Click fraud botnet detection by calculating mix adjusted traffic value: A method for de-cloaking click fraud attacks that is resistant to spoofing

Click Fraud remains one of the most durable fraudulent schemes online. With 50 billion dollars being generated per year by Google alone, a fraudulent publisher is able to capture a significant amount of revenue with a small investment. The most well heeled click fraud attacks employ large distributed botnets, deceptive publisher pages, malware infection, and fake conversion “chaff” in an attempt to cloak fraudulent activity. We describe an algorithm that we call Mix Adjustment which corrects for traffic bias differences. The method is scalable and we show a simple implementation that can be applied to current weblog processing systems. We show two case studies of this algorithm on real fraud detection problems: (a) WOW Bot net detection, (b) Advertiser fraud detection.