Systems, methods, and media for detecting suspicious activity

• US 10,387,911 B1
• Filed: 06/03/2013
• Issued: 08/20/2019
• Est. Priority Date: 06/01/2012
• Status: Active Grant

• Current Assignee: Integral Ad Science Incorporated (Integral Ad Science Holding Corp.)
• Original Assignee: Integral Ad Science Incorporated (Integral Ad Science Holding Corp.)
• Inventors: Shaw, Jason Lloyd, Luttrell, David William, Ahuja, Arun
• Primary Examiner(s): Hamilton, Matthew L
• Application Number:
  US13/909,018
• Time in Patent Office: 2,269 Days
• Field of Search: 705 14
• CPC Class Codes: G06Q 30/0248 Avoiding fraud

Abstract

Systems, methods, and media for detecting suspicious activity in connection with advertisement impressions are provided. In some embodiments, the method includes: collecting advertisement impression information associated with a plurality of pages; determining, from the collected advertisement impression information, an indication of whether a browser application detected that an advertisement displayed on a webpage was viewable in a browser window; determining, from the collected advertisement impression information, a plurality of viewability statistics for each of the plurality of pages, wherein each viewability statistic indicates a likelihood of whether an advertisement displayed on a webpage was viewable in a browser window; comparing the plurality of viewability statistics with the indication from the browser application; determining a viewability score for the advertisement impression based on the comparison; and identifying the advertisement impression as likely to be suspicious based on the determined viewability score.

Claims

1. A method for detecting suspicious activity from a plurality of websites, the method comprising:

collecting, by a server that includes a hardware processor, advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculating, by the hardware processor, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregating, by the hardware processor, the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculating, by the hardware processor, a domain-level never-in-view statistic in response to the aggregating;

classifying, by the hardware processor, the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determining, by the hardware processor, additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generating, by the hardware processor, a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibiting, by the hardware processor, inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.

2. The method of claim 1, further comprising transmitting information relating to the potentially suspicious domain that inhibits an advertiser from associating with the potentially suspicious domain.

3. The method of claim 1, wherein the never-in-view statistic comprises a fraction of advertisement impressions that was never in the viewable area of the browser window.

4. The method of claim 3, wherein the domain is classified as the potentially suspicious domain based on the domain-level never-in-view statistic further comprises determining that the domain-level never-in-view statistic exceeds a selected threshold value, wherein the selected threshold value indicates that the domain is engaging in suspicious activity.

5. The method of claim 1, further comprising:

generating a distribution of spoofing rates associated with the collected advertisement impression information;

dividing the generated distribution of spoofing rates into a first sub-distribution of normal websites and a second sub-distribution of suspicious websites using a mixture model, wherein the domain is classified as the potentially suspicious domain based on relative strength between the first sub-distribution and the second sub-distribution.

6. The method of claim 1, further comprising:

determining a plurality of browsers associated with advertisement calls for one or more advertisement impressions from the collected advertisement impression information.

7. The method of claim 1, further comprising:

extracting identification data associated with the potentially suspicious domain;

searching for other websites having identification data that is similar to the extracted identification data; and

determining whether at least one of the other websites should be deemed as likely to be suspicious.

8. The method of claim 1, further comprising:

receiving training data;

identifying features for differentiating suspicious websites from normal websites using the received training data; and

identifying the suspicious websites from the plurality of pages associated with the collected advertisement impression information using a classifier with the identified features.

9. A system for detecting suspicious activity from a plurality of websites, the system comprising:

a memory; and

a hardware processor that, when executing computer-executable instructions stored in the memory;

collects advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculates, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregates the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculates a domain-level never-in-view statistic in response to the aggregating;

classifies the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determines additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generates a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibits inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.

10. The system of claim 9, wherein the hardware processor transmits information relating to the potentially suspicious domain that inhibits an advertiser from associating with the potentially suspicious domain.

11. The system of claim 9, wherein the never-in-view statistic comprises a fraction of advertisement impressions that was never in the viewable area of the browser window.

12. The system of claim 11, wherein the hardware processor determines that the domain-level never-in-view statistic exceeds a selected threshold value, wherein the selected threshold value indicates that the domain is engaging in suspicious activity.

13. The system of claim 9, wherein the hardware processor:

generates a distribution of spoofing rates associated with the collected advertisement impression information;

divides the generated distribution of spoofing rates into a first sub-distribution of normal websites and a second sub-distribution of suspicious websites using a mixture model, wherein the domain is classified as the potentially suspicious domain based on relative strength between the first sub-distribution and the second sub-distribution.

14. The system of claim 9, wherein the hardware processor:

determines a portion of the plurality of pages corresponding to a website;

determines one or more advertisements presented on the portion of the plurality of pages; and

determines a plurality of browsers associated with advertisement calls for one or more advertisement impressions from the collected advertisement impression information.

15. The system of claim 9, wherein the hardware processor:

extracts identification data associated with the potentially suspicious domain;

searches for other websites having identification data that is similar to the extracted identification data; and

determines whether at least one of the other websites should be deemed as likely to be suspicious.

16. The system of claim 9, wherein the hardware processor:

receives training data;

identifies features for differentiating suspicious websites from normal websites using the received training data; and

identifies the suspicious websites from the plurality of pages associated with the collected advertisement impression information using a classifier with the identified features.

17. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting suspicious activity from a plurality of websites, the method comprising:

collecting advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculating, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregating the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculating a domain-level never-in-view statistic in response to the aggregating;

classifying the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determining additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generating a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibiting inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.