better media means better outcomes by augustine fou

Better Media Means Better Outcomes

April 2017Augustine Fou, [email protected] 212. 203 .7239

mailto:[email protected]

“Are you buying ‘traffic’ or ‘inventory’? There’s plenty of

that … at low cost, even.”

“Real human audiences are scarce and valuable.”

Case Examples for Advertisers

April 2017 / marketing.scienceconsulting group, inc.

linkedin.com/in/augustinefou

Reduce bots/NHT in display campaignsPeriod 1 Period 3Period 2

Initial baseline measurement

Measurement after first optimization

Eliminating several “problematic” networks



Improve outcomes by shifting spendMeasure

AdsMeasure Arrivals

Measure Conversions

clean, good media

low-cost media, ad exchanges

346

1743

5

156

30X better outcomes

• More arrivals• Better quality

A

B



Make analytics more accurate and clean

7% conversion rate 13% conversion rateartificially low actually correct



Assess “humanness” of media channels

Organic sources have more humans (dark blue)

Conversion actions (calls) are well correlated to humans



Higher quality means lower cost per human

Lower quality paid sources mean higher cost per human – like 11X higher cost.

Sources of different quality send widely different amounts of humans to landing pages.

Ad Fraud Background



Digital ad fraud is profitable and scalable

Source: https://hbr.org/2015/10/why-fraudulent-ad-networks-continue-to-thrive

“the profit margin is 99% … [especially with pay-for-use cloud services ]…”

“highly lucrative, and profitable… with margins from 80% to 94%…”

“why stop at 10 ads on the page; why

not load 13,000 ads on the page”

131 ads on pageX

100 iframes=

13,100 ads /page

Source: Digital Citizens Alliance Study, Feb 2014

https://hbr.org/2015/10/why-fraudulent-ad-networks-continue-to-thrive

https://media.gractions.com/314A5A5A9ABBBBC5E3BD824CF47C46EF4B9D3A76/4af7db7f-03e7-49cb-aeb8-ad0671a4e1c7.pdf



Example – 92% of impressions cleaned

Increased CPM prices by 800%

Decreased impression volume by 92%

Source: http://adexchanger.com/ad-exchange-news/6-months-after-fraud-cleanup-appnexus-shares-effect-on-its-exchange/

260 billion

20 billion

> $1.60

< 20 cents



Methbot stayed hidden for years

Source: Dec 2016 WhiteOps Discloses Methbot Research

“the largest ad fraud discovered to date, a single botnet, Methbot, steals $3 - $5 million per day, $2 billion annualized.”

1. Targets video ad inventory$13 average CPM, 10X higher than display ads

2. Disguised as good publishersPretending to be good publishers to cover tracks

3. Simulated human actionsActively faked clicks, mouse movements, page scrolling

4. Obfuscated data center originsData center bots pretended to be from residential IP addresses

http://www.whiteops.com/METHBOT





Where is Ad Fraud Concentrated?



CPM/CPC (91% of spend) is most targeted

Impressions(CPM/CPV)

Clicks(CPC)

Search27%

91% digital spend

Display10%

Video7%

Mobile47%

Leads(CPL)

Sales(CPA)

Lead Gen$2.0B

Other$5.0B

• classifieds• sponsorship• rich media

(89% in 2015)Source: IAB 1H 2016 Report

(86% in 2014)



Two key ingredients of CPM and CPC FraudImpression (CPM) Fraud

(includes mobile display, video ads)

1. Put up fake websites and load tons of ads on the pages

Search Click (CPC) Fraud

(includes mobile search ads)

2. Use fake users (bots) to repeatedly load pages to generate fake ad impressions

1. Put up fake websites to participate in search networks

2. Use fake users (bots) to type keywords and click on them to generate the CPC revenue

screen shots of fake sites

Fake Websites(cash-out sites)



99% human pageviews on “sites you’ve heard of”

100% botpageviews on

“fraud sites”

99% of human pageviews are on

“sites you’ve heard of”

“real content that real humans want to read”

WSJESPN

NYTimesReuters

CBSSports

1% of human pageviews are on

“long tail sites”

“niche content that some humans want

to read”

top 1 million sitesnext 10 million sites318 million sites

Verisign reports 329 million domains registered by Q4 2016Source: http://www.verisign.com/en_US/domain-names/dnib/index.xhtml



Countless fraud sites made by template

100% bot

Fake Visitors(bots)



Bots are automated browsers used for ad fraud

Headless BrowsersSeleniumPhantomJSZombie.jsSlimerJS

Mobile Simulators35 listed

Bots are made from malware compromised PCs or headless browsers (no screen) in datacenters.

Bots

http://www.mobilexweb.com/emulators



Bots range in sophistication, and therefore cost

Javascript installed on webpage

Malware on PCsData Center BotsOn-Page BotsHeadless browsers

in data centersMalware installed on

humans’ devices

Less sophisticated Most sophisticated

Source: AdAge/Augustine Fou, Mar 2014 Source: Forensiq Source: Augustine Fou, Oct 2015

“the official industry lists of bots catch NONE of these bots”

1 cent CPMsLoad pages, click

10 cent CPMsFake scroll, mouse movement, click

1 dollar CPMsReplay human-like mouse movements, clone cookies

http://adage.com/article/digital/bots-scam-advertisers-pretending-human/293428/

http://adage.com/article/digital/bots-scam-advertisers-pretending-human/293428/

http://www.slideshare.net/augustinefou/digital-ad-fraud-ecosystem

“The equation of ad fraud is simple: buy traffic for $1 CPMs, sell ads for $10 CPMs; pocket $9 of pure profit.”



How Ad Fraud HarmsAdvertisers



Messes up your analytics

click on links

load webpages tune bounce rate

tune pages/visit

“bad guys’ bots are advanced enough to fake most metrics”



Messes up your KPIsProgrammatic display

(18-45% clicks from advanced bots)Premium publishers(0% clicks from bots)

0.13% CTR(18% of clicks by bots)



Campaign KPI: CTRs



Fake clicks mess up CTRsLine item details

Overall average 9.4% CTR

“fraud hides easily in averages”



Fake demographic information



Fake languages declared by bots



Want 100% viewability? 0% NHT (bots)?

Bad guys cheat and stack ALL ads above the fold to make 100% viewability.

“100% viewability? Sure, no problem.”

AD • IAS filtered traffic, • DV filtered traffic• Pixalate filtered traffic, • MOAT filtered traffic, • Forensiq filtered traffic

“0% NHT? Sure, no problem.”



Bot activity has higher signal“Humans are hard to predict …

… but bots give you beautiful signals.”

Source: Claudia Perlich, PhD. Data Scientist, Dstilllery

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=&url=http://www.marketsmithinc.com/2013/08/advertisers-guide-to-avoiding-fake-web-traffic-bot-prevention-basics/&bvm=bv.103627116,d.cWw&psig=AFQjCNHfTnJhIo8xATsuYHSUpcQgH15fkQ&ust=1443703052902546

Current State of NHT Detection



Fraud bots are NOT on any list

user-agents.org

bad guys’ bots

2% and “on the wane”Source: GroupM, Feb 2017

bot list-matching

4% Source: IAB Australia, Mar 2017

400 bot names in list

“not on any list”disguised as popular browsers – Internet Explorer; constantly

adapting to avoid detection

10,000bots observed

in the wild

http://www.mediapost.com/publications/article/294527/groupm-marketers-ignore-ai-at-their-peril-ad-fra.html

http://www.mediapost.com/publications/article/294527/groupm-marketers-ignore-ai-at-their-peril-ad-fra.html

https://mumbrella.com.au/ad-fraud-real-problem-publishers-brands-agencies-tell-iab-429978



Limitations due to where measurement is done

In-Ad (ad iframes)

On-Site (publishers’ sites)

• Used by advertisers to measure ad impressions

• Limitations – tag is in foreign iframe, cannot look outside itself

ad tag / pixel(in-ad measurement)

javascript embed(on-site measurement)

In-Network (ad exchange)

• Used by publishers to measure visitors to pages

• Limitations – most detailed and complete analysis of visitors

• Used by exchanges to screen bid requests

• Limitations – relies on blacklists or probabilistic algorithms, least info

ad served

bot

human

fraud site

good site



In-ad measurements could be entirely wrong

Publisher Webpagepublisher.com

Foreign Ad iFramesadserver.com

Cross-domain (XSS) security restrictions mean iframe cannot:• read content in parent frame• detect actions in parent frame• see where it is on the page

(above- or below- fold)• detect characteristics of the

parent page

1x1 pixeljs ad tags ride along

inside iframe

incorrectly reported as 100% viewable

parent frameforeign iframes



10% bots doesn’t mean 90% humans

volume bars (green)

Stacked percentBlue (human)Red (bots)

red v blue trendlines

“Some of the data is simply not measurable – e.g. the white is not measurable, and gray is ‘not enough info’.”

“Fraud detection that only reports bots is telling half the story.”

“Having fraud DETECTION is not the same as having fraud PROTECTION.”

What about Mobile?

“it’s more lucrative and less measurable… hmm, what do you think?”



Bad acting apps load more ad impressionsApp Name

Source: Forensiq



Fake mobile devices from data centers do thisDownload and Install

Launch and Interact

“do you think bad guys install fraud detection SDKs in their apps?”

“No. Your CPI campaigns are not immune to fraud”

“it’s not lower in mobile, you just can’t measure it.”

“Let’s go fight some bad guys together!”



About the Author

April 2017Augustine Fou, [email protected] 212. 203 .7239

mailto:[email protected]



Dr. Augustine Fou – Independent Ad Fraud Researcher2013

2014

Follow me on LinkedIn (click) and on Twitter @acfou (click)

Further reading:http://www.slideshare.net/augustinefou/presentationshttps://www.linkedin.com/today/author/augustinefou

2016

2015

http://www.linkedin.com/today/author/augustinefou

http://twitter.com/acfou

http://twitter.com/acfou

http://www.slideshare.net/augustinefou/presentations

https://www.linkedin.com/today/author/augustinefou



Harvard Business ReviewExcerpt:

Hunting the Bots

Fou, a prodigy who earned a Ph.D. from MIT at 23, belongs to the generation that witnessed the rise of digital marketers, having crafted his trade at American Express, one of the most successful American consumer brands, and at Omnicom, one of the largest global advertising agencies. Eventually stepping away from corporate life, Fou started his own practice, focusing on digital marketing fraud investigation.

Fou’s experiment proved that fake traffic is unproductive traffic. The fake visitors inflated the traffic statistics but contributed nothing to conversions, which stayed steady even after the traffic plummeted (bottom chart). Fake traffic is generated by “bad-guy bots.” A bot is computer code that runs automated tasks.

better media means better outcomes by augustine fou

Marketing