprises a software basic parameter; when the quality report data is abnormal, determining that the abnormal quality report data is cheating data and intercepting the cheating data, comprising: when the software basic parameter is abnormal, determining that the abnormal software basic parameter is cheating data and intercepting the cheating data.

3. The method of claim 2, wherein, The quality report data comprises a click-to-activation time indicator; when the quality report data is abnormal, determining that the abnormal quality report data is cheating data and intercepting the cheating data, comprising: when the software basic parameter is normal, analyzing the click-to-activation time indicator; when the click-to-activation time indicator is greater than a first preset threshold or less than a second preset threshold, determining that the abnormal click-to-activation time indicator is cheating data and intercepting the cheating data.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: pooled quality report data in a preset time period to form a quality report data set; dividing the quality report data set according to sub-channel information to form a plurality of sub-channel data; for each of the sub-channel data, when the cheating data in the sub-channel data exceeds a preset number, filtering the cheating data.

5. The method of claim 4, wherein, When the cheating data in the sub-channel data exceeds a preset number, filtering the cheating data, comprising: comparing whether the proportion interval of the click-to-activation time indicator and the new machine proportion in the sub-channel data exceeds the corresponding preset number; if so, filtering the corresponding click-to-activation time indicator and new machine data.

6. The method of claim 5, wherein, The method further comprises: performing attribution analysis on each sub-channel data after filtering the cheating data using a machine learning method to form post-attribution quality report data.

7. An apparatus for intercepting advertisement traffic fraud, characterized by, The device comprises: a download request receiving module for receiving download request data sent by a user by clicking an advertisement link to enable the user to download target program software; wherein the target program software is pre-configured with a software development kit for monitoring cheating; an installation request receiving module for receiving installation request data when the user installs the target program software and verifying an authorization code of the target program software; a quality report analyzing module for analyzing the download request data, the installation request data and the operation request data to form quality report data; An operation request receiving module, configured to receive operation request data when a user operates the target program software; A data analysis module, configured to analyze the download request data, the installation request data and the operation request data to form quality report data; A data interception module, configured to determine abnormal quality report data as cheating data and intercept the cheating data when the quality report data is abnormal.

8. A server, characterized by comprising: a memory; one or more processors coupled with the memory; one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more application programs are configured to perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores program codes, and the program codes can be called and executed by the processor to perform the method according to any one of claims 1-6.

Images