Ad Server Fraud Detection via Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The online advertising industry faces challenges in distinguishing between genuine and fraudulent web traffic, with fake web pages, known as honeypots, artificially inflating traffic to deceive advertisers into purchasing unnecessary advertising space, leading to financial losses for both web pages and advertisers.
Innovation Solution
An ad server analyzes user and web page traffic data, including IP addresses, cookies, and user agent information, to identify abusive users and honeypot web pages by generating metrics that indicate abnormal behavior patterns, allowing for the determination of confidence scores to differentiate between normal and abusive activities, thereby informing bidding decisions and data storage strategies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web pages collect and analyze user traffic data to identify fraudulent activities, then advertising spend is optimized and fraudulent revenue is reduced, but data storage costs and processing complexity increase
Solution Approach 1:
The patent segments the web traffic analysis system into multiple independent components: honeypot detection module, abusive user detection module, metric calculation module, and bidding decision module. Each component processes specific aspects of traffic data independently, allowing the system to scale without proportionally increasing overall complexity.
Solution Approach 2:
The system performs preliminary analysis by pre-identifying honeypot web pages and abusive users before advertising bids are made. Traffic patterns are analyzed in advance to establish baseline metrics and detect anomalies, enabling faster real-time bidding decisions without complex processing during the bidding moment.
2Measurement precision
If ad servers store and analyze detailed web traffic data for all users and pages, then fraudulent activities are detected more accurately, but data storage costs increase significantly
Solution Approach 1:
The patent extracts only the most relevant traffic data elements for fraud detection, such as user agent strings, referrer URLs, and specific interaction patterns, while discarding redundant information. This selective extraction maintains detection precision while significantly reducing the volume of data that needs to be stored and processed.
Solution Approach 2:
The system applies different data retention strategies to different types of web pages and users based on their fraud risk profiles. High-risk honeypot pages and suspicious users have their traffic data retained in detail, while normal traffic is aggregated or discarded, optimizing storage allocation according to local quality requirements.
3Reliability
If multiple metrics are calculated and combined to determine confidence scores for abusive users and honeypot pages, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent merges multiple individual metrics (traffic volume, user agent diversity, referrer patterns, interaction frequency) into composite confidence scores for both abusive users and honeypot pages. This consolidation maintains high detection accuracy by considering multiple factors while simplifying the final decision-making process through unified scoring mechanisms.
Solution Approach 2:
The system dynamically adjusts the weights and thresholds of individual metrics based on observed traffic patterns and emerging fraud techniques. By changing parameters such as metric importance weights and confidence thresholds, the system adapts to new fraud methods without requiring complete redesign of the metric calculation framework.
Data Source
AI summary
An ad server logs web traffic regarding web page traffic by users. The web traffic is analyzed to determine web activity indicating that a user is being paid to fake legitimate web traffic. These users are referred to as abusive users. The web traffic is also analyzed to determine web activity indicating that a web page is artificially boosting its own traffic in order to earn undeserved advertising revenue. These web pages are referred to as honeypot web pages. Scores are determined for both users and web pages, where the scores indicate the likelihood that the associated user or web page is an abusive user or a honeypot web page, respectively. The ad server uses these scores to determine an amount to bid on future impressions to those users and web pages.