Wireless Signal Context Analysis for Human Device Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to accurately distinguish between human-operated mobile devices and fraudulent ones, such as bots or install farms, due to vulnerabilities in GPS spoofing, VPN usage, and IP blacklists, leading to false positives and inability to validate legitimate human usage.
Innovation Solution
A fraud-detection system that analyzes wireless signal contexts, including WiFi, Bluetooth, and Bluetooth Low Energy signals, to identify patterns of human behavior by generating signal clusters and applying a pipeline of classifiers to determine if a mobile device is operated by a human user, effectively differentiating between human and non-human usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If GPS location data is analyzed to detect fraudulent installs, then location spoofing can be detected, but false positives occur when users legitimately use VPNs or location spoofing apps
Solution Approach 1:
The system segments the fraud detection process into multiple independent classifiers that analyze different aspects of device behavior (signal context, GPS patterns, install timing, device characteristics). Each classifier operates independently and contributes to the overall fraud probability score, allowing nuanced differentiation between legitimate and fraudulent installs without false positives from single indicators
Solution Approach 2:
The system changes from analyzing single parameters (like GPS location alone) to analyzing multiple parameters simultaneously (signal context, GPS patterns, install timing, device characteristics). This multi-parameter approach transforms the detection methodology to achieve both precision and reliability by considering the combined pattern rather than isolated indicators
2Reliability
If IP blacklists are used to block fraudulent installs, then known fraud sources can be blocked, but blacklists are easily circumvented by attackers
Solution Approach 1:
The system performs preliminary analysis of device characteristics, signal context, and installation patterns before final validation. By establishing baseline expectations for legitimate device behavior in advance and comparing actual installs against these pre-established patterns, the system proactively identifies fraudulent installs rather than reactively blocking known sources
Solution Approach 2:
The system implements continuous feedback loops where classification results from multiple analyzers are aggregated and used to adjust fraud probability scores. This feedback mechanism allows the system to adapt to new fraud patterns dynamically, maintaining effectiveness against evolving attack methods without relying on static blacklists
3Measurement precision
If post-installation call-back messages are used to verify installs, then installation timing can be confirmed, but attackers can intercept and fraudulently send multiple copies of messages
Solution Approach 1:
The system introduces multiple intermediary verification layers including signal context analysis, device characteristic validation, and installation pattern recognition. These intermediaries act as additional verification points between the install event and final validation, making interception and spoofing significantly more difficult as attackers would need to compromise multiple independent verification mechanisms simultaneously
4Measurement precision
If existing fraud-detection tools analyze user location to identify spoofing, then location-based fraud can be detected, but false positives occur when users are using VPNs
Solution Approach 1:
The system segments location analysis from other verification methods, treating GPS location as just one of many independent factors. By separating location analysis from signal context analysis, device characteristic validation, and installation timing verification, the system can detect location anomalies without automatically flagging entire installs as fraudulent, reducing false positives from VPN usage
Data Source
AI summary
Disclosed herein are embodiments of systems, methods, and products comprising an analytic server, which builds a pipeline of five classifiers to validate whether an electronic device is operated by a human user. The server monitors wireless signals detected by different electronic devices by triggering a signal scanning function on the electronic devices. Based on the wireless signals reported by different electronic devices, the server generates a set of signal clusters. The server applies the pipeline of five classifiers on the wireless signals detected by an electronic device by exploiting the signal clusters included in the wireless signals. If any of the classifiers determines the electronic device is a legitimate human device, the server validates the electronic device; otherwise, the server applies the next classifier. If after a number of classifiers, none of the classifiers validates the device usage, the server determines that the device is not operated by a human.