System and method for detecting and mitigating farm click fraud

Abstract

Systems and methods for mitigating click farm fraud are provided in which network data and sensor data are received from a plurality of computing devices and one or more features are extracted from the sensor data and the network data for each device. The features represent one or more of a local physical environment and a communication channel environment associated with a device of the plurality of computing devices. The method includes determining one or more subsets of the plurality of computing devices according to environmental characteristics and network characteristics of the one or more features; identifying a co-located computing device based on the one or more subsets and the detected influencer activity; in response to determining that the count of the co-located computing device is greater than the predetermined count, a session termination command is sent to one or more servers in communication with the co-located computing device to mitigate the click farm fraud activity.

Description

Technical Field

[0001] The presently disclosed technology relates generally to mitigating online fraud, and more particularly to systems and methods for detecting and preventing click farm fraudulent activities. Background Art

[0002] A click farm is a system of multiple computing devices in a public area that is operated by a fraudster to mimic the behavior of multiple legitimate users, thereby generating revenue for the fraudster. Figure 1 A typical click farm operation 100 is shown, in which a fraudster 104 (or an unwitting employee of the fraudster) utilizes multiple computing devices 102 to artificially simulate multiple people clicking on web pages and / or advertisements in a target application, posting false reviews, or performing other revenue-generating interactions. Figure 1 As shown, multiple computing devices 102 used in a click farm operation 100 are typically mounted on racks in a common area and continuously powered 106 for access by a fraudster 104 .

[0003] like Figure 2 As shown, click fraud may involve five parties: advertiser 202, publisher 204, ad network 206, web server 210, and click farm operator 104. Advertiser 202 submits an ad for ad network 206 to publish, and publisher 204 submits the ad to appear in a web page hosted by web server 210. When a user clicks on an ad in a web page, ad network 206 receives the click indication, updates advertiser 203's billing account, and redirects the click to a URL determined by advertiser 202. For each ad click, advertiser 202 pays ad network 206, which in turn pays publisher 204 and web page owner a significant portion of the revenue from each click. Publisher 204 then pays click farm operator 104. Therefore, a portion of the collected revenue is sent to the fraudulent click farm operator 104, while advertiser 204 does not receive any benefit. It is estimated that click fraud causes hundreds of millions of dollars in losses to advertisers each year.

[0004] Early attempts to combat click fraud relied on blacklisting publishers with high click volumes but low reputation scores, but fraudsters can simply abandon their publishing accounts and quickly open new ones. Attempts have also been made to combat bot-related click farm fraud by requiring users to complete visual CAPTCHAs or other authentication that requires human input. However, human click farm operators can easily complete such authentication when necessary. Companies often have solutions to detect malicious automated activity, but it can be difficult to detect weak signs of human fraud, especially when usage appears to be from multiple genuine users interacting with multiple devices. In addition, click farm operators can use virtual private networks (VPNs), device spoofing, location spoofing, and other means to evade detection, so traditional methods do not provide an immediate and reliable way to determine whether a user is a fraudster.

[0005] Recently, some behavioral biometric algorithms have been used to detect click farm activity. Such algorithms collect the behavior of users when they interact with devices, and after a period of learning, they can calculate the probability that a new session originated from a known user. However, the multiple devices in a click farm are usually operated by different fraudsters at different times (for example, the first fraudster may interact with multiple devices during the first shift, and then the second fraudster may interact with the same multiple devices during the second shift, and so on), so learning behavioral summaries of a single user and a single device is not effective in detecting such fraudulent activities. Even if the service provider suspects that some users are committing fraud, calculating the likelihood that the same actor is indeed handling multiple accounts by comparing behavioral summaries of different devices requires laboratory-like data collection and processing, which is impossible to achieve in practice. Therefore, the user behavior learning process has limited relevance to combating certain types of click farm fraud.

[0006] In light of this, there is a need to further improve click farm fraud detection and mitigation techniques. Summary of the invention

[0007] Certain example embodiments of the disclosed technology may include a method of detecting and mitigating click farm fraud.

[0008] According to certain embodiments of the disclosed technology, a method for detecting and mitigating click farm fraud is provided. The above method may include: receiving network data and sensor data from multiple computing devices; extracting one or more features from the sensor data and network data of each of the multiple computing devices, wherein the one or more features represent one or more of the local physical environment and the communication channel environment associated with the device in the multiple computing devices. The above method includes: based on the one or more features, determining one or more subsets of the multiple computing devices according to the environmental characteristics and network characteristics of the one or more features; identifying co-located computing devices based on the one or more subsets and detected influencer activities; in response to determining that the count of the co-located computing devices is greater than a predetermined count, sending a session termination command to one or more servers in communication with the co-located computing devices to mitigate click farm fraud activities.

[0009] According to certain embodiments of the disclosed technology, another method is provided for remotely collecting network data and sensor data from multiple computing devices; sending the sensor data and network data to a backend server; extracting one or more features from the sensor data and network data; clustering the multiple computing devices into one or more subsets based on equivalent features of the one or more features; and identifying co-located devices of the one or more subsets based on the clustering. The above method includes: in response to determining that the count of co-located devices is greater than a predetermined count, sending a session termination command to one or more servers in communication with the one or more co-located devices. In certain embodiments, when the count of co-located devices is greater than a predetermined count, an indication can be sent to a related advertising network and / or publisher to provide an alert about actual or potential click farm activities.

[0010] According to certain embodiments of the disclosed technology, a system is provided, which has a processor and a memory, wherein programming instructions stored on the memory, when executed by the processor, cause the processor to: receive network data and sensor data from multiple computing devices; extract one or more features from the sensor data and network data of each of the multiple computing devices, wherein the one or more features represent one or more of a local physical environment and a communication channel environment associated with a device in the multiple computing devices; based on the one or more features, determine one or more subsets of the multiple computing devices according to environmental characteristics and network characteristics of the one or more features; identify co-located computing devices based on the one or more subsets and detected influencer activities; and in response to determining that a count of the co-located computing devices is greater than a predetermined count, send a session termination command to one or more servers in communication with the co-located computing devices to mitigate click farm fraud activities.

[0011] According to certain embodiments of the disclosed technology, a system is provided, which has a processor and a memory, and when the programming instructions stored on the memory are executed by the processor, the processor remotely collects network data and sensor data from multiple computing devices. The sensor data may include one or more of the following: location information, device orientation, device motion characteristics, ambient lighting conditions and / or device battery power. The network data may include one or more of the following: telecommunications network information, related WiFi network information and / or related BLE devices. The above-mentioned programming instructions also instruct the processor to: send the sensor data and network data to a back-end server; the back-end server extracts one or more features from the sensor data and the network data; cluster multiple computing devices into one or more subsets based on equivalent features of one or more features; identify co-located devices of one or more subsets based on one or more clusters; in response to determining that the count of co-located devices is greater than a predetermined count, send a session termination command to one or more servers communicating with one or more co-located computing devices to mitigate click farm fraud activities.

[0012] According to certain embodiments of the disclosed technology, a non-transitory computer-readable medium stores software instructions, which, when executed by a processor, cause the processor to perform the following method: remotely collect network data and sensor data from multiple computing devices; send the sensor data and network data to a backend server; extract one or more features from the sensor data and network data; cluster multiple computing devices into one or more subsets based on equivalent features of the one or more features; and identify co-located devices of one or more subsets based on clustering. The above method includes: in response to determining that the count of co-located devices is greater than a predetermined count, sending a session termination command to one or more servers communicating with the one or more co-located devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Certain embodiments of the disclosed technology are described below in conjunction with the accompanying drawings and detailed description.

[0014] Figure 1 A typical click farm operation is shown, in which fraudsters use multiple computing devices to artificially mimic multiple people clicking on web pages and / or advertisements in a target application, posting false reviews, or performing other revenue-generating interactions.

[0015] Figure 2 A typical scenario is shown in which an advertising network can collect revenue from advertisers based on click traffic of target advertisements, and a portion of the collected revenue is sent to a click farm operator.

[0016] Figure 3 A block diagram of an example system for detecting click farm activity and mitigating related fraud according to certain example embodiments of the disclosed technology is shown.

[0017] Figure 4 Example processes that may be used to detect and mitigate click farm activity according to certain example embodiments of the disclosed technology are shown.

[0018] Figure 5A An initial clustering of co-located devices in click farm activity that may be used to detect click farm activity according to certain example embodiments of the disclosed technology is shown.

[0019] Figure 5B An example graphical representation is shown of how additional extracted features may be evaluated for participating in a refined clustering of the same click farm in accordance with certain example embodiments of the disclosed technology.

[0020] Fig. 6A The WiFi channel location and signal strength measured by the first device are shown.

[0021] Figure 6B Shows possible Fig. 6A The WiFi channel location and signal strength measured by a second device co-located with the first device are shown.

[0022] Fig. 7A An example of a time series representation of data showing LUX versus time of a device light sensor when the device is stationary is shown.

[0023] Figure 7B An example of a time series representation of data representing LUX versus time of a device light sensor when the device is not stationary is shown.

[0024] Figure 8 A high-level block diagram of a processing system according to certain embodiments of the disclosed technology is shown.

[0025] Fig. 9 A method flow chart according to certain embodiments of the disclosed technology is shown.

[0026] Fig.10 A flow chart illustrating another method according to certain embodiments of the disclosed technology is shown. DETAILED DESCRIPTION

[0027] The technology disclosed herein is described in detail below in conjunction with the accompanying drawings.

[0028] The disclosed systems and methods can detect and mitigate click farm fraud. Certain processes of the disclosed technology can monitor multiple computing devices and utilize sensor data and / or related network information of each device to determine when multiple user sessions originate from a co-located subset of multiple devices. Certain embodiments of the disclosed technology can extract certain features (such as motion, orientation, usage characteristics, etc.) from the sensor data and / or network information as an indication of whether a device is involved in a click farm.

[0029] Certain embodiments of the disclosed technology may use clustering to identify devices with similar extracted features. For example, multiple stationary devices, externally powered devices, devices active at the same time, devices using a common digital service provider, etc. may indicate the presence of a click farm. In certain embodiments, the disclosed technology may utilize general sensor data from a device without unreliable indicators that may be spoofed, such as DNS data, IP addresses, or location data. Certain embodiments of the disclosed technology can automatically detect and mitigate certain types of fraud without the need for manual review.

[0030] According to certain example embodiments, a device may be associated (potentially or actually) with a click farm when it forms part of a cluster of devices that are determined to be co-located, stationary, and / or exhibit similar sensor / network characteristics. In certain embodiments, a confidence indicator indicating that a device is actually associated with a click farm may increase as the cluster size n increases. Similarly, an optional number N may be entered as a threshold to ignore or suppress clusters with device counts n less than N, for example, to reduce false positives.

[0031] According to certain example embodiments of the disclosed technology, when a device is determined to be part of a click farm, various mitigation procedures can be implemented to prevent and / or reduce related click fraud. For example, in one embodiment, an instruction can be sent to an enterprise network server that communicates with the click farm device to terminate the device session. In another example embodiment, an instruction can be sent to an advertising network and / or publisher to ignore clicks from the click farm device. Certain additional details regarding such mitigation measures are further discussed below in conjunction with the accompanying figures.

[0032] Figure 3 A block diagram of an example system 300 for detecting click farm activity and mitigating related fraud according to certain example embodiments of the disclosed technology is shown.

[0033] The system 300 may include a backend server 330 that may communicate with the WebServer 210 that hosts the webpage 301 and provides it to, for example, one or more computing devices 102, which in some embodiments may be smartphones, tablet computers, laptop computers, etc. Figure 3 As shown, the mobile device 102 may include an operating system 302, a memory 322, and various sensors, which may include an air pressure / humidity / temperature sensor 304, a light sensor 306, a battery level sensor 308, an accelerometer / gyroscope 310, a magnetometer 312, etc. The mobile device 102 may also include various applications, such as a pedometer 314, a WiFi / Bluetooth application 316, a cellular communication application 318, a web browser 320, etc. The mobile device 102 may also include a speaker 325 and a microphone 326.

[0034] In some embodiments, when the device 102 accesses the web page 301 hosted by the WebServer 210, the Web application 322 (Web App) stored on the WebServer 210 can be transmitted to the device 102 (e.g., through a browser interface) via the communication network 208 and transmitted to the browser 320 of the device 102. In some cases, a software development kit (SDK) and / or an application programming interface (API) can be used instead of or in combination with the Web App 322.

[0035] According to some example embodiments of the disclosed technology, when the device 102 begins accessing the web page 301 and instantiates the Web App 322 in the Web browser 320 of the device 102, the Web App 322 may begin monitoring / recording data and / or information from certain sensors and / or applications of the device 102. In some embodiments, the Web App 322 may utilize the device operating system 302 and / or memory to temporarily store data recorded from one or more sensors.

[0036] Refer to the following Fig. 7A and Figure 7B As described above, in some cases, the recorded data may take the form of time series (sampled) data that may indicate motion or other changes over time. For example, the time series may represent the tilt and / or movement of the device (via the accelerometer / gyroscope 310), the ambient air pressure / humidity / temperature (via the corresponding pressure / humidity / temperature sensor 304), the ambient light level (via the light sensor 306, such as Fig. 7A and Figure 7B ), battery level indication and / or whether the device 102 is powered by a power source (via battery level sensor 308), local magnetic field strength (via magnetometer 312). In addition, WebApp 322 can use device operating system 302 and / or memory to temporarily store network information, such as local WiFi network SSID, signal strength, name, Bluetooth device information (via WiFi / Bluetooth application 316) and / or cellular tower communication information (via cellular communication application 318). In some embodiments, WebApp 322 can access certain applications on device 102, such as pedometer application 314, to detect any step-like movement since the last time the pedometer was reset.

[0037] According to some example embodiments of the disclosed technology, Web App 322 may also be configured to detect interaction data and / or influencer activities performed by the operator of device 102. Such influencer activities may include, but are not limited to, clicking on ads, sharing links, promoting certain content, and commenting on products or services.

[0038] According to certain example embodiments of the disclosed technology, certain selected data and / or information recorded from various device 102 sensors and / or applications can be transmitted to the backend server 330 via the communication network 208 for further processing and / or analysis. It should be understood by those skilled in the art that various local sensors and applications on the device 102 will output data, which will quickly fill up the device memory 322 and / or have a negative impact on the available communication bandwidth of the device 102, especially when each data stream is sampled at a high speed and the relevant raw data is sent to the backend server 330. Therefore, according to certain embodiments, the Web App 322 can be configured to adjust the sampling rate of some or all of the relevant time series data and / or filter the data before sending the data to the backend server 330. In certain embodiments, the data repository 340 in communication with the backend server 330 can be used to store various data sets, time series, features, etc. In certain embodiments, the data can be low-pass filtered to, for example, reduce certain high-frequency artifacts or noise. In certain embodiments, some data or information may be discarded, for example, before sending it to the backend server 330.

[0039] According to certain example embodiments of the disclosed technology, once the monitoring / logging / filtering data and / or information from the sensors and / or applications of the device 102 arrives at the backend server 330, the feature extraction / filtering module 332 can be used to further filter the incoming time series data and / or extract certain features from the incoming time series data and / or other information. Such features may include network name, cell tower identifier, steps since last reset, etc.).

[0040] According to some example embodiments of the disclosed technology, as also described below with reference to FIG5, the clustering module 334 can cluster certain extracted features of the specific device 102 with the extracted features of other monitored devices. Such clustering information can be used by the co-location determination module 336 to determine co-located devices, for example, based on the feature similarities of these devices with other monitored devices.

[0041] According to certain example embodiments of the disclosed technology, the notification / termination module 338 may be utilized to mitigate further potential fraud, for example, when it is determined that the device 102 is part of a click farm, an indication is generated and sent to one or more of the WebServer 210, the ad network 206, and / or the publisher 204. In certain embodiments, the mitigation indication may take several alternative forms. For example, in one embodiment, the mitigation indication generated by the notification / termination module 338 may take the form of an instruction to instruct the WebServer 210 to terminate the current browsing session with the device 102 to prevent additional fraudulent clicks.

[0042] In other embodiments, the mitigation instructions generated by the notification / termination module 338 may take the form of instructions to the advertising network 206 and / or publisher 204 indicating that a particular device 102 is suspected of being part of a click farm, which may cause the advertising network 206 and / or publisher 204 to ignore clicks from the particular device. Many other mitigation measures may be taken without departing from the scope of the present disclosure.

[0043] Figure 4 An example process that can be used to detect and mitigate click farm activities according to certain example embodiments of the present technology is shown. In box 402, a browsing session can be initiated between a device and a WebServer. In box 404, various sensors and / or applications of the device can be monitored / recorded. According to certain example embodiments of the present technology, various identifiers, quantities and / or measurement statistics, such as mean, variance, skewness and / or kurtosis, can be extracted from various sensors and / or network information for analysis to determine the usage of a particular device in a click farm. For example, identifiers of routers / devices / towers (such as SSIDs, cell tower IDs, etc.) around stationary devices can be used for analysis. In addition, refer to the following 6A to 7B As described above, various measures of signal strength in a time series and calculated statistics of these measures may be utilized.

[0044] Continue to refer to Figure 4 , box 406, some sensor data / statistics and / or network information and / or time series data can be sent to the backend server. According to some example embodiments of the disclosed technology, box 402, box 404 and box 406 can be processed under the guidance of the WebApp (as described above).

[0045] According to certain embodiments of the disclosed technology, sensor data / statistics and / or network information and / or time series data may include interaction data and / or influencer activities, which may include but are not limited to clicking on advertisements, sharing links, promoting certain content, commenting on products or services, etc.

[0046] At box 408, the backend server may extract and / or filter the incoming data / information to extract certain features from the data. At box 410, the extracted data may be clustered to extract similar features from other devices. At box 412, the clustered data may be analyzed to determine actual or potential co-located devices that are performing influencer activity indicative of a click farm. In certain embodiments, multiple different features may be analyzed to similarly cluster with other devices, thereby increasing the confidence of the co-location determination. At box 414, the threshold of box 416 may be set using one or more parameters to determine the minimum number of co-located devices to be detected before declaring a particular device to be part of a click farm. At box 418, when it is determined that the device is part of a click farm, an indication may be sent to terminate the associated browsing session, discard clicks, etc. Otherwise, process 400 may continue to collect and analyze data.

[0047] Figure 5A An example graphical representation of an initial clustering process according to an example embodiment of the disclosed technology is shown, in which certain devices may be clustered 502 based on extracted features that indicate participation in the same click farm (as described above). For example, each circle may represent a different device in the plurality of devices 102 (e.g., as described above with reference to Figure 3 As described, the device 102 communicates with the WebServer 210 and further communicates with the backend server 330 via the Web App 320). According to certain example embodiments of the disclosed technology, for illustrative purposes, a unique cluster identifier (such as A, B, C, D, etc.) can be assigned to each different device in the multiple devices 102 based on similar extracted features. In certain embodiments, related features can be processed and compared to determine the connection or relationship between the features. In certain embodiments, the "relationship" between various devices 102 can be represented (for illustrative purposes) as a connection (edge). In certain embodiments, the weights of these edges can also represent a measure of feature similarity with other devices 102 in similar groups.

[0048] In some example embodiments, each device 102 may have multiple extracted related features (not shown), and thus may be represented as a hyperspace node. In an example embodiment, cluster identifiers may be associated with those devices that are stationary, externally powered, simultaneously active, using a common digital service provider, performing influencer activities, etc. Thus, an initial cluster 502 may be identified as including devices 102 that share common features.

[0049] Initial cluster 502 is depicted as having a dashed outline, for example, to distinguish the clustered devices from the remaining devices. As shown in this example, initial cluster 502 shares a common identifier: "A" and a connection edge that can represent any number of scenarios according to certain example embodiments of the disclosed technology. For example, the "A" identifier and the connection edge can represent the commonality of certain extracted features.

[0050] Figure 5B An example graphical representation of a refined clustering 504 that can evaluate whether additional extracted features participate in the same click farm is shown. According to an example embodiment, for any particular feature, the general device clustering process can be refined by each iteration, i.e., assuming that all other devices and relationships are correct, performing one clustering iteration, then moving on to the next feature, performing one clustering iteration, and so on. For example, each device 102 can be evaluated for a particular feature, and a clustering 506 of records can be identified as having some quantitative or qualitative relationship with the particular extracted feature of interest. Figure 5B As shown, as additional or different extracted features are evaluated, some devices 506 (shown as shaded) may fall into the refined cluster 504 (with their associated cluster identifiers changed to match that group).

[0051] To arrive at new clusters 504, certain example embodiments may utilize a first iteration process to cluster records with the "A" attribute while noting the relationships (e.g., edges and weights) between records with the "C" feature, and vice versa. For example, starting with the initial clusters 502, features, attributes, or commonalities may be evaluated to aggregate one or more relationships between any of the devices 102. Figure 5B As shown, based on the relationships between the devices 102 and / or other criteria, a new cluster 504 can be formed in the re-clustering step, which cluster 504 can include some of the devices in the first iterative cluster 502 while omitting some devices. In an example embodiment, the re-clustering refinement can be based at least in part on the mutually matching features of the associated initial clusters. In another example embodiment, the re-clustering can be based at least in part on determining the similarity between the corresponding extracted features. In another example embodiment, the re-clustering can be based at least in part on detecting influencer activities.

[0052] According to an example embodiment of the disclosed technology, determining the similarity between the corresponding extracted features of the devices 102 may include assigning a hyperspace attribute to each device 102. The hyperspace attribute corresponding to two devices may be related to the similarity of the corresponding extracted features. In certain example embodiments, the membership of each device in a plurality of hyperspace clusters may be determined based at least in part on the hyperspace attribute. According to an example embodiment, each device 102 may be assigned a cluster ID and a match value reflecting the likelihood that the device is a member of a particular hyperspace cluster, and related devices (such as the hyperspace clusters) may be linked based at least in part on the cluster ID and the match value. Figure 5A and Figure 5BDetermining the membership of each device in a plurality of hyperspace clusters may, for example, include creating a plurality of nodes at random locations within the hyperspace, each node maintaining a device in the hyperspace based on its hyperspace property of being the closest node.

[0053] According to certain embodiments of the disclosed technology, the device set can be reduced by eliminating duplicate devices by merging database records with hyperspace attribute differences within predefined criteria. According to an example embodiment, the process may also include recalculating field value weights of the reduced device set and re-clustering the reduced device set based at least in part on the recalculated field value weights.

[0054] According to example embodiments of the disclosed technology, clustering, iteration, recalculation, and re-clustering, etc., can produce a refined set of clusters, where devices in a given set possess similar criteria to other devices in the set. Such clustering can provide useful characteristics, categories, structures, features, etc. for detecting click farms and / or specific devices participating in click farms.

[0055] 6A to 7B Example extracted features that can be used to assess whether a device forms part of a click farm are shown.

[0056] Fig. 6A An example of nearby WiFi channel locations (x-axis), signal strengths (y-axis), and SSID names ( A1 , A2 , A3 ) measured and reported by a first device is shown. Figure 6B The nearby WiFi channel location, signal strength, and SSID name measured and reported by the second device are shown. Certain embodiments of the disclosed technology can evaluate relative or normalized signal strength, channel location, SSID name, etc. to determine whether the first device and the second device are co-located. Fig. 6A and Figure 6B In the example shown, the two devices can be considered co-located due to the same channel location, relative strength, and SSID name.

[0057] Fig. 7A An example of LUX versus time (a time series) measured by a light sensor and reported by a first device is shown. Such a time series may indicate a stationary device. Fig. 7A An example of LUX versus time (a time series) measured by a light sensor and reported by a second device is shown. Such a time series may indicate that a device is affected by different lighting conditions, movement, or changes in ambient lighting conditions. In some embodiments (other than Fig. 6A and Figure 6B Similar to the WiFi characteristics shown above, when two independent devices report different LUX and time characteristics, this difference may indicate that the two devices are not co-located.

[0058] Passive Discovery

[0059] As mentioned above, review Figure 3 , certain sensor data may be collected from a set of devices 102 and sent to a backend server 330. For example, the set of devices 102 may be all mobile devices active on a given day, and the evaluation / clustering may be performed in a nightly batch job, selected from geographic regions, or based on any other user data groups and / or extracted features. In some embodiments, the sensor data may include low-level time series of sensor readings, filtered sensor values, and / or high-level aggregate estimates generated by the device operating system.

[0060] Using time series of sensor data, features describing device location and behavior can be extracted. As described above, these features can include current and historical data for orientation, motion, lighting, battery level, telecommunication networks, WiFi, and BLE devices, and pages, content, or actions performed by users. User activity can include time series data sets measured by device accelerometers, gyroscopes, and / or magnetometers. In some embodiments, advanced aggregates such as pedometers can be included as evaluation features. The resulting data set can be run through a clustering algorithm to find subsets of devices that share a set of parameters over a period of time (as described above with respect to Figure 5A and Figure 5B For example, selecting a few dozen stationary devices that all have the same spatial orientation angle can form an easily distinguishable pattern. These devices may also share static battery charging history, similar light readings, and magnetometer readings. Even if these devices show different IP and geolocation data, the low-level data may show enough similarity to enable detection.

[0061] Another example of data and / or features that can be used to identify the approximate co-location of multiple devices is provided by WiFi nearby device data, as described above with reference to Fig. 6A and Figure 6BIn one embodiment, the backend server 330 can use the device to perform a WiFi network scan, so that the service set identifier (SSID) and the received signal strength indicator (RSSI, i.e., received power) from each device and the channel number of each detected WiFi access point (AP) are stored in a data repository 340 that communicates with the backend server 330. Continuous readings can be serially connected to form a time representation of WiFi periodic readings, thereby forming a historical record of the device passing through the network environment. According to certain example embodiments of the disclosed technology, after the abandonment period, the earliest data can be discarded, that is, the value is stored in a sliding time window. In this case, if more than two devices register the same SSID, a clustering algorithm may not even be required. In some embodiments, the complete time series of the received RSSI for each SSID and channel number can be vectorized, and the determination of the statistical distance between the two can be used directly, such as by Hamming, Euclidean, Wasserstein or any other statistical distance metric. If the distance between two or more devices is below a threshold, that is, the devices exhibit the same or similar RSSI values, then the devices are determined to be close to each other. In one embodiment, the sensor time series data is low pass filtered to reflect the unnaturally long periods of time exhibited by rack mounted equipment when stationary.

[0062] In another example embodiment, a request may be made for the cell tower IDs detected by the device, and similar operations as described above may be implemented. For example, 3G, 4G, and 5G mobile devices track at least the three strongest cell IDs for short periods of time, which means that co-location between devices can be very accurate. A map of cell towers is available around the world, and they can be geolocated to facilitate further investigation of fraud teams, etc. Therefore, a suspicious click farm can be determined based on the number of similar or identical devices.

[0063] Active Discovery

[0064] In another embodiment, after the backend server 330 determines that a group of devices may be co-located, the backend server 330 can actively detect and try to determine whether these devices are co-located. For example, such detection can be performed to confirm after executing a certain passive mode discovery embodiment.

[0065] Active discovery can be accomplished in a variety of ways. For example, in a first embodiment, the backend server 330 may instruct (via Web App 322) one of the devices to play an audio signal (which may be an inaudible audio signal), while instructing the other devices to register the response through their microphones or magnetometer sensors. In another embodiment, the backend server 330 may instruct one of the devices to illuminate the surrounding environment using a device-based LIDAR, while instructing the other devices to register the response by measuring the response. In certain embodiments, interference can be measured as other different devices are turned on. Similarly, without departing from the scope of protection of the present disclosure, other active discoveries using NFC or Bluetooth transmitter / receiver solutions may be used in a similar manner.

[0066] In some embodiments, active or passive discovery of measurements or readings can be enabled with minimal user authorization. In some embodiments, successive layers of permissions can be utilized to obtain richer sensor data, thereby improving accuracy.

[0067] Figure 8 A block diagram of an illustrative computing device 800 that can be used to implement certain aspects of the disclosed technology is shown. Various embodiments and methods herein may be embodied as non-transitory computer-readable media for execution by a processor. It should be understood that computing device 800 is only illustrative and does not limit the scope of various embodiments of communication systems and methods.

[0068] Figure 8 The computing device 800 includes one or more processors for processing computer instructions. The computing device 800 may include a CPU 802 or may be connected to a processor. Figure 8 In some cases, a computing device may be a processor, a controller, or a central processing unit (CPU). In other cases, a computing device may be a set of hardware components.

[0069] The computing device 800 may include a display interface 804 acting as a communication interface, providing the functionality of rendering video, graphics, images, and text on a display. In certain example embodiments of the disclosed technology, the display interface 804 may be directly connected to a local display. In another example embodiment, the display interface 804 may be configured to provide data, images, and other information to an external / remote display. In certain example embodiments, the display interface 804 may communicate wirelessly, for example, via a Wi-Fi channel or other available network connection interface 812 to communicate with an external / remote display.

[0070] In an example embodiment, the network connection interface 812 may be configured as a communication interface and may provide the functionality of rendering video, graphics, images, text, other information, or any combination thereof on a display. In an example, the communication interface may include a serial port, a parallel port, a general purpose input / output (GPIO) port, a game port, a universal serial bus (USB), a micro USB port, a high-definition multimedia (HDMI) port, a video port, an audio port, a Bluetooth port, a near field communication (NFC) port, other similar communication interfaces, or any combination thereof. In an example, the display interface 804 may be operably coupled to a local display. In another example, the display interface 804 may communicate wirelessly, for example, via a network connection interface 812 (such as a Wi-Fi transceiver) to communicate with an external / remote display.

[0071] The computing device 800 may include a keyboard interface 806 that provides a communication interface with a keyboard. According to some example embodiments of the disclosed technology, a presence-sensitive display interface 808 may provide a communication interface for various devices such as a pointing device, a touch screen, and the like.

[0072] The computing device 800 may be configured to use input devices through one or more input / output interfaces (e.g., keyboard interface 806, display interface 804, presence-sensitive display interface 808, network connection interface 812, camera interface 814, sound interface 816, etc.) to allow a user to collect information from the computing device 800. Input devices may include a mouse, a trackball, a directional pad, a touch-validating touchpad, a presence-sensitive touchpad, a presence-sensitive display, a scroll wheel, a digital camera, a digital video camera, a webcam, a microphone, a sensor, a smart card, etc. In addition, the input device may be integrated with the computing device 800 or may be a stand-alone device. For example, the input device may be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0073] Example embodiments of computing device 800 may include an antenna interface 810 that provides a communication interface with an antenna and a network connection interface 812 that provides a communication interface with a network. According to some example embodiments, antenna interface 810 may be used to communicate with a Bluetooth transceiver.

[0074] In some embodiments, a camera interface 814 may be provided as a communication interface, providing the functionality of capturing digital images from a camera. In some embodiments, a sound interface 816 is provided as a communication interface for converting sound into electrical signals using a microphone and converting electrical signals into sound using a speaker. According to an example embodiment, a random access memory (RAM) 818 is provided, wherein computer instructions and data may be stored in a volatile memory device for processing by the CPU 802.

[0075] According to an example embodiment, the computing device 800 includes a read-only memory (ROM) 820, where unchanging low-level system code or data for basic system functions (such as basic input / output (I / O), booting, or receiving keystrokes from a keyboard) is stored in a non-volatile memory device. According to an example embodiment, the computing device 800 includes a storage medium 822 or other suitable type of memory (e.g., RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable magnetic cartridge, flash drive), where stored files include an operating system 824, applications 826 (including, for example, a web browser application, a small widget or gadget engine, and / or other applications as needed) and data files 828. According to an example embodiment, the computing device 800 includes a power supply 830, which provides appropriate alternating current (AC) or direct current (DC) to the power components. According to an example embodiment, the computing device 800 includes a telephone subsystem 832, which allows the computing device 800 to send and receive voice over a telephone network. The component devices and the CPU 802 communicate with each other via a computer bus 834 .

[0076] According to an example embodiment, the structure of CPU 802 is suitable for use as a computer processor. In a certain arrangement, computer CPU 802 may include more than one processing unit. RAM 818 is docked with computer bus 834 to provide fast RAM storage for CPU 802 during the execution of software programs (such as operating system applications and device drivers). Specifically, CPU 802 loads computer executable processing steps from storage medium 822 or other media into fields of RAM 818 to execute software programs. Data can be stored in RAM 818, where computer CPU 802 can access the data during execution. In an example configuration, computing device 800 includes at least 128MB of RAM and 256MB of flash memory.

[0077] The storage medium 822 itself may include multiple physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disk (HD-DVD) optical drive, an internal hard drive, a Blu-ray disk drive or a holographic digital data storage (HDDS) optical drive, an external micro dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM) or an external micro DIMM SDRAM. Such computer-readable storage media allow the computing device 800 to access computer-executable process steps, applications, etc. stored on removable and fixed storage media to offload data from the computing device 800 or upload data to the computing device 800. A computer program product (such as a computer program product utilizing a communication system) may be tangibly embodied in the storage medium 822 (which may include a machine-readable storage medium).

[0078] According to an example embodiment, the term "computing device" as used herein may be a CPU, or may be conceptualized as a CPU (e.g. Figure 8 In this example embodiment, the computing device (CPU) may be coupled, connected and / or communicate with one or more peripheral devices.

[0079] Those skilled in the art should also understand that Figure 3 One or more of the devices shown may be implemented as Figure 8 Computing device 800 is shown.

[0080] Fig. 9 is a flow chart of a method 900 for detecting and mitigating click farm fraud according to certain embodiments of the disclosed technology. At block 902, the method 900 may include remotely collecting network data and sensor data from a plurality of computing devices. In certain embodiments, the sensor data may include one or more of the following: location information, device orientation, device motion characteristics, ambient lighting conditions, device battery level. In certain embodiments, the network data may include one or more of the following: telecommunication network information, related WiFi network information, and / or related Bluetooth (BLE) devices.

[0081] At block 904, method 900 may include sending the sensor data and the network data to a backend server. At block 906, method 900 may include extracting, by the backend server, one or more features from the sensor data and the network data. At block 908, method 900 may include clustering the plurality of computing devices into one or more subsets based on equivalent features of the one or more features. At block 910, method 900 may include identifying co-located devices of the one or more subsets based on the clustering. At block 912, method 900 may include, in response to determining that a count of co-located devices is greater than a predetermined count, sending a session termination command to one or more servers in communication with the one or more co-located computing devices to mitigate click farm fraud activity.

[0082] In certain embodiments, clustering is based on one or more features being substantially equivalent over a predetermined period of time.

[0083] Certain embodiments of the disclosed technology may include: when a device is determined to be one of the one or more co-located devices, alerting one or more of a Web Server, an advertising network, and a publisher.

[0084] According to certain example embodiments of the disclosed technology, the extracted features may also include one or more nearby device WiFi data, including a service set identifier (SSID) value and a received signal strength indication (RSSI) value of a detected WiFi access point.

[0085] In some embodiments, a statistical distance between one or more SSID values ​​and RSSI values ​​may also be used to identify co-located devices.

[0086] In some embodiments, the one or more extracted features may include a cellular tower identifier. In some embodiments, statistical distances between cellular tower identifiers may also be used to identify co-located devices.

[0087] In some embodiments, the sensor data may be time series data.

[0088] In certain embodiments, the time series data may be low pass filtered to detect unnaturally long periods of time exhibited by rack-mounted equipment when in a stationary state.

[0089] Certain embodiments of the disclosed technology may also include confirming the proximal arrangement of one or more device subsets by active detection. In certain embodiments, active detection may include instructing a first device in one or more subsets of co-located devices to transmit a signal and measuring the relevant responses from other devices in the co-located devices of the one or more subsets. In certain embodiments, the relevant responses from other devices may include using one or more of a microphone and a magnetometer sensor to perform measurements.

[0090] In certain embodiments, the sensor data may include high-level aggregate estimates generated by the device operating system.

[0091] In certain embodiments, sensor data may be collected from a selected geographic area or user data group to identify one or more subsets of co-located devices.

[0092] Fig.10 is a flow chart of a method 1000 for detecting and mitigating click farm fraud according to certain embodiments of the disclosed technology. At block 1002, the method 1000 may include receiving network data and sensor data from a plurality of computing devices. At block 1004, the method 1000 includes extracting one or more features from the sensor data and the network data of each of the plurality of computing devices, the one or more features representing one or more of a local physical environment and a communication channel environment associated with the device in the plurality of computing devices. At block 1006, the method 1000 includes determining, based on the one or more features, one or more subsets of the plurality of computing devices according to environmental characteristics and network characteristics of the one or more features. At block 1008, the method 1000 includes identifying a co-located computing device based on the one or more subsets and the detected influencer activity. At block 1010, the method 1000 includes, in response to determining that a count of the co-located computing devices is greater than a predetermined count, sending a session termination command to one or more servers in communication with the co-located computing devices to mitigate click farm fraud activity.

[0093] According to some example embodiments of the disclosed technology, the sensor data may include one or more of the following location information: device orientation, device motion characteristics, ambient light conditions, and / or device battery level. In some embodiments, the network data may include one or more of the following: telecommunication network information, related WiFi network information, and / or related BLE devices.

[0094] In certain embodiments, influencer activity may include one or more of: clicking on an ad, sharing a link, promoting content, and / or posting a comment.

[0095] According to certain example embodiments of the disclosed technology, identifying the co-located computing devices is further based on clustering the plurality of computing devices into one or more subsets based on equivalent characteristics according to the one or more characteristics.

[0096] In certain embodiments, clustering is further based on one or more features being substantially equivalent over a predetermined period of time.

[0097] Certain embodiments of the disclosed technology may include: when a device is determined to be one of the co-located devices, alerting one or more of a Web Server, an advertising network, and a publisher.

[0098] In some embodiments, the extracted features may also include one or more nearby device WiFi data, including service set identifier values ​​and received signal strength indicator values ​​of detected WiFi access points, statistical distances between one or more service set identifier values ​​and received signal strength indicator values, cellular tower identifiers, and statistical distances between cellular tower identifiers.

[0099] In some embodiments, the sensor data may be time series data. In some embodiments, the sensor data and / or time series data may be low pass filtered to detect unnaturally long periods of time exhibited by rack mounted equipment in a stationary state.

[0100] Certain embodiments of the disclosed technology may include confirming the proximal arrangement of one or more device subsets by active detection. In certain embodiments, the detection may include instructing a first device in the co-located devices of one or more subsets to transmit a signal and measuring the relevant responses from other devices in the co-located devices of one or more subsets. In certain embodiments, measuring the relevant responses from other devices may include using one or more of a microphone and a magnetometer sensor to perform the measurement.

[0101] In certain embodiments, the sensor data may also include high-level aggregate estimates generated by the device operating system.

[0102] In certain embodiments, sensor data may also be collected from selected geographic areas or user data groups to identify one or more subsets of co-located devices.

[0103] The subject matter and functional operations described in this specification may be implemented in various systems, digital electronic circuits, computer software, firmware or hardware (including the disclosed structure and its equivalent structure) or a combination of one or more of the above. The subject matter described in this specification may be implemented as one or more computer program products, i.e., one or more computer program instruction modules, which are encoded on a non-transient tangible computer-readable medium for a digital processing device to execute or control its operation. The computer-readable medium may be a machine-readable storage device, a machine-readable storage matrix, a memory device, a material component that affects a machine-readable propagation signal, or a combination of one or more of the above. The term "data processing unit" or "data processing device" covers all devices, devices and machines for processing data, such as programmable processors, computers or multiple processors or computers. In addition to hardware, the above-mentioned device may also include code for creating an execution environment for the computer program involved, such as code constituting a processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of the above.

[0104] A computer program (also known as a program, software, software application, script, or code) may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, including as a standalone program or module, component, subroutine, or other unit suitable for a computing environment. A computer program does not necessarily correspond to a file in a file system. A program may be stored in a file portion that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program, or in multiple collaborative files (e.g., a file that stores one or more modules, subroutines, or code portions). A computer program may be deployed to execute on one computer or on multiple computers located in one location or distributed across multiple locations and interconnected by a communication network.

[0105] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. These processes and logic flows can also be performed by dedicated logic circuits, and the device can also be implemented as a dedicated logic circuit, such as a Field Programmable Gate Array (FPGA) or an Application-Specific Integrated Circuit (ASIC).

[0106] For example, processors suitable for executing computer programs include general-purpose microprocessors and special-purpose microprocessors and any one or more processors of any type of digital computer. Typically, the processor receives instructions and data from a read-only memory, a random access memory, or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer also includes one or more large-capacity storage devices (such as magnetic disks, magneto-optical disks, or optical disks) for storing data or is operably coupled thereto to receive data from it, transmit data to it, or both. However, a computer does not necessarily have such a device. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM, flash memory devices. The processor and memory can supplement or incorporate a dedicated logic circuit.

[0107] Although this specification contains many specific details, these details should not be interpreted as limiting the present disclosure or its scope of protection, but should be interpreted as describing features specific to a particular embodiment of a particular invention. Certain features described in the context of different embodiments may also be combined in a single embodiment to be implemented. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments or in any suitable sub-combination. In addition, although features may be described above as functioning in certain combinations, even initially stated, one or more features may be deleted from the combination in some cases, and the combination may also involve sub-combinations or variations of sub-combinations.

[0108] Similarly, although the operations are depicted in a specific order in the drawings, it should not be understood that these operations must be performed in the specific order shown or in a sequential order, nor that all illustrated operations must be performed to achieve the desired results. In addition, the separation of various system components in the embodiments described herein should not be understood as requiring such separation in all embodiments.

[0109] Although the disclosed technology is described in detail in conjunction with the above-mentioned embodiments, it should be recognized by those skilled in the art that changes may be made in form and detail without departing from the spirit and scope of the subject matter of the present disclosure. The embodiments described should be considered illustrative and not restrictive in all respects. All changes that fall within the meaning and scope of the equivalents of the claims are within the scope of protection of the claims. It is also conceivable that any combination of the above-mentioned methods and devices are within the scope of protection of the disclosed technology.

Claims

1. A method for detecting and mitigating click farm fraud, comprising: receiving network data and sensor data from a plurality of computing devices; extracting one or more features from sensor data and network data for each of the plurality of computing devices, wherein the one or more features represent one or more of a local physical environment and a communication channel environment associated with a device in the plurality of computing devices; Based on the one or more characteristics, determining one or more subsets of the plurality of computing devices according to environmental characteristics and network characteristics of the one or more characteristics; identifying a co-located computing device based on the one or more subsets and the detected influencer activity; and In response to determining that the count of the co-located computing device is greater than a predetermined count, a session termination command is sent to one or more servers in communication with the co-located computing device to mitigate click farm fraud activity.

2. The method according to claim 1, wherein: The sensor data includes one or more of the following: Location information; Device orientation; Equipment motion characteristics; Ambient lighting conditions; and Device battery level; The network data includes one or more of the following: Telecommunications network information; Relevant WiFi network information; and Related BLE devices.

3. The method according to claim 1, wherein: The influencer activities include one or more of the following: clicking on ads, sharing links, promoting content, and posting comments.

4. The method according to claim 1, wherein: Identifying the co-located computing devices is also based on clustering the plurality of computing devices into one or more subsets based on equivalent features according to the one or more features.

5. The method according to claim 4, wherein: The clustering is further based on the one or more features being substantially equivalent over a predetermined period of time.

6. The method according to claim 1, further comprising: When the device is determined to be one of the co-located devices, an alert is sent to one or more of the Web Server, the advertising network, and the publisher.

7. The method according to claim 1, wherein: The extracted features also include one or more nearby device WiFi data, including service set identifier values ​​and received signal strength indicator values ​​of detected WiFi access points, statistical distances between one or more service set identifier values ​​and received signal strength indicator values, cellular tower identifiers, and statistical distances between cellular tower identifiers.

8. The method according to claim 1, wherein: The sensor data is time series data, wherein the data time series is low pass filtered to detect unnaturally long periods of time exhibited by rack mounted equipment in a stationary position.

9. The method according to claim 1, further comprising: The proximal arrangement of one or more subsets of devices is confirmed by actively probing, the probing comprising instructing a first device of the one or more subsets of co-located devices to transmit a signal and measuring associated responses from other devices of the one or more subsets of co-located devices.

10. The method according to claim 9, wherein: Measuring the relevant responses from the other devices includes taking measurements using one or more of a microphone and a magnetometer sensor.

11. The method according to claim 1, wherein: The sensor data also includes high-level aggregate estimates generated by the device operating system.

12. The method according to claim 1, wherein: The sensor data is also collected from a selected geographic area or user data group to identify the one or more subsets of co-located devices.

13. A system comprising: processor; as well as A memory storing programming instructions that, when executed by the processor, cause the processor to: receiving network data and sensor data from a plurality of computing devices; extracting one or more features from sensor data and network data for each of the plurality of computing devices, wherein the one or more features represent one or more of a local physical environment and a communication channel environment associated with a device in the plurality of computing devices; Based on the one or more characteristics, determining one or more subsets of the plurality of computing devices according to environmental characteristics and network characteristics of the one or more characteristics; identifying a co-located computing device based on the one or more subsets and the detected influencer activity; and In response to determining that the count of the co-located computing device is greater than a predetermined count, a session termination command is sent to one or more servers in communication with the co-located computing device to mitigate click farm fraud activity.

14. The system according to claim 13, wherein: The influencer activities include one or more of the following: clicking on ads, sharing links, promoting content, and posting comments.

15. The system of claim 13, wherein: Identifying the co-located computing devices is also based on clustering the plurality of computing devices into one or more subsets based on equivalent features according to the one or more features.

16. The system of claim 15, wherein: The clustering is further based on the one or more features being substantially equivalent over a predetermined period of time.

17. The system of claim 13, further comprising: When the device is determined to be one of the co-located devices, an alert is sent to one or more of the Web Server, the advertising network, and the publisher.

18. The system of claim 13, wherein: The extracted features also include one or more nearby device WiFi data, including service set identifier values ​​and received signal strength indicator values ​​of detected WiFi access points, statistical distances between one or more service set identifier values ​​and received signal strength indicator values, cellular tower identifiers, and statistical distances between cellular tower identifiers.

19. The system of claim 13, wherein: The sensor data is time series data, wherein the data time series is low pass filtered to detect unnaturally long periods of time exhibited by rack mounted equipment in a stationary position.

20. The system of claim 13, further comprising: The proximal arrangement of one or more subsets of devices is confirmed by actively probing, wherein the probing includes instructing a first device of the one or more subsets of co-located devices to transmit a signal and measuring associated responses from other devices of the one or more subsets of co-located devices, wherein measuring associated responses from the other devices includes performing measurements using one or more of a microphone and a magnetometer sensor.

Images