A brief analysis of mobile Internet advertising fraud methods. How to prevent it?

1. Causes of Cheating

Here I would like to first explain the mobile advertising industry. Advertisers post links to their own brands on ad spaces on apps and settle accounts for the app’s ad spaces based on the proportion of user clicks or user activations after clicks (the activation behavior may be user registration, user generation of UGC , user consumption, or other activities, which require specific determination for different applications).

It seems that advertisers use "mobile advertising" to push their applications simply to achieve results in the rankings (clicks, downloads) and effects (activation, retention ). APP advertising space wants to realize more monetization, so cheating behavior comes into being.

Specifically, starting from 2013, the emergence of a large number of online money-making applications and the strong demand for App Store rankings have provided the most fundamental foundation for cheating. At the same time, the monitoring technology threshold for mobile advertising is high, the background data structure is cumbersome and complex, and there are many monitoring dimension indicators, which provide continuous development impetus for cheating behaviors derived from the mobile advertising process.

Types of Cheating

According to the two dimensions that advertisers are concerned about, clicks and activations, the types of cheating are also divided into these two types.

Click cheat

Click fraud is a relatively low-cost and easy method. It can usually be sent directly using a large number of test machines or simulators. Some methods also involve hiring or incentivizing users to make a large number of clicks. By analyzing the logs of click data, we can find several phenomena:

• IP dispersion is dense: Since cheating is done through simulators or hiring users to perform a large number of clicks, the same IP will repeatedly click on ads.
• Repeated time period: Similar to the principle of IP dispersion density, cheating users will frequently click on ads (send requests) within a fixed time period.

The following two phenomena are aimed at the large-scale use of simulators for click cheating

• Non-mobile terminals send messages as simulators: To save costs, on non-mobile terminals, many servers will be deployed on one computer to perform click cheating.
• Unable to obtain UA information of the mobile terminal: UA stands for User Agent, which is a special string header that enables the server to identify the operating system and version, CPU type, browser and version, browser rendering engine, browser language, browser plug-in, etc. used by the client.

Activate cheats

In addition to clicks, the effectiveness of mobile advertising lies more in performance data, namely subsequent activations. Some common methods are consistent with click cheating methods, such as simulating downloads on test machines or simulators, modifying device information through mobile manual or technical means, cracking SDK to send virtual information, simulating download activation, etc.

The phenomenon of activation cheating also includes:

• IP dispersion is dense
• Time cycle repetition
• Simulator Send
• The attribution time difference is illogical: Under normal circumstances, users need to read and understand the content from clicking on the ad to activating the ad, which takes a certain amount of time. If this time is too short, we can consider it an abnormality.

3. Prevention of Cheating

Click cheat

Before we sort out the methods of click fraud protection, let’s first list some important indicators.

Click-through rate = Number of clicks / PV

Click-through rate is a key method to determine whether there is click cheating. If the click-through rate of a website's advertisements is too high, it can be directly judged as cheating.

Click rate/click rate of a single IP

If this value is too high, probably greater than 3, we can assume that the user with this IP value may have click cheating.

There are several ways to prevent click fraud:

• Cookie deduplication: a solution based on local cookies. Cookies will record user information. When users request data, you can call the user's cookies first to prevent the same device from clicking on the same ad multiple times.
• IP prevents cheating: When brushing clicks, it is definitely not just the same device that is used, so in addition to Cookie deduplication, it can also be deduplicated based on IP.
• Abnormal data blacklist: For IP addresses that appear repeatedly, we need to perform blacklist management and add those IP addresses that frequently increase clicks to the blacklist.

Activate cheats

• Activate IP deduplication: Similar to clicks, multiple activations of the same IP segment should also be marked as abnormal activations.
• Attribution time difference cheating: Attribution time difference refers to the time from click to download activation. Under normal circumstances, it takes a certain amount of time for users to read and understand the content from clicking on the ad to activating the ad. If this time is too short, we can consider it an abnormality.
• SDK encryption protection: Encrypt the SDK for transmission and activation to increase the cost of cracking cheating.

Association cheating

Simply put, users who are marked as click cheaters may also be abnormal in activation cheating. Such association allows us to more easily detect potential cheating users. Linking click fraud with activation fraud is also an effective protective measure.

IV. Future development direction of anti-cheating

Anti-fraud prediction analysis model combined with big data

To give a simple example, two important indicators of an advertisement, clicks and activations, are under the same process. The user sees the ad on the website, clicks on the traffic , finds interest, and activates it. The user traffic is successfully transferred from the website's ad space to the advertiser's application. Under normal circumstances (no cheating), the entire process will take some time from the time a user clicks on an ad to the time the activation is completed. Just now we discussed this overall situation for too short a time, and it may be considered cheating. This is a micro-level view of this data indicator.

From a macro perspective, the overall time should follow a mathematical distribution. We can detect abnormal areas based on this mathematical distribution model. For example, during the period from August 1 to August 22, there is an IP segment (because cheating is an organized behavior, it may appear regularly in a certain IP segment rather than a single IP) whose model distribution does not match the normal model. We can then detect this network segment and discover the cheating organization.