Intent To Treat Analysis

How Intent To Treat Analysis Works

Visitor Arrives → [ Data Collection ] → [ Intent Analysis Engine ] → [ Risk Scoring ] ┐
      (User/Bot)          │                │                       │              │
                          │                │                       │              ├─→ [ Allow ] → Legitimate User
                          └────────────────┼───────────────────────┼──────────────┘
                                           │                       │
                                           └───────────────────────┼──────────────→ [ Block ] → Fraudulent Bot
                                                                   │
                                                                   └──────────────→ [ Flag/Monitor ] → Suspicious User

🧠 Core Detection Logic

Example 1: Behavioral Anomaly Detection

This logic focuses on how a user interacts with a page before clicking. It distinguishes between human-like randomness and the predictable patterns of a bot. This is critical for catching sophisticated bots that can mimic device and IP characteristics but fail to replicate natural user behavior.

function analyze_behavior(session) {
  // Rule 1: No mouse movement before click
  if (session.mouse_movements.count == 0 && session.time_to_click_sec < 2) {
    return "FRAUD";
  }

  // Rule 2: Perfectly linear mouse path
  if (is_linear(session.mouse_path)) {
    return "FRAUD";
  }

  // Rule 3: Instantaneous click upon page load
  if (session.time_to_click_sec < 0.5) {
    return "FRAUD";
  }

  return "LEGITIMATE";
}

Example 2: IP and User-Agent Congruity Check

This logic cross-references technical data points that fraudsters often manipulate. A bot might use a residential IP address from a proxy network but forget to spoof a corresponding common user-agent string. This check finds contradictions that expose the traffic as non-human.

function check_congruity(request) {
  ip_info = get_ip_data(request.ip); // Returns ISP, country, type (datacenter/residential)
  user_agent = parse_user_agent(request.user_agent);

  // Rule 1: IP from a known data center (server)
  if (ip_info.type == "datacenter") {
    return "BLOCK";
  }

  // Rule 2: User-agent is outdated or rare
  if (user_agent.is_rare || user_agent.is_outdated) {
    return "FLAG_FOR_REVIEW";
  }
  
  // Rule 3: Mobile user-agent but desktop screen resolution
  if (user_agent.is_mobile && request.screen_resolution > "1920x1080") {
    return "BLOCK";
  }

  return "ALLOW";
}

Example 3: Click Velocity and Frequency Analysis

This logic tracks the rate and timing of clicks originating from a single source (like an IP address) or targeting a single campaign. It's effective against click farms and botnets programmed to execute rapid, repetitive clicks to deplete an ad budget quickly.

function check_click_velocity(ip_address, campaign_id) {
  timestamp = current_time();
  
  // Get historical clicks from this IP for this campaign
  clicks = get_recent_clicks(ip_address, campaign_id, last_60_seconds);

  // Rule 1: More than 5 clicks in a minute
  if (clicks.count > 5) {
    add_to_blocklist(ip_address);
    return "FRAUDULENT_VELOCITY";
  }
  
  // Rule 2: Clicks are spaced exactly 10 seconds apart (programmatic)
  if (are_clicks_rhythmic(clicks, interval_sec=10)) {
    return "SUSPICIOUS_RHYTHM";
  }

  record_click(ip_address, campaign_id, timestamp);
  return "OK";
}

📈 Practical Use Cases for Businesses

• Campaign Shielding – Protects active pay-per-click (PPC) campaigns by analyzing traffic intent before a click is registered, preventing bots and competitors from exhausting the ad budget on fraudulent interactions.
• Analytics Purification – Ensures that marketing analytics and performance data are based on genuine human interest. By filtering out non-human traffic, businesses can make more accurate decisions based on real user engagement.
• Return on Ad Spend (ROAS) Optimization – Maximizes the effectiveness of the ad budget by ensuring that ads are shown primarily to legitimate potential customers. This directly improves ROAS by reducing wasted spend on clicks that have no chance of converting.
• Lead Generation Integrity – Safeguards lead generation forms from being flooded with fake submissions by bots. This ensures that the sales team receives qualified leads from real users, saving time and resources.

Example 1: Geofencing and Proxy Detection Rule

This logic prevents fraud from regions outside the campaign's target area and blocks users hiding their location behind proxies or VPNs, a common tactic for fraudsters.

FUNCTION evaluate_geo_traffic(user_ip, campaign_target_countries):
  user_location = get_geolocation(user_ip)
  is_proxy = check_proxy_status(user_ip)

  IF is_proxy:
    RETURN "BLOCK" # Block all proxy/VPN traffic

  IF user_location.country NOT IN campaign_target_countries:
    RETURN "BLOCK" # Block traffic from outside target countries
  
  ELSE:
    RETURN "ALLOW"

Example 2: Session Authenticity Scoring

This logic aggregates multiple risk signals during a user's session into a single score. If the score crosses a certain threshold, the user is deemed fraudulent and blocked before they can click on an ad. This provides a more nuanced approach than relying on a single data point.

FUNCTION calculate_session_score(session_data):
  score = 0
  
  // Check for known bot signatures in user agent
  IF contains_bot_signature(session_data.user_agent):
    score += 50
  
  // Check for robotic mouse movement (e.g., straight lines)
  IF has_robotic_movement(session_data.mouse_events):
    score += 30
    
  // Check if IP is from a known data center
  IF is_datacenter_ip(session_data.ip):
    score += 40

  // Decision based on score
  IF score >= 70:
    RETURN "FRAUDULENT"
  ELSE IF score >= 40:
    RETURN "SUSPICIOUS"
  ELSE:
    RETURN "GENUINE"

🐍 Python Code Examples

This function simulates checking a click's timestamp to detect abnormally high frequency from a single IP address. It's a simple way to identify and flag basic bots or manual fraud attempts designed to rapidly deplete an ad budget.

CLICK_HISTORY = {}
TIME_THRESHOLD_SEC = 5  # Min time between clicks
MAX_CLICKS_PER_MINUTE = 10

def is_click_frequent(ip_address):
    import time
    current_time = time.time()
    
    if ip_address not in CLICK_HISTORY:
        CLICK_HISTORY[ip_address] = []
    
    # Filter clicks in the last minute
    recent_clicks = [t for t in CLICK_HISTORY[ip_address] if current_time - t < 60]
    
    if len(recent_clicks) >= MAX_CLICKS_PER_MINUTE:
        return True # Too many clicks in the last minute
        
    if recent_clicks and (current_time - recent_clicks[-1]) < TIME_THRESHOLD_SEC:
        return True # Clicked too soon after the last one

    CLICK_HISTORY[ip_address].append(current_time)
    return False

This example demonstrates how to parse a user agent string to identify known suspicious patterns. This helps block traffic from non-standard browsers or known bot frameworks before they can generate fraudulent clicks.

def is_suspicious_user_agent(user_agent_string):
    # List of known bot-related substrings
    suspicious_signatures = ["bot", "spider", "headless", "phantomjs"]
    
    ua_lower = user_agent_string.lower()
    
    for signature in suspicious_signatures:
        if signature in ua_lower:
            return True
            
    # Check for empty or missing user agent
    if not user_agent_string:
        return True
        
    return False

# Example Usage
ua = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
print(f"Is suspicious: {is_suspicious_user_agent(ua)}")

This code analyzes a simplified list of mouse coordinates to detect inhuman, perfectly straight-line movements. Real user mouse movements have natural curves and variations, so this helps distinguish legitimate users from simple bots.

def has_robotic_mouse_movement(mouse_coordinates):
    # Expects a list of (x, y) tuples
    if len(mouse_coordinates) < 3:
        return False # Not enough data to analyze

    # Check if all points lie on the same line (simplified check)
    x0, y0 = mouse_coordinates
    x1, y1 = mouse_coordinates

    if (x1 - x0) == 0: # Vertical line
        for x, y in mouse_coordinates[2:]:
            if x != x0:
                return False # Not a straight vertical line
    else:
        slope = (y1 - y0) / (x1 - x0)
        for x, y in mouse_coordinates[2:]:
            # Check if the point satisfies the line equation y = mx + c
            if abs((y - y0) - slope * (x - x0)) > 1e-9: # Allow for small float inaccuracies
                return False # Point deviates from the line

    return True # All points are on a straight line

Types of Intent To Treat Analysis

• Heuristic-Based Analysis – This type uses a set of predefined rules to score traffic. For example, a rule might state that any visitor with a data center IP address and no mouse movement is fraudulent. It's fast and effective against known, simple fraud patterns.
• Behavioral Analysis – This method focuses on user actions, such as mouse dynamics, scroll speed, and time between events, to detect non-human patterns. It is particularly effective at identifying more sophisticated bots designed to mimic human technical attributes but failing to replicate natural, random behavior.
• Signature-Based Analysis – This approach checks visitor attributes against a known database of fraudulent signatures. These signatures can include malicious IP addresses, device fingerprints, or user-agent strings associated with botnets. It is excellent for blocking recognized threats quickly.
• Predictive Analysis – Leveraging machine learning, this type analyzes vast datasets of past traffic to build models that predict the likelihood of fraud from new, unseen visitors. It can identify emerging threats and complex fraud patterns that may not be caught by fixed rules or known signatures.