Internet advertisement abnormal flow detection method and detection system

Abstract

The invention relates to the technical field of advertisement abnormal traffic detection, in particular to an internet advertisement abnormal traffic detection method and system, and the method comprises the steps: collecting the visited frequency and user stay duration of a target advertisement in each preset time period in a plurality of historical collection cycles; constructing target advertisement browsing time anomaly, a target advertisement browsing anomaly factor and a visited frequency change anomaly value, and fusing to generate a first anomaly value of target advertisement traffic; and constructing a user behavior abnormal value, combining the first abnormal value with the user behavior abnormal value, constructing a second abnormal value of the target advertisement flow, and constructing a flow judgment threshold value according to the second abnormal value of the time period in all historical collection periods so as to judge whether the advertisement flow is abnormal in the current analysis time period. According to the invention, the abnormal condition of the advertisement flow is accurately discriminated in combination with multi-aspect monitoring parameters.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of advertising abnormal traffic detection, and particularly relates to an Internet advertising abnormal traffic detection method and system. BACKGROUND

[0002] With the rapid development of the Internet advertising industry, advertising delivery gradually evolves towards programmatic, automation and data-driven direction, and the interaction between advertisers, media platforms and advertising technology platforms is increasingly complex. Under this background, the problem of false traffic is increasingly prominent, becoming a key obstacle to the healthy development of the industry. A large amount of malicious traffic is generated by means such as automated scripts, virtual devices, proxy IPs, click farms and other means to fake user behavior, causing distortion of advertising exposure, click and conversion data, not only leading to waste of advertiser budgets, but also damaging the fairness and transparency of the advertising ecosystem. Especially in high-time-efficiency scenarios such as real-time bidding (RTB) and cross-channel attribution, the existence of abnormal traffic seriously affects the evaluation and optimization of delivery effect, and an efficient and accurate abnormal traffic identification mechanism is urgently needed.

[0003] Traditional anomaly detection methods mainly rely on preset rules and simple statistical models, such as IP frequency and time interval analysis, which have the advantages of simple implementation and fast response, but are powerless in the face of increasingly intelligent and concealed cheating methods. Modern cheating behavior often simulates the behavior patterns of real users, with characteristics such as low frequency, dispersion and variability, and a single monitoring parameter cannot accurately distinguish abnormal advertising traffic. SUMMARY

[0004] To solve the above technical problems, the present application provides an Internet advertising abnormal traffic detection method and system, and the technical solutions adopted are as follows: In a first aspect, one embodiment of the present application provides an Internet advertising abnormal traffic detection method, which comprises the following steps: Collecting the access frequency and user dwell time of the target advertisement in each preset time period within a plurality of historical collection periods; In any time period, based on the distribution difference between the number of users online on the network platform where the target advertisement is located and the access frequency of the target advertisement, calculating the target advertisement browsing time abnormality; Combining the distribution of the access frequency and user dwell time of the target advertisement within a time period and the average user dwell time, constructing a target advertisement browsing abnormality factor; By analyzing the difference in access frequency difference between adjacent time periods in any two time periods within a historical collection period, calculating the access frequency change abnormal value; Fusing the target advertisement browsing time abnormality, the target advertisement browsing abnormality factor and the access frequency change abnormal value, generating a first abnormal value of the target advertisement traffic; constructing a user behavior abnormal value based on the dwell time of all the ads visited by the user accessing any target ad in the time period and the distribution thereof, and the average interval time of accessing the same ad in all the ads; combining the first abnormal value and the user behavior abnormal value to construct a second abnormal value of the target ad traffic, and constructing a traffic judgment threshold based on the second abnormal value of the time period in all the historical collection periods, to determine whether there is an ad traffic anomaly in the current analysis time period.

[0005] Preferably, the target ad browsing time abnormality is calculated by the following formula: ; wherein represents the target ad browsing time abnormality of the time period t, norm represents a normalization function, represents the number of users online on the network platform where the target ad is located in the time period t, represents the highest number of users online in all time periods in the collection period in which the time period t is located, and S represents the access frequency in the time period corresponding to the highest number of users online in all time periods in the collection period in which the time period t is located, represents the access frequency of the target ad in the time period t.

[0006] Preferably, the target ad browsing abnormal factor is calculated by the following formula: ; wherein represents the target ad browsing abnormal factor of the time period t, norm represents a normalization function, represents the variance value of the dwell time of the user accessing the target ad in the time period t, represents the access frequency of the target ad in the time period t, represents the average duration of the dwell time of the user accessing the target ad in the time period t.

[0007] Preferably, the visited frequency change abnormal value is calculated by the following formula: ; wherein represents the visited frequency change abnormal value of the time period t, norm represents a normalization function, represents the normalization value of the number of time periods between the time period t and the time period u in the same historical collection period, , respectively represent the adjacent time period visited frequency difference of the time period u and t.

[0008] Preferably, the first abnormal value of the target ad traffic is determined by multiplying the target ad browsing time abnormality, the target ad browsing abnormal factor, and the visited frequency change abnormal value of the same time period.

[0009] Preferably, the user behavior abnormal value is calculated by the following formula: ; wherein represents the user behavior abnormal value of the A-th user accessing the target advertisement in the time period t, norm represents a normalization function, T represents the number of time periods between the registration time of the A-th user and the time period t, F represents the variance value of the dwell time of all advertisements accessed by the A-th user in the time period t, D represents the average dwell time of all advertisements accessed by the A-th user in the time period t, and L represents the number of all advertisements accessed by the A-th user in the time period t. represents the average interval time of the A-th user when accessing the i-th advertisement in the time period t, and R represents the average value of the average interval time of each same advertisement accessed by the A-th user in the time period t.

[0010] Preferably, when the number of time periods between the registration time of the A-th user and the time period t is greater than a preset number, the number is assigned as the preset number.

[0011] Preferably, the second abnormal value of the target advertisement traffic is calculated by the following formula: ; wherein represents the second abnormal value of the target advertisement traffic in the time period t, represents the first abnormal value of the target advertisement traffic in the time period t, and norm represents a normalization function, represents the access frequency of the target advertisement in the time period t, represents the user behavior abnormal value of the A-th user accessing the target advertisement in the time period t.

[0012] Preferably, the second abnormal value of the target advertisement traffic in the time period t is constructed into a traffic judgment threshold according to the second abnormal values of the time periods in all historical collection periods, so as to determine whether there is an advertisement traffic abnormality in the current analysis time period, comprising: selecting the minimum value of the second abnormal values of the target advertisement traffic in the same time period in all historical collection periods as the traffic judgment threshold of the same time period; when the second abnormal value of the target advertisement traffic in the current analysis time period is greater than the traffic judgment threshold of the corresponding time period, the advertisement traffic in the current analysis time period is abnormal.

[0013] In a second aspect, another embodiment of the present application further provides an Internet advertisement abnormal traffic detection system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the above-mentioned Internet advertisement abnormal traffic detection method when executing the computer program.

[0014] The present application has at least the following beneficial effects: The present application not only considers the time distribution of advertisement access, access frequency and stay time, etc. macro access mode, but also introduces the overall user activity trend of the platform for comparison and analysis, quantifies the degree of deviation of the access behavior of the advertisement from the normal user behavior in a specific time period by constructing relevant indicators, and effectively identifies the abnormal access peak caused by non-natural traffic. In view of the characteristics of automatic script or AI simulated user high-frequency access to the advertisement in a short time, short stay time and highly consistent behavior, the present application can sharply capture the "low variance, short duration, high frequency" behavior mode caused by machine access by constructing browsing anomaly factor, and significantly improve the identification efficiency of programmatic brushing behavior. The present application further collects and analyzes the browsing behavior data of the user within 24 hours, including registration time, advertisement browsing frequency, stay time variance, average stay time and multi-ad access interval consistency, etc. features, constructs user behavior abnormal value, and the mechanism can effectively analyze abnormal user behavior, and accurately distinguish the abnormal situation of advertisement traffic in combination with multiple monitoring parameters. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0016] Figure 1 A flow chart of an internet advertisement abnormal traffic detection method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0017] Embodiment 1 An internet advertisement abnormal traffic detection method provided by an embodiment of the present application, specifically referring to Figure 1 The method comprises the following steps: Step S1: data collection.

[0018] Since the advertisement traffic anomaly may be caused by human or machine multiple frequency access to the advertisement, the time of advertisement click access and the frequency of click access can be collected, the abnormal access time and the abnormal access frequency are monitored, and the corresponding user behavior is analyzed, so as to determine whether the corresponding access is abnormal access. And according to the frequency and time of the total abnormal access, the abnormality of the advertisement traffic is determined.

[0019] Therefore, the data collection includes collecting the frequency of advertisement click access and the user stay time. In the present application, the access frequency is counted once every half hour.

[0020] The present application considers that the online behavior of a user has a significant daily periodicity feature, and is generally developed around the life schedule of "24 hours a day", that is, 48 time period target advertisement visit frequencies and user visit user dwell times can be collected in a day.

[0021] The advertisement delivery environment has dynamic change characteristics, and user interests, hot events, seasonal activities, etc. can cause user behavior patterns to evolve over time, so the present application analyzes the visit-related data of the target advertisement in the 30 days closest to the day on which the current analysis time period is located, thereby analyzing the advertisement abnormal traffic analysis result of the current analysis time period.

[0022] Step S2: advertisement traffic anomaly analysis.

[0023] a. Target advertisement browsing time abnormality analysis: Internet advertisement traffic anomaly first needs to analyze the frequency of target advertisement clicks and the user dwell time after visiting the target advertisement, so the present application analyzes each advertisement visit record based on the above factors, first obtains the advertisement browsing time abnormality of each time period in a historical collection period: First, for the number of users online on the network platform of the target advertisement in each time period in a historical collection period, if the time of browsing the advertisement is in the time when the user activity of the network platform is low, then the possibility of the advertisement browsing record being an abnormal browsing record at that time is higher.

[0024] Take one browsing time period t in the collection period as an example to illustrate the target advertisement browsing time abnormality of the analysis time period t, and the specific calculation method is as follows: Wherein represents the target advertisement browsing time abnormality of time period t, norm represents the normalization function, represents the number of users online on the network platform of the target advertisement in time period t, represents the highest number of users online on the network platform of the target advertisement in all time periods in the collection period in which time period t is located, S represents the visit frequency in the time period corresponding to the highest number of users online on the network platform of the target advertisement in all time periods in the collection period in which time period t is located, represents the visit frequency of the target advertisement in time period t.

[0025] That is, when the number of users online on the platform in the time period t in which the advertisement is browsed is divided by the number of users online on the platform in the collection period , and the visit frequency of the target advertisement in the time period t is divided by the visit frequency of the time period with the highest number of users online on the platform The greater the difference, the more the browsing record of the target advertisement in the time period does not conform to the normal law that the online number is proportional to the visited frequency, and the greater the possibility of abnormal access to the target advertisement in the time period.

[0026] b. Target advertisement browsing abnormal factor analysis: Further, considering that machines or programs are set to brush the click volume or access volume of the advertisement, and most of them only click the advertisement and then exit, if the browsing time of the advertisement is short and the browsing time is consistent, it means that the browsing record may be set by a machine program, so the target advertisement browsing abnormal factor of the time period can be calculated as follows: Wherein represents the target advertisement browsing abnormal factor of the time period t, represents the variance value of the user stay duration of the target advertisement in the time period t, represents the visited frequency of the target advertisement in the time period t, represents the average duration of the user stay duration of the target advertisement in the time period t, that is, the smaller the variance of the stay time of the target advertisement accessed by the user in the time period, the more similar the browsing time, and the smaller the browsing duration of the user stay, and the higher the visited frequency, the more likely it is that the time period is an abnormal browsing time period of the target advertisement.

[0027] c. Visited frequency change abnormal value analysis: At the same time, considering that people have different work and rest times, it is possible to click and access the platform at any time, so the abnormal results of the visited record of the target advertisement are further corrected as follows.

[0028] According to the overall access trend, if the visited frequency of the target advertisement in the adjacent time period suddenly increases, it means that there may be a large number of abnormal access records in the access record of the advertisement in the time period.

[0029] Accordingly, the present application first obtains the visited frequency of the target advertisement in all time periods in a historical collection period, and the difference between the visited frequency of the current time period and the adjacent time period is taken as the visited frequency difference of the adjacent time period of the current time period. It is worth noting that the visited frequency difference of the adjacent time period of the first time period in a historical collection period is calculated by the difference between the visited frequency of the last time period in the last historical collection period.

[0030] Therefore, the visited frequency change abnormal value of the time period t can be further analyzed as follows: Wherein represents the visited frequency change abnormal value of the time period t, This represents the normalized value indicating the number of time intervals between time interval u and time interval t within the same historical data collection period. Specifically, the smaller the time interval between time interval u and time interval t, the larger its weight. , This indicates the number of time intervals between time interval u and time interval t. , These represent the differences in visit frequency between adjacent time periods u and t, respectively. In other words, the larger the absolute difference between the visit frequency of the time period t and the adjacent time periods of other time periods, and the greater the time interval between the two time periods, the larger the abnormal value of the visit frequency change of the time period t.

[0031] d. Analysis of the first outlier in the target ad traffic: Based on the above analysis results, by comprehensively analyzing the anomalies of target ad browsing time, target ad browsing anomaly factors, and outliers in the frequency of visits during time period t, the first outlier of target ad traffic in time period t is constructed. : In other words, the greater the anomaly in the target ad browsing time within the desired time period t, the greater the target ad browsing anomaly factor, and the greater the anomaly value of the visit frequency change, the greater the probability of anomalies in the target ad visit records within that time period t, i.e., the greater the first anomaly value of the target ad traffic.

[0032] e. User behavior outlier analysis: Meanwhile, considering the current development of AI, users generated by programs may not repeatedly visit the same ad in a short period of time to increase ad exposure. Instead, they may visit several ads that require increased exposure in a short period of time, increasing the frequency of visits to the same ad in turn, thus avoiding the possibility of being detected when monitoring abnormal traffic based on short-term visit frequency.

[0033] Accordingly, this application analyzes the frequency of user visits to advertisements and the time users spend on each advertisement to determine whether a user is a dedicated account registered specifically to increase advertising traffic. Therefore, it is necessary to conduct anomaly analysis on the user's behavior within 24 hours. The specific calculation method is as follows: in user behavior abnormal value of the A-th user accessing the target advertisement in the time period t, T represents the number of time periods between the registration time of the A-th user and the time period t, when the number of time periods is greater than a preset number, the number is assigned as 48, in the embodiment, the preset number is taken as 48, that is, when the user is registered more than one day before the analysis time period t, it is explained that the user is not an abnormal user for temporarily using a “brushing account”, F represents the variance value of the stay time of all advertisements accessed by the A-th user in the time period t, D represents the average stay time of all advertisements accessed by the A-th user in the time period t, L represents the number of all advertisements accessed by the A-th user in the time period t, representing the average interval time of the A-th user when accessing the i-th advertisement in the time period t, R represents the average value of the average interval time of each same advertisement accessed by the A-th user in the time period t.

[0034] That is, when the registration time of the user is shorter, the variance value of the stay time of all advertisements accessed in the time period t is smaller, and the average stay time is shorter, and the difference of the access interval time of multiple different advertisements accessed in the same time period is smaller (that is, the access rhythm is highly regularized), it is explained that the behavior mode of the user is highly consistent with the “brushing account” under the control of the programmatic operation or the automated script, and the possibility of being an abnormal user is significantly increased.

[0035] f. Advertisement traffic anomaly analysis in a time period: In summary, the first abnormal value of the target advertisement traffic in the time period t and the user behavior abnormal value are analyzed comprehensively to construct the second abnormal value of the target advertisement traffic in the time period t: Among them representing the second abnormal value of the target advertisement traffic in the time period t, representing the access frequency of the target advertisement in the time period t, representing the user behavior abnormal value of the A-th user accessing the target advertisement in the time period t, that is, when the first abnormal value of the target advertisement traffic in the time period t is greater, and the behavior abnormal value of the A-th user accessing the target advertisement is greater, it is explained that the second abnormal value of the target advertisement traffic in the time period t is greater.

[0036] Using this method, the second abnormal value of the target advertisement traffic is calculated for all time periods in the history of 30 days before the day of the current analysis time period. The minimum value of the second abnormal value of the target advertisement traffic in the same time period in the history of 30 days is selected as the traffic judgment threshold value of the same time period, which is used to judge the advertisement traffic anomaly of the current analysis time period.

[0037] When the second abnormal value of the target advertisement traffic in the current analysis time period is greater than the traffic judgment threshold value of the corresponding time period, it indicates that the advertisement traffic in the current analysis time period is abnormal, and an alarm is given to remind a person to further analyze and process.

[0038] Embodiment 2 Another embodiment of the present application further provides an Internet advertisement abnormal traffic detection system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the above-mentioned Internet advertisement abnormal traffic detection method when executing the computer program.

[0039] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the application cover any and all variations of the application that come within the scope of the

[0040] It is to be understood that the application is not limited to the precise construction here described and illustrated and that various modifications and changes can be made without departing from the scope thereof.

Claims

1. A method for detecting abnormal traffic in internet advertising, characterized in that, The method includes the following steps: Collect the frequency of access and user dwell time of the target advertisement in each preset time period within multiple historical collection periods; Within any given time period, the anomaly of the target ad browsing time is calculated based on the difference between the distribution of the number of online users on the network platform where the target ad is located and the distribution of the frequency of access to the target ad. By combining the frequency of visits to the target advertisement within a time period, the distribution of user dwell time, and the average user dwell time, anomaly factors for target advertisement browsing are constructed. By analyzing the difference in the frequency of visits between any two adjacent time periods within a historical data collection period, outlier values ​​of visit frequency changes are calculated. By combining the anomalies in target ad browsing time, target ad browsing anomalies, and outliers in visit frequency changes, the first anomaly in target ad traffic is generated. User behavior anomalies are constructed based on the dwell time and distribution of all ads visited by any user who accesses the target ad within a time period, as well as the average interval between visits to the same ad among all ads. By combining the first outlier with the user behavior outlier, a second outlier for the target advertising traffic is constructed. A traffic judgment threshold is then constructed based on the second outlier for each time period in all historical collection periods to determine whether there is an advertising traffic anomaly in the current analysis time period.

2. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The anomaly of the target advertisement viewing time is calculated using the following formula: ;in This indicates the anomaly of the target ad viewing time in time period t, where norm represents the normalization function. This indicates the number of users online on the network platform where the target advertisement is located during time period t. This represents the highest number of online users on the target ad platform across all time periods within the collection period t. S represents the access frequency within the time period corresponding to the highest number of online users on the target ad platform across all time periods within the collection period t. This indicates the frequency of the target advertisement being viewed within the time period t.

3. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The target ad browsing anomaly factor is calculated using the following formula: ;in This represents the target ad browsing anomaly factor over time period t, where norm represents the normalization function. This represents the variance of the dwell time of users who access the target advertisement within the time period t. This indicates the frequency of the target ad being viewed within the time period t. This represents the average duration of time users spend viewing the target advertisement within time period t.

4. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The outlier in the frequency of visits is calculated using the following formula: ;in This represents outlier values ​​in the frequency of visits over a time period t, where norm represents the normalization function. This represents the normalized value indicating the number of time periods between time period u and time period t within the same historical data collection period. , These represent the difference in visit frequency between adjacent time periods u and t, respectively.

5. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The first outlier of the target ad traffic is determined by multiplying the outlier of the target ad browsing time, the outlier factor of the target ad browsing, and the outlier of the frequency of visits within the same time period.

6. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The abnormal user behavior value is calculated using the following formula: ;in Let represent the outlier user behavior of the Ath user who accessed the target ad within time period t; norm represents the normalization function; T represents the number of time periods between the Ath user's registration time and time period t; F represents the variance of the dwell time of all ads accessed by the Ath user within time period t; D represents the average dwell time of all ads accessed by the Ath user within time period t; and L represents the number of ads accessed by the Ath user within time period t. Let R represent the average interval time when user A visits the i-th advertisement within time period t, and let R represent the average of the average interval time when user A visits each of the same advertisements within time period t.

7. The method for detecting abnormal traffic in internet advertising as described in claim 6, characterized in that, If the number of time intervals between the registration time of user A and the time interval t is greater than the preset number, then the preset number will be assigned to that number.

8. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The second outlier in the target ad traffic is calculated using the following formula: ;in This indicates the second outlier in the target ad traffic over time period t. This represents the first outlier in the target ad traffic over time period t, where norm represents the normalization function. This indicates the frequency of the target ad being viewed within the time period t. This represents the user behavior anomaly value of the Ath user who accessed the target advertisement within the time period t.

9. The method for detecting abnormal traffic in internet advertising as described in claim 1, characterized in that, The process of constructing a traffic judgment threshold based on the second outlier values ​​within all historical collection periods to determine whether there are abnormal advertising traffic during the current analysis period includes: The minimum value of the second outlier in the target ad traffic across all historical collection periods within the same time period is selected as the traffic judgment threshold for that time period. If the second outlier of the target ad traffic in the current analysis period is greater than the traffic judgment threshold for the corresponding period, then the ad traffic in the current analysis period is abnormal.

10. An internet advertising abnormal traffic detection system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements a method for detecting abnormal traffic in internet advertising as described in any one of claims 1-9.

Images