Three ways to identify channel fraud from operational data!

2) Content value: For example, it generates positive and high-quality content, indirectly creates value, etc.

3) Communication value: for example, because of his/her communication, other users are prompted to use the product, etc.

4) Derivative value: length of stay or attention, advertising revenue, etc.

Each App is in a different industry, and these four values ​​have different emphases. But why do we, the App operator, never settle with the channel according to this logic, but instead negotiate and settle in the most deceptive way such as download and activation? This is another question, which we will discuss in another article.

Because the time window of activation as the settlement time node is too short for us, it brings huge challenges to distinguish the authenticity of users.

In the face of this huge challenge, different levels of cheating protection have emerged.

To quantify this level a little, it takes more than 7 days to detect cheating, and about 40% of fake users can be detected, but the fraud of more than half of the others cannot be ensured. In layman's terms, you know you have been cheated, but you don't know how much. Their methods generally go like this:

1. Look at the retention rate

Based on their long-term experience, they found that channels that increase traffic will choose to import user data at important time points such as the next day, 7 days, and 30 days. Then we found that the data of the App at key time points such as the next day, 7th day, and 30th day were significantly higher than those at other time points. The retention curve of real users is a smooth exponential decay curve. If they find that the retention curve has abnormal fluctuations with sharp rises and falls, it basically means that the channel has intervened in the data.

(II) View user terminal information

1) Ranking of low-priced devices: The device rankings of new users or startup users in the channel are analyzed based on experience. If they find that a low-priced device is ranked abnormally high, they will regard it as an anomaly and start to report it to the police.

2) The proportion of new versions of operating systems: After years of channel abuse, operators finally discovered that many channel-boosting studios have delays in adapting the operating system version. When viewing the operating systems of channel users, you can compare them with the distribution of operating systems of all mobile Internet users.

3) Usage of Wi-Fi network: for example, whether the usage ratio of 2G, 3G, and 4G is normal, etc.

(III) View extended information

1) The distribution and regularity of registered nicknames. Many low-end fake registered nicknames have strong regularity. All operators must have encountered such situations.

2) The distribution of the registered mobile phone numbers by location. I think you have all encountered this before. The mobile phone numbers of users coming from a certain channel are not only from a certain city of a certain operator, but they are even consecutive mobile phone numbers.

Summary: Operators in this realm rely heavily on personal experience, their tools and methods are unprofessional, their operations are inefficient, and they waste manpower and material resources. However, they discover problems late, and slightly more advanced cheating behaviors cannot be detected.

For players at this level, it takes about 2-7 days to distinguish the real from the fake, and the fake volume identified is about 40%-70%. In layman's terms, they can identify a large portion of fake users with a relatively certainty, and if the business conditions are good, the scope of losses can be controlled. The reason for this effect is that they adopted some professional means:

1. Single indicator

1) IP: whether it is a blacklist IP or a proxy IP, and compare it with a huge blacklist database;

2) IMEI: whether it is a blacklist IP;

3) Mobile phone number: whether the number is illegal or on the blacklist;

2. Group indicators

1) IP: Whether the geographical distribution of user IPs is consistent with the distribution of prior data, including the distribution of domestic provinces and overseas markets;

2) IMEI: Whether the geographical distribution of user IMEI numbers conforms to the distribution of prior data, and whether the distribution of manufacturers represented by IMEI is random;

3) OS: Check whether the distribution of the operating system version of the channel meets certain randomness and statistics, and compare and judge with previous prior data;

4) Model: whether the model distribution is consistent with the prior data and the proportion of the latest smartphone shipments;

5) Location information: The ratio of location information opening and the geographical distribution ratio of location information obtained are consistent with the distribution of prior data, the geographical situation promised by the channel, and the actual distribution of the application;

6) Operator: Is the data distribution of the operator random? Is it consistent with the normal distribution of domestic operators and the random distribution of overseas operators?

7) Network access method: whether the distribution ratio of Wi-Fi, 2G, 3G, and 4G maintains the same trend and data characteristics as the prior data;

3. Information consistency:

Verification of device consistency, including: CPU, manufacturer, Mac address, IMEI, model, and operating system consistency verification;

Generally speaking, general statistical analysis tools cannot achieve the above distribution, which requires the use of professional cheating protection software or security software.

Operators at this level have gotten rid of the stage of manual processing and reliance on personal experience, and have instead embarked on a professional route of algorithms and data. The problem is that each company’s algorithm capabilities and data accumulation vary widely, so the effects vary greatly. The channels, in turn, speculate on the strength of each operator’s capabilities and add different proportions of fake volume to them.

For players at this level, the time required to distinguish whether a user is genuine or fake ranges from 15 minutes to 30 minutes. If the time window is extended to 24 hours, their confidence will be even greater. So how do they do it? To sum it up in one sentence: use both soft and hard tactics, offense is the best defense!

1. Hard measures:

The so-called hard means are to work hard on the hardware on the user side. The SDK installed on the user's hardware device actively sniffs to detect changes in the hardware environment, abnormalities in the operating system environment, and whether various application interfaces have been hijacked. Get the status of the user's smart device at the first time. When the user's mobile phone hardware and system environment show abnormalities, all the user's data will be immediately and carefully reviewed in the background: 1) Track the status of the IP and port, as well as the historical behavior of the IP; 2) Track the correspondence between the IMEI and IMSI. IMEI and IMSI can basically be understood as the correspondence between a key and a lock. It is easy to forge an IMEI number, but if you want to forge it together with the IMSI, the cost becomes extremely high. The whole process can be controlled within 15-30 minutes, which creates a sufficient time window to compete with channels.

2. Soft measures:

Based on the second realm, they discovered through long-term data accumulation and research that the information fed back by each indicator has different strengths, so they assigned values ​​to all indicators and let these indicators cheat on the group of users. When the cumulative value exceeds the threshold, the user is declared a suspicious user. In this way, additional judgment on the authenticity of the user can be completed within 24 hours.

To reach this level, not only long-term accumulation of large amounts of data and updates that keep pace with the times are required, but also powerful data processing algorithms and technical capabilities that cover both software and hardware. (over)