Fraud – the game of cat and mouse

Looking into the crystal ball as we all like to do at this time of year, it would be a welcome festive gift to report that online fraud has been conquered, and that advertisers can rest easy that their ads are being viewed only by humans and not by bots.

Fraud can cost advertisers billions of their digital ad spend annually, and as such the online advertising industry is on a mission to uncover fraudulent activity. However, both buy and sell sides of the industry are benefitting from the new technologies that make it easier for fraudsters to hide.

When we talk about bots it might, in some quarters, conjure up a post-apocalyptic image of T-900 terminators roaming through the Internet. Bots, robots, are in effect, sophisticated computer programs hiding on a computer, carrying out automated instructions – like generating fake traffic to websites – controlled via a human mastermind.

Computers are typically infected with bots through malware, hiding in the software you knew you shouldn’t have clicked on or downloaded, but did anyway.  Bots run in the background of a computer and usually remain undetected by a user. We frequently hear from publishers that they are not affected by fraud but their premium-nature makes them lucrative targets; that said, they are less prone to attract fraudulent activity than networks and exchanges, where less human eyeballs are present to pick up suspicious irregularities.

Bots siphon off money from advertising by surfing the web, in order to generate fake traffic, but they don’t do that by opening a new tab in your browser, something a user would probably notice. Instead, the bots are ordered to access your web browser without the graphical interface, such as Chrome, or Firefox that you and I use to click on and navigate.  To a website, whether by browser or simply a ‘visit’ this makes no difference. The bot still visits websites where it is ‘shown’ ads and ‘clicks’ on links, and might even put things in its shopping cart.  The bot operators evolve and refine their techniques to avoid discovery.

Bots will fail the Turing test

Bots obviously have every reason to remain undetected to attract as much advertising spend as possible. The best way to achieve this is to appear as human-like as possible.  So, logically to be able to identify bots, we need to ask the right questions to reveal their non-human qualities.

The brilliant mathematician and creator of modern computing Alan Turing argued that if a computer can convince or fool a number of humans into believing it is intelligent, then it must be intelligent.

Obviously, we can’t ask bots literal questions but we can probe its behaviour.  One of the key human trait indicators is sleep, which usually occurs at predictable times. On the other hand, bots have no need for sleep. That means an ‘always on’ activity pattern can be indicative of bot traffic. This isn’t as obvious as one might think, since bots typically piggy-back a computer used by a human, as soon as the human turns off the computer (to sleep) the bot can no longer operate.  Many of these suspicious signals by themselves are not absolute indicators of fraudulent activity but combined they have strong predictive power in identifying bots.

Rather than expose every single bot, and prevent it from being served impressions; we can identify co-ordinated behaviour among the bots in their browsing patterns. Usually, this reveals clusters of websites that are used by the bots to generate traffic. By labelling these websites as fraudulent and giving them a low ranking in our ratings – our True Advertising Quality (TRAQ) score acts similar to a credit rating system – advertisers will reduce or even stop serving impressions on these websites. Additionally, through diverting impressions away from these fraudulent websites, we essentially chip away at the bot owners’ business model. A logical step for them is to set up a new cluster of websites for the bots to visit, but we will just as quickly label them as fraudulent. And setting up new websites takes time, money and effort. And so the game of cat and mouse is established.

But truly how big of a problem is advertising fraud in the UK? In our latest media quality report, ad fraud impacted 9.1% of UK ad impressions during Q3 2015.  This figure increased when looking at impressions sourced via networks or exchanges; where fraudulent activity rose to 10.5%. When looking at publisher direct deals however, we saw that ad fraud levels decreased to only 4.2%.

Fraud can only exist as long as it profitable. If the metric of success in the digital advertisement ecosystem is changed from merely showing an impression to showing impressions that had a measurable effect on the viewer’s behaviour, the activity will stop being lucrative and bots will cease to be a useful tool.

Ad fraud is an ever-changing landscape but continued vigilance of fraudsters will ensure it is possible to stay ahead of the game.

Read the article here.