Method and system for monitoring false traffic of Internet-oriented advertising

Abstract

The present invention relates to the field of data processing technology, and in particular to a method and system for monitoring false traffic for Internet-based advertising. The method uses a threshold comparison method to screen out abnormal click time periods within each time period, sorts the IPs based on the number of clicks, and groups them. For each IP group of the same type, a mutation evaluation is obtained, and after removing them, the stability of the change in the number of clicks of the remaining IPs of the same type is analyzed to determine the second group of suspected false traffic sources. Each IP in the second group of suspected false traffic sources is analyzed, and based on the difference in the number of clicks and views at the same time, the accurate real false traffic source is screened out in combination with the judgment index. The present invention accurately screens out the real false traffic source by analyzing the information changes in multiple dimensions such as the number of clicks, views, and IPs, thereby improving the efficiency of advertising delivery.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for monitoring false traffic of Internet advertisement delivery. Background Art

[0002] When advertisers distribute their content to their target audiences through various channels, such as social media, search engines, and display ad networks, some bad actors use fake users or automated tools (such as bots and crawlers) to create false clicks, views, and installs, generating fraudulent traffic. For example, click farms inflate ad clicks and generate large amounts of fraudulent traffic data to generate even more fraudulent advertising revenue. This inflated revenue attracts advertisers and market attention, and can affect the accuracy of advertisers' analysis and decision-making based on advertising data, potentially leading to misleading conclusions and further increasing advertisers' investment. Fraudulent traffic can undermine advertising effectiveness, increase customer acquisition costs, and waste advertisers' advertising budgets.

[0003] In the existing technology, each IP address can be tested by setting a click threshold, and IP addresses with significantly higher clicks can be screened as sources of false traffic. This method relies on the setting of a threshold. If the threshold is not set properly, it will lead to missed detections and false detections. In addition, for advertising, in the initial stages, the platform's advertising push algorithm needs a certain amount of time to learn and optimize the advertising delivery strategy. When the advertisement is initially delivered, it may not be accurately delivered to the target audience. As the algorithm of the advertising delivery platform is optimized and the target audience is accurately matched, the click data may also change significantly. This situation will also lead to false detections of false traffic sources. Summary of the Invention

[0004] In order to solve the technical problem in the prior art that determining the source of false traffic by detecting IP click volume may lead to false detection and missed detection, the purpose of the present invention is to provide a method and system for monitoring false traffic for Internet advertising. The technical solution adopted is as follows:

[0005] The present invention proposes a method for monitoring false traffic of advertisements placed on the Internet, the method comprising:

[0006] Obtaining, within a preset time range, a sequence of page views, a sequence of clicks, and IP address information for multiple advertisements within the same preset time period;

[0007] Perform threshold comparison on elements in the click volume sequence to determine abnormal click time periods; for each abnormal click time period, sort the click volume of each IP in order to obtain an IP click volume sequence; divide the IP click volume sequence into multiple similar IP groups based on the similarity of adjacent click volumes;

[0008] Select any IP group of the same type as the first suspected false traffic source group, and obtain a mutation evaluation of the first suspected false traffic source group based on the number of clicks of the first suspected false traffic source group at each moment and the timestamp range of the first suspected false traffic source group; analyze the time series changes in the number of clicks of the same IP groups other than the first suspected false traffic source group to obtain the stability of the changes; obtain a judgment index of the first suspected false traffic source group based on the stability of the changes and the mutation evaluation; and screen out the second suspected false traffic source group in each abnormal click time period based on the judgment index;

[0009] According to the difference between the click volume and the pageview volume of the second suspected false traffic source group at the same time, and the judgment index, the real false traffic source is screened out.

[0010] Furthermore, the method for obtaining the abnormal click time period includes:

[0011] Obtain the average sequence of click volume sequences for all time periods; obtain the average click volume within the time series range; for each moment in the time period, use the normalized value of the element corresponding to the moment in the average sequence as the abnormality coefficient at that moment, obtain an adjustment factor based on the abnormality coefficient, and use the product of the adjustment factor and the average click volume as the adaptive threshold at that moment;

[0012] Compare the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine the abnormal moment, and use the continuous abnormal moments as the initial abnormal click time period; extend the initial abnormal click time period to both sides until it reaches the minimum point of the click volume sequence, and use the minimum points on both sides as two endpoints to obtain the abnormal click time period.

[0013] Furthermore, dividing the IP click volume sequence into a plurality of similar IP groups according to the similarity of adjacent click volumes includes:

[0014] The sorting method of the IP click volume sequence is ascending order;

[0015] Obtain a differential sequence of an IP click volume sequence; in the differential sequence, use the IP corresponding to an element greater than the element mean as a segmented IP, and use the segmented IP to segment the IP click volume sequence to obtain multiple similar IP groups.

[0016] Furthermore, the method for obtaining the mutation evaluation includes:

[0017] For each IP in the first suspected fake traffic source group, obtain the average click volume of each IP at all times during the abnormal click time period, and use the average of the average click volumes of all IPs as the overall average click volume of the first suspected fake traffic source group;

[0018] The union of the timestamp ranges of all IPs in the first suspected false traffic source group is used as the overall timestamp range of the first suspected false traffic source group;

[0019] The ratio of the overall average click volume to the overall timestamp range is used as the mutation evaluation.

[0020] Furthermore, the method for obtaining the change smoothness includes:

[0021] In the click volume sequence, the click volume information corresponding to the first suspected false traffic source group is removed to obtain the click volume sequence to be analyzed; the absolute values ​​of the differences between adjacent elements in the click volume sequence are accumulated to obtain the first overall change degree of the click volume sequence; the absolute values ​​of the differences between adjacent elements in the click volume sequence to be analyzed are accumulated to obtain the second overall change degree of the click volume sequence to be analyzed; the ratio of the first overall change degree to the second overall change degree is used as the change smoothness.

[0022] Furthermore, the judgment index is a normalized result of the product of the change stability and the mutation evaluation.

[0023] Furthermore, the second suspected false traffic source group is a similar IP group with the largest judgment index in each abnormal click time period.

[0024] Furthermore, the method for screening out real and fake traffic sources includes:

[0025] The IPs in the second suspected false traffic source group are taken as suspected false traffic IPs; for each suspected false traffic IP, the ratio of the normalized value of the click volume and the normalized value of the page views of the suspected false traffic IP at each moment in the time series range is taken as the initial false traffic degree of the false traffic IP at each moment, and the largest initial false traffic degree is selected as the first false traffic degree of the false traffic IP in the time series range; the judgment indicators of the suspected false traffic IP in all abnormal click time periods are accumulated to obtain the second false traffic degree; and whether the suspected false traffic IP is a real false traffic source is judged according to the first false traffic degree and the second false traffic degree.

[0026] Furthermore, judging whether the suspected false traffic IP is a real false traffic source according to the first false traffic level and the second false traffic level includes:

[0027] The first false traffic level and the second false traffic level are multiplied and normalized to obtain a third false traffic level; if the third false traffic level is greater than a preset level threshold, the suspected false traffic IP is used as a real false traffic source.

[0028] The present invention also proposes a false traffic monitoring system for Internet-oriented advertising delivery, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements any one of the steps of the false traffic monitoring method for Internet-oriented advertising delivery.

[0029] The present invention has the following beneficial effects:

[0030] The present invention first uses a threshold comparison method to screen out abnormal click time periods within each time period. Because the IPs in the abnormal click time period may include the target audience IPs generated by advertising delivery, it is necessary to further analyze each IP in the abnormal click time period. In order to facilitate analysis, the present invention sorts the IPs based on the number of clicks and reduces the amount of calculation by grouping. For each similar IP group, the embodiment of the present invention quantifies the mutation characteristics of its click volume, obtains a mutation evaluation, and analyzes the stability of the click volume changes of the remaining similar IPs after removing them. These two characteristics can be used to screen the similar IP groups and determine the second suspected false traffic source group, that is, the second suspected false traffic source group is an IP combination with relatively abnormal click volume. Further analysis is performed on each IP in the second suspected false traffic source group. Compared with the normal target audience IP, the real false traffic source has the characteristic of obvious mismatch between click volume and pageview volume. Therefore, based on the difference in click volume and pageview volume at the same time, the accurate real false traffic source can be screened out in combination with the judgment index. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 A flow chart of a method for monitoring false traffic of Internet-based advertising provided by one embodiment of the present invention;

[0033] Figure 2 A schematic diagram comparing page views and clicks within a time series range provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation method, structure, features and effects of a method and system for monitoring false traffic for Internet advertising proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics of one or more embodiments may be combined in any suitable form.

[0035] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0036] The following describes in detail a method and system for monitoring false traffic of Internet-based advertising provided by the present invention in conjunction with the accompanying drawings.

[0037] See also Figure 1 , which shows a flow chart of a method for monitoring false advertising traffic on the Internet provided by an embodiment of the present invention, the method comprising:

[0038] Step S1: within a preset time sequence range, obtain a plurality of advertisement view count sequences, click count sequences and IP address information within the same preset time period.

[0039] The purpose of the embodiment of the present invention is to identify traffic anomalies during the advertising delivery period and filter out false traffic sources. Therefore, the embodiment of the present invention sets the time range to 7 days, using each day as a time period to obtain daily pageview sequence, click sequence, and IP address information. The pageviews, clicks, IP address, and timestamp information can be obtained at every moment of each day. Pageviews refer to the frequency of ad display on the advertising delivery platform, and clicks refer to the frequency of clicks on ads on the advertising delivery platform to jump to the target website.

[0040] In the embodiment of the present invention, after obtaining the data, irrelevant data such as blacklist traffic data can be excluded by data preprocessing methods such as data cleaning and preliminary screening. The specific technical means are well known to those skilled in the art and will not be described in detail here.

[0041] In order to timely screen out false traffic sources, the embodiment of the present invention sets the detection time to once a day, that is, starting from the detection time, the forward 7 days are divided as the time series range, and the information of each day within the time series range is analyzed and false traffic source detection is performed. After each false traffic source is detected, the false traffic source information of that day should be deleted and then stored to facilitate the analysis of false traffic sources in subsequent time periods.

[0042] Step S2: Perform threshold comparison on the elements in the click volume sequence to determine the abnormal click time period; for each abnormal click time period, arrange the click volume of each IP in order to obtain the IP click volume sequence; divide the IP click volume sequence into multiple similar IP groups according to the similarity of adjacent click volumes.

[0043] Because the click and pageview sequences obtained by the embodiments of the present invention are both time series, the false traffic source for advertisements manifests as a high density of clicks at a certain moment. Therefore, a threshold comparison method can be used to first determine the abnormal click time period in the click sequence, and then a targeted analysis can be performed on each IP address in the abnormal click time period. The threshold comparison method can be based on empirical thresholds in the prior art, or it can be based on statistical analysis of data within the time series range to determine an adaptive threshold, which is not limited here.

[0044] In the prior art, it is often determined whether an IP is a false traffic source by detecting the size of the click volume of a single IP. This direct threshold judgment will cause the situation of false detection and missed detection proposed in the background technology. Therefore, the embodiment of the present invention analyzes the changes and distribution of the click volume of the IP in the abnormal click time period, and further combines the information such as the pageview volume to perform multiple screenings to determine the real false traffic source. Taking into account that analyzing a single IP will cause a large amount of calculation and affect the timeliness of the detection, the embodiment of the present invention arranges the click volume of each IP in order in each abnormal click time period to obtain an IP click volume sequence; the IP click volume sequence is divided into multiple similar IP groups according to the similarity of adjacent click volumes. That is, in an abnormal click time period, the IPs involved are divided into multiple similar IP groups, and a similar IP group is regarded as a combination with similar click volume characteristics. In subsequent steps, the group can be analyzed as a unit, which improves the real-time performance of the detection method.

[0045] Preferably, in one embodiment of the present invention, considering that the number of users in different time periods of the day is different, the amount of ad clicks that may be generated is also different. For example, the page views in the afternoon and evening are often more than those in the early morning. Therefore, when screening abnormal click time periods, a fixed empirical threshold should not be used. Instead, an adaptive threshold should be set for each moment for comparison. Therefore, the method for obtaining abnormal click time periods in the embodiment of the present invention includes:

[0046] Obtain the average sequence of click counts for all time periods. Obtain the average click count within the time series range. Use these two averages as a reference to adaptively determine the threshold. Each element in the average sequence represents the average click count at each moment within a day, while the average click count within the time series range represents the average click count at each moment within seven days. Therefore, the average click count within the time series range can be used as a basis to normalize each element in the average sequence to characterize the degree of user volume anomaly at that moment, and then combine them to determine the adaptive threshold.

[0047] For each moment in the time period, the normalized value of the corresponding element in the average sequence is used as the anomaly coefficient at that moment. A larger anomaly coefficient indicates a greater number of users at that moment, and a larger threshold is required for comparison. An adjustment factor is calculated based on the anomaly coefficient, and the product of the adjustment factor and the average click volume is used as the adaptive threshold for that moment.

[0048] In the embodiment of the present invention, the sum of the normalized value of the element divided by 2 and the positive integer 1 is used as the abnormal coefficient. That is, the abnormal coefficient is a coefficient between 1 and 1.5, which avoids missed detection caused by an excessively large adaptive threshold.

[0049] In the embodiment of the present invention, the normalization method for the elements in the average sequence adopts range normalization, which is a technical means well known to those skilled in the art and will not be described in detail here.

[0050] Compare the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine the abnormal moment. That is, if the click volume at a certain moment is greater than the adaptive threshold at that moment, then that moment is considered an abnormal moment. Consecutive abnormal moments are considered the initial abnormal click period.

[0051] Considering that subsequent steps primarily involve analyzing changes in click volume for IP addresses, the embodiment of the present invention extends the initial abnormal click time period to both sides, until it reaches the minimum point in the click volume sequence, and uses the two minimum points as the two endpoints to obtain the abnormal click time period. That is, within the abnormal click time period, the overall click volume shows both upward and downward trends, which facilitates subsequent analysis of changes in click volume for IP addresses.

[0052] Preferably, in an embodiment of the present invention, the IP click volume sequence is divided into multiple similar IP groups according to the similarity of adjacent click volumes, including:

[0053] The sorting method of IP click volume sequence is ascending order.

[0054] Obtain a differential sequence of the IP click volume sequence. This differential sequence is the result of subtracting the previous element from the next element in the IP click volume sequence. In the differential sequence, the IPs corresponding to the elements greater than the element mean are used as segmented IPs. The segmented IPs are used to segment the IP click volume sequence to obtain multiple groups of similar IPs. In this embodiment of the present invention, if an element in the differential sequence is greater than the element mean, the element is the result of subtracting the previous IP click volume from the next IP click volume in the IP click volume sequence, and the next IP is used as the segmented IP.

[0055] Step S3: Select any IP group of the same type as the first suspected false traffic source group, and obtain the mutation evaluation of the first suspected false traffic source group based on the number of clicks of the first suspected false traffic source group at each moment and the timestamp range of the first suspected false traffic source group; analyze the time series changes in the number of clicks of the same IP groups except the first suspected false traffic source group to obtain the smoothness of the changes; obtain the judgment index of the first suspected false traffic source group based on the smoothness of the changes and the mutation evaluation; and screen out the second suspected false traffic source group in each abnormal click time period based on the judgment index.

[0056] For a similar IP group, if it is a fake traffic source group, the overall click volume change characteristics of this similar IP group during the abnormal click period will show obvious mutations. If this similar IP group is eliminated, the remaining IPs should show normal user click volume, showing a steady increase. Therefore, in this embodiment of the present invention, a specific similar IP group is selected as the first suspected fake traffic source group. Based on the click volume of the first suspected fake traffic source group at each moment and the timestamp range of the first suspected fake traffic source group, a mutation evaluation of the first suspected fake traffic source group is obtained. That is, the greater the overall click volume of the first suspected fake traffic source group and the shorter the corresponding timestamp range, the greater the mutation evaluation, and the more its click volume change is characterized by mutation. Further analysis of the click volume changes of similar IP groups other than the first suspected fake traffic source group in time series is performed to obtain the change stability. That is, each similar IP group can obtain a corresponding mutation evaluation and change stability. Based on these two characteristics, a judgment index can be obtained. According to this judgment index, all similar IP groups can be traversed to screen out the second suspected fake traffic source group in each abnormal click period. That is, the second suspected false traffic source group is an IP combination that meets the false traffic characteristics. In subsequent steps, each IP needs to be further analyzed to determine the true false traffic source.

[0057] Preferably, in an embodiment of the present invention, the method for obtaining mutation evaluation includes:

[0058] Considering that the first suspected fraudulent traffic source group contains multiple IP addresses, this embodiment of the present invention uses a method of first analyzing each IP address individually and then averaging the IP addresses to quantify the characteristics. For each IP address in the first suspected fraudulent traffic source group, the average number of clicks for each IP address at all times during the abnormal click time period is obtained. The average number of clicks for all IP addresses is then taken as the overall average number of clicks for the first suspected fraudulent traffic source group.

[0059] The union of the timestamp ranges of all IP addresses in the first suspected fraudulent traffic source group is used as the overall timestamp range of the first suspected fraudulent traffic source group. It should be noted that the purpose of obtaining the union in this embodiment of the present invention is to avoid redundant calculations caused by overlapping IP timestamp ranges. Essentially, this is to eliminate the impact of overlap and use the length of the timestamp range involved as the final calculation target. That is, the timestamp range is a time-series length.

[0060] The ratio of the overall average click volume to the overall timestamp range is used as the mutation evaluation. That is, the larger the overall average click volume and the smaller the overall timestamp range, the more likely the click volume change characteristics of the first suspected fraudulent traffic source group are to be mutational, and the higher the mutation evaluation.

[0061] Preferably, in an embodiment of the present invention, the method for obtaining the change smoothness includes:

[0062] In the click volume sequence, the click volume information corresponding to the first suspected fraudulent traffic source group is removed to obtain the click volume sequence to be analyzed. For the click volume sequence to be analyzed, if the first suspected fraudulent traffic source group is a fraudulent traffic IP combination, then the click volume sequence to be analyzed is the click volume time series data generated by normal traffic IPs, which will show a stable change, which is significantly different from the change characteristics in the original click volume sequence. Therefore, by comparing the element changes of the two sequences, the stability of the change can be quantified.

[0063] The first overall degree of change of the click volume sequence is obtained by summing the absolute values ​​of the differences between adjacent elements in the click volume sequence to be analyzed. The second overall degree of change of the click volume sequence to be analyzed is obtained by summing the absolute values ​​of the differences between adjacent elements in the click volume sequence to be analyzed. The ratio of the first overall degree of change to the second overall degree of change is used as the stability of change. In other words, the smaller the second overall degree of change, the more stable the change of the click volume sequence to be analyzed is relative to the click volume sequence, and the greater the stability of change.

[0064] Preferably, in an embodiment of the present invention, the judgment index is the normalized result of the product of the change stability and the mutation evaluation. That is, the larger the judgment index, the more likely the corresponding similar IP group is to be a combination of false traffic IPs. Therefore, the present invention determines that the second suspected false traffic source group is the similar IP group with the largest judgment index in each abnormal click time period. That is, there is a need to determine the second suspected false traffic source group in each abnormal click time period. For an IP, it may be judged to belong to the second suspected false traffic source group in multiple abnormal click time periods.

[0065] Step S4: Filter out the real fake traffic sources based on the difference in click volume and pageview volume of the second suspected fake traffic source group at the same time, as well as the judgment index.

[0066] Fake traffic sources usually visit at a specific frequency or time interval, so they may recur with a certain regularity. Because fake traffic sources stimulate visits at a specific frequency, they differ from the visit habits of normal users. For example, when the total number of visitors to a website is small, but the ads still receive a large number of clicks, it is possible that the clicks are generated by fake traffic. Figure 2 As shown, Figure 2 A schematic diagram showing a comparison of page views and clicks within a time series provided by an embodiment of the present invention is shown. Figure 2 The horizontal axis represents time, and the vertical axis represents frequency. Figure 2 Comparing the two virtual boxes, the first shows relatively synchronized changes in page views and clicks, indicating normal changes in the ad information. In the second, page views have decreased significantly, but clicks have increased significantly, a significant discrepancy indicating significant fraudulent traffic. Therefore, fraudulent traffic IPs can be detected by comparing the difference between clicks and page views at the same moment. This can be combined with the judgment indicator obtained in the previous steps. A larger judgment indicator indicates a more abnormal second suspected fraudulent traffic source group, allowing accurate identification of the true fraudulent traffic source.

[0067] Preferably, in an embodiment of the present invention, the method for screening out real and fake traffic sources includes:

[0068] The IPs in the second suspected fake traffic source group are regarded as suspected fake traffic IPs; for each suspected fake traffic IP, the ratio of the normalized value of the click volume and the normalized value of the pageview volume of the suspected fake traffic IP at each moment within the time series range is used as the initial fake traffic level of the fake traffic IP at each moment. After normalizing the click volume and pageview volume respectively, the normalized results represent the numerical values ​​under the corresponding dimensions. The smaller the normalized pageview value and the larger the normalized click volume value, the more obvious abnormal traffic information is generated at the current moment, and the greater the initial fake traffic level of the suspected fake traffic IP at the current moment.

[0069] It should be noted that the normalization methods involved in the embodiments of the present invention are all range normalization results in their respective dimensions. They are specific technical means well known to those skilled in the art and will not be elaborated here.

[0070] Because the time series range includes multiple moments, that is, multiple initial false traffic levels, in order to avoid missed detection, the largest initial false traffic level is selected as the first false traffic level of the false traffic IP in the time series range.

[0071] Further considering the judgment indicators, since the suspected false traffic IP may be judged as belonging to the second suspected false traffic source group in multiple abnormal click time periods, the judgment indicators of the suspected false traffic IP in all abnormal click time periods are accumulated to obtain the second false traffic degree.

[0072] The suspected fraudulent traffic IP address is determined to be the actual fraudulent traffic source based on the first and second fraudulent traffic levels. In this embodiment of the present invention, the first and second fraudulent traffic levels are multiplied and normalized to obtain a third fraudulent traffic level. If the third fraudulent traffic level exceeds a preset threshold, the suspected fraudulent traffic IP address is considered the actual fraudulent traffic source. In this embodiment of the present invention, the threshold is set to 0.7.

[0073] After identifying the true source of fraudulent traffic, the ad platform can blacklist the corresponding IP addresses to prevent them from continuing to participate in ad delivery and wasting ad budget. Ad traffic should be continuously monitored, with real-time data collected and blacklists updated. When a large amount of fraudulent traffic is detected, consider pausing ad delivery and re-optimizing ad settings and target audience targeting to optimize ad delivery and reduce wasted ad budget. Continuously optimizing and monitoring ad delivery status, implementing fraudulent traffic detection methods, and improving ad delivery efficiency.

[0074] In summary, the present invention uses a threshold comparison method to screen out abnormal click time periods within each time period, sorts the IPs based on the number of clicks, and groups them. For each similar IP group, a mutation evaluation is obtained, and after removing it, the stability of the change in the number of clicks of the remaining similar IPs is analyzed to determine the second suspected false traffic source group. Each IP in the second suspected false traffic source group is analyzed, and based on the difference in the number of clicks and views at the same time, the accurate real false traffic source is screened out in combination with the judgment index. The present invention accurately screens out the real false traffic source by analyzing the information changes in multiple dimensions such as advertising clicks, views, and IP, thereby improving the efficiency of advertising delivery.

[0075] Based on the same inventive concept, the present invention also proposes a false traffic monitoring system for Internet-oriented advertising, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the steps of the false traffic monitoring method for Internet-oriented advertising are implemented.

[0076] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0077] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A method for monitoring false traffic of Internet-based advertising, characterized in that: The method comprises: Obtaining, within a preset time range, a sequence of page views, a sequence of clicks, and IP address information for multiple advertisements within the same preset time period; Perform threshold comparison on elements in the click volume sequence to determine abnormal click time periods; for each abnormal click time period, sort the click volume of each IP in order to obtain an IP click volume sequence; divide the IP click volume sequence into multiple similar IP groups based on the similarity of adjacent click volumes; Select any IP group of the same type as the first suspected false traffic source group, and obtain the mutation evaluation of the first suspected false traffic source group based on the number of clicks of the first suspected false traffic source group at each moment and the timestamp range of the first suspected false traffic source group; analyze the time series changes in the number of clicks of the same IP groups other than the first suspected false traffic source group to obtain the stability of the change; obtain the judgment index of the first suspected false traffic source group based on the stability of the change and the mutation evaluation; screen out the second suspected false traffic source group in each abnormal click time period based on the judgment index; the judgment index is the normalized result of the product of the stability of the change and the mutation evaluation; According to the difference between the click volume and the pageview volume of the second suspected false traffic source group at the same time, and the judgment index, the real false traffic source is screened out.

2. The method for monitoring false traffic of Internet-based advertising according to claim 1, characterized in that: The method for obtaining the abnormal click time period includes: Obtain the average sequence of click volume sequences for all time periods; obtain the average click volume within the time series range; for each moment in the time period, use the normalized value of the element corresponding to the moment in the average sequence as the abnormality coefficient at that moment, obtain an adjustment factor based on the abnormality coefficient, and use the product of the adjustment factor and the average click volume as the adaptive threshold at that moment; Compare the elements in the click volume sequence with the adaptive threshold at the corresponding moment to determine the abnormal moment, and use the continuous abnormal moments as the initial abnormal click time period; extend the initial abnormal click time period to both sides until it reaches the minimum point of the click volume sequence, and use the minimum points on both sides as two endpoints to obtain the abnormal click time period.

3. The method for monitoring false traffic of Internet-oriented advertising according to claim 1, characterized in that: The step of dividing the IP click volume sequence into a plurality of similar IP groups according to the similarity of adjacent click volumes includes: The sorting method of the IP click volume sequence is ascending order; Obtain a differential sequence of an IP click volume sequence; in the differential sequence, use the IP corresponding to an element greater than the element mean as a segmented IP, and use the segmented IP to segment the IP click volume sequence to obtain multiple similar IP groups.

4. The method for monitoring false traffic of Internet-oriented advertising according to claim 1, characterized in that: The method for obtaining the mutation evaluation includes: For each IP in the first suspected fake traffic source group, obtain the average click volume of each IP at all times during the abnormal click time period, and use the average of the average click volumes of all IPs as the overall average click volume of the first suspected fake traffic source group; The union of the timestamp ranges of all IPs in the first suspected false traffic source group is used as the overall timestamp range of the first suspected false traffic source group; The ratio of the overall average click volume to the overall timestamp range is used as the mutation evaluation.

5. The method for monitoring false traffic of Internet-oriented advertising according to claim 1, characterized in that: The method for obtaining the change stability includes: In the click volume sequence, the click volume information corresponding to the first suspected false traffic source group is removed to obtain the click volume sequence to be analyzed; the absolute values ​​of the differences between adjacent elements in the click volume sequence are accumulated to obtain the first overall change degree of the click volume sequence; the absolute values ​​of the differences between adjacent elements in the click volume sequence to be analyzed are accumulated to obtain the second overall change degree of the click volume sequence to be analyzed; the ratio of the first overall change degree to the second overall change degree is used as the change smoothness.

6. The method for monitoring false traffic of Internet-oriented advertising according to claim 1, characterized in that: The second suspected fake traffic source group is a similar IP group with the largest judgment index in each abnormal click time period.

7. The method for monitoring false traffic of Internet-oriented advertising according to claim 1, characterized in that: The method for screening out real and fake traffic sources includes: The IPs in the second suspected false traffic source group are taken as suspected false traffic IPs; for each suspected false traffic IP, the ratio of the normalized value of the click volume and the normalized value of the page views of the suspected false traffic IP at each moment in the time series range is taken as the initial false traffic degree of the false traffic IP at each moment, and the largest initial false traffic degree is selected as the first false traffic degree of the false traffic IP in the time series range; the judgment indicators of the suspected false traffic IP in all abnormal click time periods are accumulated to obtain the second false traffic degree; and whether the suspected false traffic IP is a real false traffic source is judged according to the first false traffic degree and the second false traffic degree.

8. The method for monitoring false traffic of Internet-oriented advertising according to claim 7, characterized in that: The determining, based on the first false traffic level and the second false traffic level, whether the suspected false traffic IP is a real false traffic source includes: The first false traffic level and the second false traffic level are multiplied and normalized to obtain a third false traffic level; if the third false traffic level is greater than a preset level threshold, the suspected false traffic IP is used as a real false traffic source.

9. A system for monitoring false traffic of advertisements on the Internet, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for monitoring false traffic of Internet-oriented advertising are implemented as described in any one of claims 1 to 8.

Images