Publishers make a 70% cut on each click on their site

*Based on Interactive Advertising

Bureau Report, a consortium of

Online Ad Networks

Ads

impossible to know if particular click is genuine

security by obscurity

Researchers lack real attack data

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Published

Paper

Tech

Transfer

independently estimate

open (research) problem

six classes of sophisticated attacks

Release data

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Lots of clicks Lots of visits

How many ?

Random sample Fewer visits

Black box

Black Box

!

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

𝑥 =𝑔𝑑 𝑙𝑖 − 𝑙𝑖

′ 𝑑𝑑′

𝑛𝑑𝑔𝑖

“Loading …”, or “Click

to continue”

Fewer spammers.

Slightly fewer good

users.

Lots of clicks

Loading…

Bluff

Few clicks. Spammers and

(few) curious good users.

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

as advertisers for ten ad networks

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

0

0.25

0.5

0.75

1

1.25

A B C

Fra

ction

va

lid (

no

rm.)

celebrityyogalawnmower

Valid

Tra

ffic

Fra

ctio

n (

No

rmalize

d)

Ad Network’s Estimate Our Estimate

Ad Networks

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Manual Investigation

Identical sites!

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Arbitrage

Adult Parked

Malware

Browser specific filtering doesn’t work

Timing analysis doesn’t work

Threshold based filtering doesn’t work Onl

Signature Sustained clicks over multiple days

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

# Days Clicked in a Week

# U

sers

bing.com coolsearchnow.com meetgirlstonight.net

jjbargains.com

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Low page-rank, not malicious, no ads

No typos, no dates

Periodically reset

Cheap Ads! Page now full of (expensive) ads

Confused user clicks

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights

Published

Paper

Tech

Transfer

Detect

Click-

Fraud

Gain

Insights

BingAds

Log Data

Catch

Click-

Fraud

Tech

Transfer

Detect

Click-

Fraud

Gain

Insights

BingAds

Log Data

Catch

Click-

Fraud

Tech

Transfer

Detect

Click-

Fraud

Gain

Insights

BingAds

Log Data

Catch

Click-

Fraud

Tech

Transfer

Detect

Click-

Fraud

Gain

Insights

BingAds

Log Data

Catch

Click-

Fraud

Tech

Transfer

1. General Insight

2. Adaptive adversary

3. Algorithm public

independently estimate

open (research) problem

six classes of sophisticated attacks

Release data

BingAds

Log Data

Collect

Clean

Data

Catch

Click-

Fraud

Detect

Click-

Fraud

Gain

Insights