Prevention methods for click fraud on advertisemen

Question

How can I prevent from abusing by over clicking my ads...or using an automated system, or an iframe with the ad url to inflate the clicks.

I was wondering having the following in place but I was wondering what more can I add and how.

1). Encrypt each ad id and bind the encryption with time, so if the click is within a time limit then approve the click. However there are about 20 ads placeholders shown on some websites at once, so the encryption may be slowed down. Also what sort of encryption can I use? something that can be decrypted or validated within the time limit of the generation of the encrypted link. Also the encryption needs to be very fast. decryption can be a bit slower. For every request there need to be about 20 encryptions on average and there are about 1000 peak requests per second so you can get the picture.

2). Having cookies generated by JavaScript and which means that the ad must have most likely been seen and then clicked on. However the frauds may open the ads in an iframe and then open a link to the ad randomly, which will the clicks look authentic. So are there any improvements that can be made here?

3)Another one was to make sure that if the ad link was opened in an iframe then use the iframe breaking script.

4) Any other suggestions...You can also say the methods used by the advertisers such as adsense but please only keep them relevant to the scale of my situation as it is not even 1% of that of the adsense. I am using a php/mysql/javscript/ajax/json based system.

Answer 1

Protection has to be mainly on the server; anything on the client (browser) is too easily compromised.

Start by do something slightly differently from everyone else. If I were doing this I'd use an image map to partition the image up into 10 (or more) sections and measure the average click frequency of each section. You can use this data to statistically weight the probability that this is a real click based on other clicks. Possibly partition off 0,0 and the extremities.

Also I'd protect this largely on the server by serving up each ad with a unique tracking id and correlating this (on the server) to allow the following to be monitored:

1. IP Address - obviously if ads come from the same IP or a lot come from a similar GeoIP (use the GeoLite City.
2. Measure the Click Through Rate (CTR). Usual CTR should not exceed 10%. Usual CTR should ranges from 0.5% to 10%.
3. Set cookies to track the browser.
4. Monitor click patterns, suspicious when a click results too soon after page load - so track the time of ad serving and if a click is too soon flag this. Usually genuine clicks will happen after a person has had time to digest the content.
5. Check referrers - very few sites will come from a direct type in with no referrer.

I'd resist the temptation to do too much on the client side as it's far to visible and easier to compromise.

Once you've implemented the above it should be used to produce reports that allow a person to asses the possibility of click fraud, any automated system will never be as good at spotting patterns.

Also worth reading White Paper: ClickTracks Analytics Inc. ClickTracks Approach to Click Fraud Analysis

Answer 2

You have the following choices that you can follow:

For each ad id you can generate a time based encryption. So for example encrypt time with a secret passphrase and then decrypt it with that secret passphrase later.

You can use a public key and private key approach.

You can have a two tier system where an ad is clicked the click is validate to see if it is being loaded in an iframe or if that window is active.

Another method is to look at the transactions that take place. if the visitor has clicked the ad and then look at how many actually reach the destination and for how long.