Internet-oriented advertisement putting false flow monitoring method and system

Abstract

The invention relates to the technical field of data processing, in particular to an internet-oriented advertisement putting false flow monitoring method and system. According to the method, abnormal click time periods in each time period are screened out by using a threshold comparison method, and IPs are sorted based on click rates and grouped. And for each similar IP group, obtaining mutation evaluation, eliminating the mutation evaluation, analyzing the click rate change stability of the remaining similar IPs, and determining a second suspected false flow source group. And analyzing each IP in the second suspected false flow source group, and based on the difference between the click rate and the page view at the same moment, screening out an accurate real false flow source in combination with a judgment index. According to the method, the real and false flow sources are accurately screened out by analyzing information changes of multiple dimensions such as the advertisement click rate, the page view and the IP, and the advertisement putting efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly to an advertising false traffic monitoring method and system for the Internet. Background Art

[0002] In the process of an advertiser spreading advertisement content to target audiences through various channels such as social media, search engines, and display advertising networks, some bad actors will generate false clicks, views, installations, etc. through non-real users or automated tools (such as robots, crawlers, etc.), generating false traffic. For example, click farms will increase the advertisement click volume to create a large amount of false traffic data to obtain more false advertising revenue, attract the attention of advertisers or the market in an inflated manner, and will also affect the accuracy of advertisers' analysis and decision-making based on advertisement placement data, possibly bringing misleading conclusions and further increasing the advertisers' investment. False traffic will affect the effect of advertisement placement, resulting in an increase in customer acquisition costs and waste of advertisers' advertising budgets.

[0003] In the prior art, the method of setting a click volume threshold can be used to detect each IP, and the IP with an obviously high click volume is selected as a false traffic source. This method depends on the setting of the threshold. If the threshold is set unreasonably, it will lead to missed detection and misdetection. And for advertisement placement, in the initial stage, the advertisement push algorithm of the platform needs a certain amount of time to learn and optimize the advertisement placement strategy. When the advertisement is initially placed, it may not be accurately pushed to the target audience. As the algorithm of the advertisement placement platform is optimized and accurately matches the target audience, the click volume data may also change greatly. This situation will also lead to misdetection of false traffic sources. Summary of the Invention

[0004] In order to solve the technical problem that misdetection and missed detection will occur when detecting false traffic sources by detecting the IP click volume in the prior art, the purpose of the present invention is to provide an advertising false traffic monitoring method and system for the Internet, and the specific technical solutions adopted are as follows: The present invention proposes an advertising false traffic monitoring method for the Internet, and the method includes: Obtain the view volume sequence, click volume sequence, and IP address information of the advertisement within multiple identical preset time periods within a preset time sequence range; Compare the elements in the click volume sequence with a threshold to determine the abnormal click time period; for each abnormal click time period, arrange the click volume of each IP in order to obtain an IP click volume sequence; divide the IP click volume sequence into multiple groups of similar IPs according to the similarity of adjacent click volumes; Optionally select a group of similar IPs as the first suspected false traffic source group. According to the click volume of the first suspected false traffic source group at each moment and the time stamp range of the first suspected false traffic source group, obtain the mutation evaluation of the first suspected false traffic source group; analyze the change in click volume over time of the groups of similar IPs other than the first suspected false traffic source group to obtain the change smoothness; obtain the judgment index of the first suspected false traffic source group based on the change smoothness and the mutation evaluation; screen out the second suspected false traffic source group in each abnormal click time period according to the judgment index; According to the difference between the click volume and the view volume of the second suspected false traffic source group at the same moment and the judgment index, screen out the true and false traffic sources.

[0005] Further, the method for obtaining the abnormal click time period includes: Obtain the average sequence of the click volume sequences for all time periods; obtain the average click volume within the time sequence range; for each moment within the time period, use the normalized value of the corresponding element of the moment in the average sequence as the abnormal coefficient at that moment, obtain the adjustment magnification according to the abnormal coefficient, and use the product of the adjustment magnification and the average click volume as the adaptive threshold at that moment; Compare the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine the abnormal moments, and take the continuous abnormal moments as the initial abnormal click time period; extend the initial abnormal click time period to both sides until it reaches the minimum value points of the click volume sequence, and take the minimum value points on both sides as the two endpoints to obtain the abnormal click time period.

[0006] Further, the method of dividing the IP click volume sequence into multiple groups of similar IPs according to the similarity of adjacent click volumes includes: The sorting method of the IP click volume sequence is ascending order; Obtain the difference sequence of the IP click volume sequence; in the difference sequence, take the IP corresponding to the element greater than the element mean as the segmented IP, and use the segmented IP to segment the IP click volume sequence to obtain multiple groups of similar IPs.

[0007] Further, the method for obtaining the mutation evaluation includes: For each IP in the first suspected false traffic source group, obtain the average click volume of each IP at all moments within the abnormal click time period, and take the average value of the average click volumes of all IPs as the overall average click volume of the first suspected false traffic source group; Take the union of the time stamp ranges of all IPs in the first suspected false traffic source group as the overall time stamp range of the first suspected false traffic source group; Take the ratio of the overall average click volume to the overall time stamp range as the mutation evaluation.

[0008] Further, the method for obtaining the change smoothness includes: In the click volume sequence, remove the click volume information corresponding to the first suspected false traffic source group to obtain the click volume sequence to be analyzed; accumulate the absolute values of the differences between adjacent elements in the click volume sequence to obtain the first overall change degree of the click volume sequence; accumulate the absolute values of the differences between adjacent elements in the click volume sequence to be analyzed to obtain the second overall change degree of the click volume sequence to be analyzed; use the ratio of the first overall change degree to the second overall change degree as the change smoothness.

[0009] Further, the judgment index is the normalized result of the product of the change smoothness and the mutation evaluation.

[0010] Further, the second suspected false traffic source group is the group of the same type of IPs with the largest judgment index in each abnormal click time period.

[0011] Further, the method for screening out the true false traffic sources includes: Take the IPs in the second suspected false traffic source group as the suspected false traffic IPs; for each suspected false traffic IP, use the ratio of the normalized value of the click volume and the normalized value of the view volume of the suspected false traffic IP at each moment within the time series range as the initial false traffic degree of the false traffic IP at each moment, and select the largest initial false traffic degree as the first false traffic degree of the false traffic IP within the time series range; accumulate the judgment indexes of the suspected false traffic IPs in all abnormal click time periods to obtain the second false traffic degree; judge whether the suspected false traffic IP is a true false traffic source according to the first false traffic degree and the second false traffic degree.

[0012] Further, the step of judging whether the suspected false traffic IP is a true false traffic source according to the first false traffic degree and the second false traffic degree includes: Multiply the first false traffic degree and the second false traffic degree and then perform normalization processing to obtain the third false traffic degree; if the third false traffic degree is greater than the preset degree threshold, then take the suspected false traffic IP as a true false traffic source.

[0013] The present invention also provides an advertising placement false traffic monitoring system for the Internet, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of any one of the above-mentioned advertising placement false traffic monitoring methods for the Internet.

[0014] The present invention has the following beneficial effects: The present invention first uses a threshold comparison method to screen out abnormal click time periods within each time period. Since the IPs in the abnormal click time periods may include the IPs of the target audience generated by advertisement placement, it is necessary to further analyze each IP in the abnormal click time periods. For the convenience of analysis, the present invention sorts the IPs based on the click volume and reduces the computational amount through grouping. For each group of similar IPs, the present invention quantifies the mutation characteristics of its click volume to obtain a mutation evaluation, and analyzes the stability of the click volume change of the remaining similar IPs after removing it. Through these two characteristics, the groups of similar IPs can be screened to determine the second suspected false traffic source group, that is, the second suspected false traffic source group is a combination of IPs with relatively abnormal click volumes. Further analyze each IP in the second suspected false traffic source group. Compared with the normal target audience IPs, the true false traffic sources have the obvious characteristic that the click volume and the view volume do not match. Therefore, based on the difference between the click volume and the view volume at the same moment, combined with the judgment index, the accurate true false traffic sources can be screened out. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0016] Figure 1 It is a flowchart of a method for monitoring false traffic in Internet-oriented advertisement placement provided by an embodiment of the present invention; Figure 2 It is a comparison schematic diagram of the view volume and the click volume within the time sequence range provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] In order to further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following, in combination with the accompanying drawings and preferred embodiments, details the specific implementation manners, structures, features and effects of a method and system for monitoring false traffic in Internet-oriented advertisement placement proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs.

[0019] The following specifically describes the specific solutions of a method and system for monitoring false traffic in Internet - oriented advertisement placement provided by the present invention in conjunction with the accompanying drawings.

[0020] Please refer to Figure 1 , which shows a flowchart of a method for monitoring false traffic in Internet - oriented advertisement placement provided by an embodiment of the present invention. The method includes: Step S1: Within a preset time sequence range, obtain the view volume sequence, click volume sequence, and IP address information of an advertisement within multiple identical preset time periods.

[0021] The purpose of the embodiment of the present invention is to identify abnormal traffic situations during advertisement placement and screen out false traffic sources. Therefore, the embodiment of the present invention sets the time sequence range to 7 days, and takes each day as a time period to obtain the view volume sequence, click volume sequence, and IP address information of each day. At each moment of each day, information such as view volume, click volume, IP, and timestamp can be obtained. The view volume is the display frequency of the advertisement on the advertisement placement platform, and the click volume is the frequency of clicking on the advertisement and jumping to the target website in the advertisement placement platform.

[0022] In the embodiment of the present invention, after obtaining the data, irrelevant data such as blacklist traffic data can be excluded through data pre - processing methods such as data cleaning and preliminary screening. This is a well - known technical means for those skilled in the art and will not be elaborated here.

[0023] In order to screen out false traffic sources in a timely manner, the embodiment of the present invention sets the detection time to once a day. That is, starting from the detection moment, 7 days are divided forward as the time sequence range, and the information of each day within the time sequence range is analyzed and false traffic source detection is performed. After each false traffic source is detected, the false traffic source information of the current day should be deleted before storage to facilitate the analysis of false traffic sources in subsequent time periods.

[0024] Step S2: Compare the elements in the click volume sequence with a threshold to determine abnormal click time periods; for each abnormal click time period, arrange the click volumes of each IP in order to obtain an IP click volume sequence; divide the IP click volume sequence into multiple groups of similar IPs according to the similarity of adjacent click volumes.

[0025] Since the click volume sequence and view volume sequence obtained in the embodiment of the present invention are both time - series sequences, the false traffic of false traffic sources for advertisements is manifested as a high - density click volume at a certain moment. Therefore, the abnormal click time periods can be first determined in the click volume sequence through a threshold comparison method, and then each IP in the abnormal click time periods can be analyzed specifically. The threshold comparison method can use the empirical threshold in the prior art or determine an adaptive threshold through statistical analysis of the data within the time sequence range, which is not limited here.

[0026] In the prior art, the click volume of a single IP is often detected to determine whether the IP is a false traffic source. This direct threshold judgment will cause the false detection and missed detection situations mentioned in the background art. Therefore, in the embodiments of the present invention, for the IPs in the abnormal click time period, the change and distribution of their click volumes are analyzed, and further combined with information such as page view volume, and multiple screenings are carried out to determine the true and false traffic sources. Considering that analyzing a single IP will cause a large amount of calculation and affect the timeliness of detection, in the embodiments of the present invention, in each abnormal click time period, the click volumes of each IP are arranged in order to obtain an IP click volume sequence; the IP click volume sequence is divided into multiple groups of similar IPs according to the similarity of adjacent click volumes. That is, in an abnormal click time period, the involved IPs are divided into multiple groups of similar IPs. A group of similar IPs is regarded as a combination with similar click volume characteristics, and subsequent steps can be analyzed in units of groups, improving the real-time performance of the detection method.

[0027] Preferably, in an embodiment of the present invention, considering that the user volume is different at different times of a day and the generated advertisement click volume is also different. For example, the page view volume from afternoon to evening is often more than that in the early morning period. Therefore, when screening the abnormal click time period, a fixed empirical threshold should not be used, but an adaptive threshold should be set for each moment for comparison. Therefore, the method for obtaining the abnormal click time period in the embodiments of the present invention includes: Obtain the average sequence of the click volume sequences of all time periods. Obtain the average click volume within the time series range. That is, these two average information are used as references to adaptively determine the threshold. Each element in the average sequence represents the average click volume information at each moment in a day, and the average click volume within the time series range is the average click volume information at each moment within 7 days. Therefore, the average click volume within the time series range can be used as the basis, and each element in the average sequence is normalized to represent the abnormal degree of the user volume at that moment, and then an adaptive threshold is obtained by combination.

[0028] For each moment within the time period, the normalized value of the corresponding element of the moment in the average sequence is used as the abnormal coefficient at that moment. That is, the larger the abnormal coefficient, the more users correspond to that moment, and a larger threshold is required for comparison. Obtain the adjustment ratio according to the abnormal coefficient, and take the product of the adjustment ratio and the average click volume as the adaptive threshold at that moment.

[0029] In the embodiments of the present invention, after dividing the element normalized value by 2, the sum value with the positive integer 1 is used as the abnormal coefficient. That is, the abnormal coefficient is a coefficient from 1 to 1.5, avoiding the missed detection caused by too large an adaptive threshold.

[0030] In the embodiments of the present invention, the normalization method of the elements in the average sequence adopts range normalization, which is a well-known technical means for those skilled in the art and will not be elaborated here.

[0031] Compare the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine the abnormal moment. That is, if the click volume at a certain moment is greater than the adaptive threshold corresponding to that moment, then take that moment as the abnormal moment. Take the consecutive abnormal moments as the initial abnormal click time period.

[0032] In the embodiment of the present invention, considering that in the subsequent steps, mainly the change of the click volume of the IP is analyzed for screening. Therefore, in order to better analyze the change of the click volume, extend the initial abnormal click time period to both sides until it extends to the minimum value points of the click volume sequence, and take the minimum value points on both sides as the two endpoints to obtain the abnormal click time period. That is, in the abnormal click time period, the click volume as a whole includes an upward and a downward trend, which can facilitate the subsequent analysis of the change of the click volume of the IP.

[0033] Preferably, in the embodiment of the present invention, the IP click volume sequence is divided into multiple groups of similar IPs according to the similarity of adjacent click volumes, including: The sorting method of the IP click volume sequence is ascending order.

[0034] Obtain the difference sequence of the IP click volume sequence. That is, this difference sequence is the result of subtracting the previous element from the next element in the IP click volume sequence. In the difference sequence, take the IP corresponding to the element greater than the element mean as the segmented IP, and use the segmented IP to segment the IP click volume sequence to obtain multiple groups of similar IPs. In the embodiment of the present invention, if an element in the difference sequence is greater than the element mean, and this element is the result of subtracting the previous IP click volume from the next IP click volume in the IP click volume sequence, then take the next IP as the segmented IP.

[0035] Step S3: Optionally select a group of similar IPs as the first suspected false traffic source group, obtain the mutation evaluation of the first suspected false traffic source group according to the click volume of the first suspected false traffic source group at each moment and the time stamp range of the first suspected false traffic source group; analyze the change of the click volume of the groups of similar IPs other than the first suspected false traffic source group in time series to obtain the change smoothness; obtain the judgment index of the first suspected false traffic source group according to the change smoothness and the mutation evaluation; screen out the second suspected false traffic source group in each abnormal click time period according to the judgment index.

[0036] For a group of homogeneous IPs, if it is a false traffic source group, the change characteristics of the click volume manifested by the group of homogeneous IPs as a whole during the abnormal click time period will show obvious mutations. And if this group of homogeneous IPs is removed, the click volume shown by the remaining IPs should be that of normal users, showing a characteristic of stable increase. Therefore, in an embodiment of the present invention, any group of homogeneous IPs is selected as the first suspected false traffic source group, and according to the click volume of the first suspected false traffic source group at each moment and the time stamp range of the first suspected false traffic source group, the mutation evaluation of the first suspected false traffic source group is obtained. That is, the larger the click volume manifested by the first suspected false traffic source group as a whole and the shorter the corresponding time stamp range, the larger the mutation evaluation, and the more the change in its click volume belongs to the mutation characteristic. Further analyze the change in the click volume of the groups of homogeneous IPs other than the first suspected false traffic source group in time series to obtain the change smoothness. That is, each group of homogeneous IPs can obtain the corresponding mutation evaluation and change smoothness. According to the characteristics of the two, a judgment index can be obtained, and by traversing all groups of homogeneous IPs according to this judgment index, the second suspected false traffic source group in each abnormal click time period can be screened out. That is, the second suspected false traffic source group is an IP combination that conforms to the false traffic characteristics, and in the subsequent steps, each IP needs to be further analyzed to determine the true false traffic source.

[0037] Preferably, in an embodiment of the present invention, the method for obtaining the mutation evaluation includes: Considering that the first suspected false traffic source group contains multiple IPs, in an embodiment of the present invention, a method of first analyzing each one and then averaging is used to quantify the characteristics. For each IP in the first suspected false traffic source group, obtain the average click volume of each IP at all moments during the abnormal click time period, and take the average value of the average click volumes of all IPs as the overall average click volume of the first suspected false traffic source group.

[0038] Take the union of the time stamp ranges of all IPs in the first suspected false traffic source group as the overall time stamp range of the first suspected false traffic source group. It should be noted that the purpose of taking the union in an embodiment of the present invention is to avoid redundant calculations caused by the overlap of IP time stamp ranges. Essentially, it is to eliminate the influence of overlapping factors and take the length of the time stamp range involved as the final operation target, that is, the time stamp range is a length quantity in time series.

[0039] Take the ratio of the overall average click volume to the overall time stamp range as the mutation evaluation. That is, the larger the overall average click volume and the smaller the included overall time stamp range, it means that the change characteristic of the click volume of the first suspected false traffic source group belongs more to the mutation characteristic, and the larger the mutation evaluation.

[0040] Preferably, in an embodiment of the present invention, the method for obtaining the change smoothness includes: In the click volume sequence, remove the click volume information corresponding to the first suspected false traffic source group to obtain the click volume sequence to be analyzed. For the click volume sequence to be analyzed, if the first suspected false traffic source group is a combination of false traffic IPs, the click volume sequence to be analyzed is the click volume time series data generated by normal traffic IPs, which will show a stable change, significantly different from the change characteristics in the original click volume sequence. Therefore, the change stability can be quantified by comparing the element changes of the two sequences.

[0041] Accumulate the absolute values of the differences between adjacent elements in the click volume sequence to obtain the first overall change degree of the click volume sequence; accumulate the absolute values of the differences between adjacent elements in the click volume sequence to be analyzed to obtain the second overall change degree of the click volume sequence to be analyzed; use the ratio of the first overall change degree to the second overall change degree as the change stability. That is, the smaller the second overall change degree, the more stable the change of the click volume sequence to be analyzed relative to the click volume sequence, and the greater the change stability.

[0042] Preferably, in the embodiment of the present invention, the judgment index is the normalized result of the product of the change stability and the mutation evaluation. That is, the larger the judgment index, the more likely the corresponding same-type IP group is a combination of false traffic IPs. Therefore, the present invention determines that the second suspected false traffic source group is the same-type IP group with the largest judgment index in each abnormal click time period. That is, for each abnormal click time period, it is necessary to determine the second suspected false traffic source group. For an IP, it may be determined to belong to the second suspected false traffic source group in multiple abnormal click time periods.

[0043] Step S4: Screen out the true and false traffic sources according to the difference between the click volume and the view volume at the same moment of the second suspected false traffic source group and the judgment index.

[0044] False traffic sources usually access at a specific frequency or time interval, so they may appear repeatedly regularly. Since false traffic sources trigger access at a specific frequency, there are differences from the access habits of normal users. For example, when the overall number of visitors to the website is small, the advertisement still receives a large number of clicks, which may be clicks generated by false traffic. As Figure 2 shown, Figure 2 shows a schematic diagram of the comparison between the view volume and the click volume within the time sequence provided by an embodiment of the present invention. Figure 2 The horizontal axis represents time, and the vertical axis represents frequency. In Figure 2Taking two virtual boxes as a comparison, in the first virtual box, the view volume and click volume show relatively synchronous changes, which is the normal change of advertising information. In the second virtual box, the view volume significantly decreases, but the click volume significantly increases, showing an obvious difference between the two, indicating that obvious false traffic clicks have occurred at this time. Therefore, for the detection of false traffic IPs, the difference between the click volume and view volume at the same moment can be used to obtain it. At the same time, the judgment indicators obtained in the above steps can be combined. The larger the judgment indicator, the more abnormal the second suspected false traffic source group to which it belongs, and then the accurate true and false traffic sources can be judged.

[0045] Preferably, in the embodiments of the present invention, the method for screening out the true and false traffic sources includes: Regarding the IPs in the second suspected false traffic source group as suspected false traffic IPs; for each suspected false traffic IP, the ratio of the normalized value of the click volume and the normalized value of the view volume of the suspected false traffic IP at each moment within the time series range is used as the initial false traffic degree of the false traffic IP at each moment. After normalizing the click volume and view volume respectively, the normalization results represent the numerical sizes in their respective dimensions. The smaller the normalized value of the view volume and the larger the normalized value of the click volume, the more obvious abnormal traffic information is generated at the current moment, and the greater the initial false traffic degree of the suspected false traffic IP at the current moment.

[0046] It should be noted that the normalization methods involved in the embodiments of the present invention are all the range normalization results in their respective dimensions, which are specific technical means well-known to those skilled in the art and will not be elaborated here.

[0047] Since the time series range contains multiple moments, that is, multiple initial false traffic degrees, in order to avoid missed detection, the largest initial false traffic degree is selected as the first false traffic degree of the false traffic IP in the time series range.

[0048] Further considering the judgment indicator, since the suspected false traffic IP may be judged to belong to the second suspected false traffic source group in multiple abnormal click time periods, the judgment indicators of the suspected false traffic IP in all abnormal click time periods are accumulated to obtain the second false traffic degree.

[0049] According to the first false traffic degree and the second false traffic degree, it is judged whether the suspected false traffic IP is a true and false traffic source. In the embodiments of the present invention, the first false traffic degree and the second false traffic degree are multiplied and then normalized to obtain the third false traffic degree; if the third false traffic degree is greater than the preset degree threshold, the suspected false traffic IP is regarded as a true and false traffic source. In the embodiments of the present invention, the degree threshold is set to 0.7.

[0050] After determining the true and false traffic sources, the advertising platform can add the corresponding IP addresses to the blacklist to prevent these sources from continuing to participate in advertising delivery and causing waste of advertising budgets. Continuously monitor the advertising traffic, obtain advertising traffic data in real time, and update the blacklist. When there is a large amount of false traffic for an advertisement, consider pausing the advertising delivery, re-optimizing the advertisement settings and target audience positioning, optimizing the advertising delivery, and reducing the waste of advertising budgets. Continuously optimize and monitor the advertising delivery status, implement the method for monitoring false traffic in advertising delivery, and improve the advertising delivery efficiency.

[0051] In summary, the present invention uses a threshold comparison method to screen out abnormal click time periods within each time period, sorts the IPs based on the click volume, and groups them. For each group of similar IPs, a mutation evaluation is obtained, and after removing them, the stability of the click volume change of the remaining similar IPs is analyzed to determine the second suspected false traffic source group. Analyze each IP in the second suspected false traffic source group, and based on the difference between the click volume and the view volume at the same moment, combined with the judgment index, screen out the accurate true and false traffic sources. The present invention accurately screens out the true and false traffic sources by analyzing the information changes in multiple dimensions such as the advertising click volume, view volume, and IP, and improves the advertising delivery efficiency.

[0052] Based on the same inventive concept, the present invention also provides an advertising delivery false traffic monitoring system for the Internet, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for monitoring false traffic in advertising delivery for the Internet are implemented.

[0053] It should be noted that: the above sequence of embodiments of the present invention is only for description and does not represent the superiority or inferiority of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0054] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other, and the key point of each embodiment is to illustrate the differences from other embodiments.

Claims

1. An advertising false traffic monitoring method for the Internet, characterized in that, The method includes: Within a preset time sequence range, obtaining the view volume sequence, click volume sequence, and IP address information of advertisements within multiple identical preset time periods; Comparing the elements in the click volume sequence with a threshold to determine abnormal click time periods; for each abnormal click time period, arranging the click volumes of each IP in order to obtain an IP click volume sequence; dividing the IP click volume sequence into multiple groups of similar IPs according to the similarity of adjacent click volumes; Optionally selecting one group of similar IPs as the first suspected false traffic source group, obtaining the mutation evaluation of the first suspected false traffic source group according to the click volume of the first suspected false traffic source group at each moment and the time stamp range of the first suspected false traffic source group; analyzing the change in click volume over time of the groups of similar IPs other than the first suspected false traffic source group to obtain the change smoothness; obtaining the judgment index of the first suspected false traffic source group according to the change smoothness and the mutation evaluation; screening out the second suspected false traffic source group in each abnormal click time period according to the judgment index; Screening out the true and false traffic sources according to the difference between the click volume and view volume of the second suspected false traffic source group at the same moment and the judgment index.

2. The method for monitoring false traffic in Internet-oriented advertisement placement according to claim 1, wherein The method for obtaining the abnormal click time period includes: Obtaining the average sequence of the click volume sequences of all time periods; obtaining the average click volume within the time sequence range; for each moment within the time period, taking the normalized value of the corresponding element of the moment in the average sequence as the abnormal coefficient at that moment, obtaining an adjustment factor according to the abnormal coefficient, and taking the product of the adjustment factor and the average click volume as the adaptive threshold at that moment; Comparing the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine abnormal moments, and taking the continuous abnormal moments as the initial abnormal click time period; extending the initial abnormal click time period to both sides until it reaches the minimum value points of the click volume sequence, and taking the minimum value points on both sides as the two endpoints to obtain the abnormal click time period.

3. A method for monitoring false traffic in Internet-oriented advertising placement according to claim 1, characterized in that, The dividing of the IP click volume sequence into multiple groups of similar IPs according to the similarity of adjacent click volumes includes: The sorting method of the IP click volume sequence is ascending order; Obtaining the difference sequence of the IP click volume sequence; in the difference sequence, taking the IP corresponding to the element greater than the element mean as the segmenting IP, and segmenting the IP click volume sequence using the segmenting IP to obtain multiple groups of similar IPs.

4. The false traffic monitoring method for Internet-oriented advertisement placement according to claim 1, characterized in that, The method for obtaining the mutation evaluation includes: For each IP in the first suspected false traffic source group, obtaining the average click volume of each IP at all moments within the abnormal click time period, and taking the average value of the average click volumes of all IPs as the overall average click volume of the first suspected false traffic source group; Taking the union of the time stamp ranges of all IPs in the first suspected false traffic source group as the overall time stamp range of the first suspected false traffic source group; Taking the ratio of the overall average click volume to the overall time stamp range as the mutation evaluation.

5. A method for monitoring false traffic in Internet-oriented advertising delivery according to claim 1, characterized in that, The method for obtaining the change smoothness includes: In the click volume sequence, remove the click volume information corresponding to the first suspected false traffic source group to obtain the click volume sequence to be analyzed; accumulate the absolute values of the differences between adjacent elements in the click volume sequence to obtain the first overall change degree of the click volume sequence; accumulate the absolute values of the differences between adjacent elements in the click volume sequence to be analyzed to obtain the second overall change degree of the click volume sequence to be analyzed; use the ratio of the first overall change degree to the second overall change degree as the change smoothness.

6. The false traffic monitoring method for Internet-oriented advertisement delivery according to claim 1, characterized in that The judgment index is the normalized result of the product of the change smoothness and the mutation evaluation.

7. A method for monitoring false traffic in Internet-oriented advertising placement according to claim 6, characterized in that, The second suspected false traffic source group is the group of the same type of IPs with the largest judgment index in each abnormal click time period.

8. A method for monitoring false traffic in Internet-oriented advertising placement according to claim 1, characterized in that, The method for screening out true and false traffic sources includes: Take the IPs in the second suspected false traffic source group as suspected false traffic IPs; for each suspected false traffic IP, use the ratio of the normalized value of the click volume and the normalized value of the view volume of the suspected false traffic IP at each moment within the time series range as the initial false traffic degree of the false traffic IP at each moment, and select the largest initial false traffic degree as the first false traffic degree of the false traffic IP within the time series range; accumulate the judgment indexes of the suspected false traffic IPs in all abnormal click time periods to obtain the second false traffic degree; judge whether the suspected false traffic IP is a true false traffic source according to the first false traffic degree and the second false traffic degree.

9. A method for monitoring false traffic in Internet-oriented advertising delivery according to claim 8, characterized in that, The judging whether the suspected false traffic IP is a true false traffic source according to the first false traffic degree and the second false traffic degree includes: Multiply the first false traffic degree and the second false traffic degree and then perform normalization processing to obtain the third false traffic degree; if the third false traffic degree is greater than the preset degree threshold, then take the suspected false traffic IP as a true false traffic source.

10. An advertising false traffic monitoring system for the Internet, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for monitoring false traffic in Internet-oriented advertising placement according to any one of claims 1 to 9.

Images