Cost Control

How Cost Control Works

Incoming Ad Click → [+ Data Collection] → [± Rule Engine] → [? Analysis] → [✓ Legitimate] → Ad Display
                                │              │             └─→ [✗ Fraudulent] → Block & Log
                                │              └─→ Behavioral Scoring
                                └─→ IP, User Agent, Timestamp

🧠 Core Detection Logic

Example 1: IP Address Velocity Capping

This logic prevents a single source from depleting an ad budget through rapid, repeated clicks. It operates at the traffic entry point by tracking the number of clicks from each IP address within a specific time frame and blocking any that exceed a predefined threshold.

// Rule: Block an IP if it generates more than 5 clicks in 1 minute.
FUNCTION on_click(request):
  ip = request.get_ip()
  timestamp = get_current_time()

  IF click_log.count(ip, within_last_minute) > 5 THEN
    BLOCK_TRAFFIC(ip)
    LOG_EVENT("Velocity_Fraud", ip)
    RETURN "blocked"
  ELSE
    RECORD_CLICK(ip, timestamp)
    RETURN "allowed"
  ENDIF

Example 2: Geo-Behavioral Mismatch

This logic identifies fraud by detecting inconsistencies between a user’s stated location (via IP geolocation) and their browser or device settings (e.g., language, timezone). It’s effective against bots trying to spoof their location to match campaign targets.

// Rule: Flag traffic if IP country does not match browser language.
FUNCTION on_click(request):
  ip_geo = get_geolocation(request.get_ip())
  browser_lang = request.get_header("Accept-Language")

  // Example: IP is from Germany, but browser language is Russian
  IF ip_geo.country != "Russia" AND browser_lang.starts_with("ru") THEN
    FLAG_FOR_REVIEW(request.get_ip(), "Geo-Mismatch")
    RETURN "suspicious"
  ELSE
    RETURN "allowed"
  ENDIF

Example 3: Session Engagement Scoring

This logic assesses the quality of a click by measuring post-click engagement. Low-quality traffic, such as from bots, often results in an immediate bounce (very short session duration). This rule helps filter out clicks that show no genuine user interest.

// Rule: Flag clicks with a session duration of less than 1 second.
FUNCTION after_click(session_data):
  session_id = session_data.id
  duration = session_data.end_time - session_data.start_time

  IF duration < 1000 THEN // less than 1000 milliseconds
    score = get_fraud_score(session_id)
    score.increase(50) // Increase fraud score
    LOG_EVENT("Low_Engagement", session_id, duration)
  ENDIF

📈 Practical Use Cases for Businesses

• Campaign Shielding – Automatically blocks clicks from known fraudulent sources like data centers and proxy networks, preserving the budget for genuine audiences.
• Lead Quality Assurance – Filters out bot-generated form submissions and sign-ups that originate from fraudulent clicks, ensuring the sales team receives clean, actionable leads.
• ROAS Optimization – Improves return on ad spend by preventing budget waste on traffic that has no chance of converting, allowing for more accurate performance metrics.
• Geographic Targeting Enforcement – Blocks clicks from outside a campaign's targeted regions, preventing budget drain from irrelevant locations and sophisticated location-spoofing bots.

Example 1: Geofencing Rule

A business targeting customers only in the United States uses this logic to block all traffic from other countries, protecting its budget from irrelevant international clicks.

// Logic: Allow traffic only from the specified country.
FUNCTION check_geo(request):
  allowed_country = "US"
  user_country = get_geolocation(request.ip).country

  IF user_country != allowed_country THEN
    BLOCK_CLICK(request.ip, "Geo-Block")
    RETURN False
  ELSE
    RETURN True
  ENDIF

Example 2: Session Scoring for Conversion Funnels

An e-commerce site uses session scoring to identify users who abandon their cart in under three seconds after clicking an ad, flagging them as low-intent or non-human traffic.

// Logic: Score sessions based on interaction with the conversion funnel.
FUNCTION score_session(session):
  IF session.path == "/checkout" AND session.time_on_page < 3 THEN
    user_profile = get_user(session.user_id)
    user_profile.fraud_score += 25
    LOG_EVENT("Checkout_Abandon_Bot_Pattern", session.user_id)
  ENDIF

🐍 Python Code Examples

This Python function simulates detecting abnormally high click frequency from a single IP address. It tracks click timestamps and flags an IP if it exceeds a defined threshold, a common sign of bot activity.

CLICK_LOGS = {}
TIME_WINDOW = 60  # seconds
CLICK_THRESHOLD = 10

def is_click_fraud(ip_address):
    import time
    current_time = time.time()
    
    if ip_address not in CLICK_LOGS:
        CLICK_LOGS[ip_address] = []
    
    # Remove clicks older than the time window
    CLICK_LOGS[ip_address] = [t for t in CLICK_LOGS[ip_address] if current_time - t < TIME_WINDOW]
    
    # Add current click
    CLICK_LOGS[ip_address].append(current_time)
    
    # Check if click count exceeds threshold
    if len(CLICK_LOGS[ip_address]) > CLICK_THRESHOLD:
        print(f"Fraud Detected: IP {ip_address} exceeded click threshold.")
        return True
        
    return False

# Simulation
is_click_fraud("192.168.1.10") # Returns False
for _ in range(12):
    is_click_fraud("192.168.1.10") # Will eventually return True

This example demonstrates filtering traffic based on a user agent string. The function checks if a user agent belongs to a known bot or a non-standard browser, helping to block automated traffic sources.

KNOWN_BOTS = ["Googlebot", "Bingbot", "DataCenterBrowser"]

def filter_suspicious_user_agent(user_agent):
    is_suspicious = any(bot_name in user_agent for bot_name in KNOWN_BOTS)
    
    if is_suspicious:
        print(f"Blocking suspicious user agent: {user_agent}")
        return True
    
    print(f"Allowing user agent: {user_agent}")
    return False

# Simulation
filter_suspicious_user_agent("DataCenterBrowser/1.0") # Returns True
filter_suspicious_user_agent("Mozilla/5.0 (Windows NT 10.0; Win64; x64)") # Returns False

Types of Cost Control

• Reactive IP Blocking

  This method involves identifying and blocking IP addresses after they have already demonstrated fraudulent activity. It is effective for stopping repeat offenders but does not prevent the initial fraudulent clicks.

• Proactive Signature-Based Filtering

  This approach uses a database of known fraudulent signatures, such as device fingerprints or bot user agents, to block traffic before it can click an ad. It is faster but less effective against new or unknown threats.

• Behavioral Analysis

  This type focuses on post-click user behavior, such as mouse movement, session duration, and page interaction. It distinguishes between human and bot-like patterns to score traffic quality but requires more data processing.

• Heuristic Rule-Based Filtering

  This involves setting up custom rules based on logical conditions, such as "block all clicks from outside a target country" or "flag clicks with abnormally high frequency." It offers granular control but requires manual setup and maintenance.