Daily active users

How Daily active users Works

Incoming Traffic (Clicks/Impressions)
         │
         ▼
+---------------------+      +---------------------+      +---------------------+
│   Data Collection   │ ---> │  User Aggregation   │ ---> │   DAU Monitoring    │
│ (IP, UA, Timestamp) │      │ (Group by User ID)  │      │ (Establish Baseline)│
+---------------------+      +---------------------+      +---------------------+
         │                                                        │
         │                                                        ▼
         └───────────────────────────┐                +---------------------+
                                     │                │   Anomaly Detection │
                                     ▼                │  (Spikes, Geo, etc) │
                           +---------------------+      +---------------------+
                           │  Behavioral Analysis│      │     Scoring &       │
                           │  (Session, Events)  │ ---> │     Flagging        │
                           +---------------------+      +---------------------+
                                                                  │
                                                                  ▼
                                                          +---------------------+
                                                          │ Action/Alert      │
                                                          │ (Block, Review)   │
                                                          +---------------------+

In digital advertising security, analyzing Daily Active Users (DAU) is a critical method for identifying fraudulent activity. By establishing and monitoring a baseline of normal daily user engagement, security systems can effectively detect anomalies that often signal bot attacks or coordinated invalid clicks. This process involves collecting detailed data, analyzing user behavior in aggregate, and applying rules to flag suspicious deviations from the norm.

Data Collection and Aggregation

The process begins by collecting raw data from every user interaction, such as ad clicks or impressions. Key data points include the user’s IP address, user agent (UA) string, and the event timestamp. This information is then aggregated to identify unique users. By grouping events by a unique identifier (like a user ID, cookie, or device ID), the system can count the number of distinct users engaging with the platform each day to calculate the DAU.

Baseline Monitoring and Anomaly Detection

Once DAU is calculated, it is tracked over time to establish a predictable baseline of user activity. Fraud detection systems monitor for significant deviations from this baseline. For example, a sudden, massive spike in DAU that doesn’t correspond with a marketing campaign or known event is a major red flag for a bot attack. Similarly, an unusual increase in users from a specific geographic location where the business does not operate can also indicate fraud.

Behavioral Analysis and Scoring

Beyond just counting users, systems analyze the behavior of these daily active cohorts. Metrics such as session duration, conversion rates, and bounce rates are examined. If a surge in DAU is accompanied by near-zero session times and a 100% bounce rate, it strongly suggests the new “users” are bots that click an ad and immediately leave. Based on these anomalies and behavioral patterns, users or traffic sources are assigned a risk score. Traffic exceeding a certain threshold is flagged as fraudulent and can be automatically blocked or sent for manual review.

Diagram Element Breakdown

Incoming Traffic

This represents the raw flow of user interactions with an ad, such as clicks and impressions. It is the starting point for all fraud analysis.

Data Collection

This stage captures critical attributes for each interaction, including the IP address, User Agent (UA), and timestamp. This raw data is the foundation for identifying both unique users and behavioral patterns.

User Aggregation

Here, the system processes raw interaction data to count unique users within a 24-hour period. This count becomes the core Daily Active Users (DAU) metric.

DAU Monitoring

This component tracks the DAU metric over time to establish a normal, predictable pattern or baseline. This baseline is essential for identifying what constitutes an abnormal event.

Anomaly Detection

This logic-driven stage actively compares real-time DAU with the established baseline. It is programmed to identify statistical anomalies like sudden spikes, unusual geographic distributions, or mismatched traffic and conversion rates that suggest fraud.

Behavioral Analysis

This process examines what the aggregated users do after the initial click. It analyzes session durations, on-site actions, and conversion events to distinguish between legitimate user engagement and superficial bot activity.

Scoring & Flagging

Based on inputs from anomaly detection and behavioral analysis, this component assigns a risk score to users or traffic segments. High scores trigger a “fraud” flag.

Action/Alert

This is the final output of the system. Flagged traffic can be automatically blocked in real-time, or an alert can be sent to an administrator for further investigation. This protects ad budgets from being wasted on invalid traffic.

🧠 Core Detection Logic

Example 1: DAU Spike from New Geolocation

This logic identifies a sudden surge in daily active users originating from a geographic location that is not typically a source of traffic. It’s effective against botnets that use servers in specific, often unusual, countries to launch attacks. This check runs by comparing the daily user count per country against historical averages.

FUNCTION check_geo_dau_anomaly(today_dau_by_country, historical_avg_by_country):
  FOR country, daily_count IN today_dau_by_country.items():
    avg_count = historical_avg_by_country.get(country, 0)
    
    IF daily_count > (avg_count * 5) AND daily_count > 1000:
      // High confidence anomaly if count is 5x the average and over a minimum threshold
      FLAG_AS_FRAUD(country, "Unusual DAU spike")
    ELSE IF avg_count == 0 AND daily_count > 500:
      // Flag new countries with significant user counts
      FLAG_AS_FRAUD(country, "New significant DAU source")
  ENDFOR
END FUNCTION

Example 2: High DAU with Abnormally Low Session Duration

This heuristic flags traffic as fraudulent when a high number of daily active users corresponds with extremely short session durations. Legitimate users spend time on a site, whereas bots often “bounce” immediately after the click registers. This logic is crucial for detecting non-sophisticated bot traffic.

FUNCTION check_session_duration_anomaly(daily_active_users, avg_session_duration):
  
  // Historical average DAU is, for example, 10,000
  // Historical average session duration is, for example, 120 seconds
  
  IF daily_active_users > 20000 AND avg_session_duration < 5:
    // If DAU doubles but average time on site is less than 5 seconds
    TRIGGER_ALERT("High DAU, Low Engagement Anomaly")
    RETURN "FRAUD_DETECTED"
  ENDIF

  RETURN "NORMAL"
END FUNCTION

Example 3: Mismatched DAU and Conversion Rate

This logic detects fraud by identifying a major discrepancy between the number of active users and the conversion rate. If the DAU count triples overnight but the number of sign-ups or sales remains flat, it suggests the new users are not genuine and are likely bots with no purchase intent.

FUNCTION check_dau_conversion_mismatch(dau_today, conversions_today, dau_avg, conversion_avg):

  dau_increase_factor = dau_today / dau_avg
  conversion_change_factor = conversions_today / conversion_avg

  // If DAU increases by more than 100% (doubles)
  IF dau_increase_factor > 2.0:
    // But conversion rate change is minimal (e.g., less than 10%)
    IF conversion_change_factor < 1.1:
      // This indicates the new users are not converting, a strong sign of fraud
      MARK_TRAFFIC_AS_SUSPICIOUS("DAU spike without corresponding conversion lift")
    ENDIF
  ENDIF

END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding – Protects active advertising campaigns from budget drain by identifying and blocking traffic from sources that exhibit anomalous DAU spikes or suspicious behavioral patterns, ensuring ads are shown to real potential customers.
• Analytics Purification – Ensures marketing analytics are based on real human interactions by filtering out bot-driven traffic. This leads to more accurate metrics like conversion rate and customer lifetime value, enabling better strategic decisions.
• Return on Ad Spend (ROAS) Improvement – By preventing payment for fake clicks and ensuring budgets are spent on users with genuine interest, analyzing DAU for fraud directly boosts the efficiency and profitability of advertising investments.
• Bot-Free User Metrics – Helps businesses report on and understand their true user base by distinguishing between legitimate daily active users and automated bots, which is crucial for valuation, strategy, and product development.

Example 1: Campaign-Level DAU Threshold

This pseudocode sets a hard limit on the number of new daily users a specific campaign can generate from a single publisher. If a publisher suddenly sends an abnormally high number of "users," their traffic is throttled or blocked to prevent budget exhaustion from a suspected bot attack.

// Logic to protect a specific ad campaign
PUBLISHER_DAILY_CAP = 5000
publisher_dau_counts = get_daily_user_counts_by_publisher(campaign_id = 'summer_sale')

FOR publisher, count IN publisher_dau_counts.items():
    IF count > PUBLISHER_DAILY_CAP:
        // Block new traffic from this publisher for the rest of the day
        block_publisher(publisher_id = publisher)
        log_event("Publisher exceeded daily user cap, traffic blocked.")
    ENDIF
ENDFOR

Example 2: User-Agent Anomaly Detection

This logic analyzes the distribution of user-agent strings within the daily active user pool. A sudden shift, such as a huge percentage of users having an outdated or rare user-agent, indicates an attack from a bot farm that hasn't bothered to diversify its device signatures.

// Check for suspicious user-agent distributions among daily users
FUNCTION analyze_user_agent_distribution(daily_active_users_list):
    ua_counts = count_user_agents(daily_active_users_list)
    total_users = len(daily_active_users_list)

    FOR ua_string, count IN ua_counts.items():
        percentage = (count / total_users) * 100

        // If one specific, non-standard user-agent accounts for over 30% of traffic
        IF is_suspicious_ua(ua_string) AND percentage > 30:
            FLAG_TRAFFIC_SOURCE(ua_string, "Dominant suspicious user-agent")
            break
        ENDIF
    ENDFOR
END FUNCTION

🐍 Python Code Examples

This Python code demonstrates a simple way to detect a fraudulent surge in daily active users by checking if the count exceeds a dynamic threshold based on the historical average and standard deviation.

import numpy as np

# Historical DAU data for the last 30 days
historical_dau = #...and so on

def detect_dau_spike(today_dau, history):
    """Flags today's DAU if it's a statistical outlier."""
    if not history:
        return False
    
    avg = np.mean(history)
    std_dev = np.std(history)
    threshold = avg + (3 * std_dev) # 3 standard deviations above the mean

    if today_dau > threshold:
        print(f"FRAUD ALERT: DAU of {today_dau} exceeds threshold of {threshold:.0f}")
        return True
    
    print(f"NORMAL: DAU of {today_dau} is within normal range.")
    return False

# Simulate a normal day and a fraud day
normal_day_users = 10800
fraud_day_users = 25000

detect_dau_spike(normal_day_users, historical_dau)
detect_dau_spike(fraud_day_users, historical_dau)

This example filters incoming clicks based on IP reputation. It simulates checking each user's IP address against a known blocklist of suspicious IPs, a common first line of defense in click fraud prevention.

# A pre-defined set of known fraudulent IP addresses
IP_BLOCKLIST = {"1.2.3.4", "5.6.7.8", "9.10.11.12"}

def filter_suspicious_ips(click_events):
    """Filters out clicks from known bad IPs."""
    legitimate_clicks = []
    fraudulent_clicks = 0

    for event in click_events:
        if event['ip_address'] in IP_BLOCKLIST:
            fraudulent_clicks += 1
        else:
            legitimate_clicks.append(event)
    
    print(f"Blocked {fraudulent_clicks} fraudulent clicks.")
    print(f"Allowed {len(legitimate_clicks)} legitimate clicks.")
    return legitimate_clicks

# Simulate a stream of incoming click events
clicks = [
    {'user_id': 'a', 'ip_address': '123.45.67.89'},
    {'user_id': 'b', 'ip_address': '1.2.3.4'}, # Fraudulent IP
    {'user_id': 'c', 'ip_address': '98.76.54.32'},
    {'user_id': 'd', 'ip_address': '5.6.7.8'}  # Fraudulent IP
]

filter_suspicious_ips(clicks)

This code analyzes session behavior to identify bots. It flags users with an unusually high number of clicks but an extremely low session duration, which is characteristic of non-human click automation.

def analyze_session_behavior(user_sessions):
    """Identifies suspicious behavior based on click count and session time."""
    for user_id, data in user_sessions.items():
        clicks = data['click_count']
        duration = data['session_duration_sec']
        
        # Rule: More than 10 clicks in less than 5 seconds is suspicious
        if clicks > 10 and duration < 5:
            print(f"SUSPICIOUS BEHAVIOR: User {user_id} had {clicks} clicks in {duration}s.")
        else:
            print(f"NORMAL BEHAVIOR: User {user_id} had {clicks} clicks in {duration}s.")

# Simulate user session data for the day
sessions = {
    'user_A': {'click_count': 3, 'session_duration_sec': 180},
    'user_B': {'click_count': 15, 'session_duration_sec': 3}, # Bot-like behavior
    'user_C': {'click_count': 1, 'session_duration_sec': 95}
}

analyze_session_behavior(sessions)

Types of Daily active users

• Monetizable DAU (mDAU) – This refers to unique, authenticated users who can be shown ads. Filtering for mDAU is critical for fraud prevention as it separates legitimate, logged-in users from unidentified traffic or bots that cannot be monetized, providing a cleaner baseline for analysis.
• Segmented DAU – This is the analysis of daily active users broken down by specific attributes such as geographic region, traffic source, or device type. This is vital for pinpointing fraud, as an attack often originates from a single, anomalous segment (e.g., all from one country or one mobile carrier).
• Validated DAU – This counts only those daily users who have passed an additional verification step, such as a CAPTCHA or multi-factor authentication. This type of DAU is considered highly trustworthy and helps establish a fraud-free benchmark to compare against total traffic.
• New vs. Returning DAU – Fraud detection systems often analyze new and returning users separately. A sudden, massive spike in "new" DAU with low engagement is a classic sign of a bot attack, whereas a steady ratio of new to returning users indicates healthy, organic growth.

🛡️ Common Detection Techniques

• Heuristic Rule Analysis – This technique involves setting predefined rules and thresholds to flag suspicious activity. For instance, a rule might flag any IP address that generates more than 100 clicks in a day as fraudulent, helping to catch basic bot attacks.
• Behavioral Analysis – This method focuses on analyzing user actions post-click, such as mouse movements, scroll depth, and time on page. It helps distinguish between genuine human curiosity and the unnatural, rapid, or non-interactive patterns typical of automated bots.
• IP Reputation & Geolocation Analysis – This technique checks the incoming user's IP address against known blocklists of proxies, VPNs, and data centers commonly used for fraud. It also flags traffic from unexpected or high-risk geographic locations.
• Device & User-Agent Fingerprinting – This involves analyzing device and browser information to identify inconsistencies. If thousands of "users" appear with the identical, rare, or outdated user-agent string, it strongly indicates a botnet attack rather than a diverse group of real users.
• Session Anomaly Detection – This technique groups user activity into sessions and looks for irregularities. A bot might exhibit continuous activity for hours without any breaks, creating an ever-growing session that is impossible for a human, making it a clear indicator of fraud.

🧰 Popular Tools & Services

Tool	Description	Pros	Cons
Enterprise Fraud Platform	A comprehensive, multi-layered solution that combines machine learning, behavioral analysis, and customizable rules to provide real-time protection across all advertising channels.	High accuracy, detailed analytics, seamless integration with major ad platforms, proactive threat blocking.	High cost, can be complex to configure, may require dedicated staff to manage.
Real-time IP & Device Filter API	A specialized service that checks incoming traffic against constantly updated databases of high-risk IP addresses (proxies, data centers) and known fraudulent device fingerprints.	Fast, easy to integrate into existing systems, effective at blocking known bad actors and low-sophistication bots.	Less effective against new or sophisticated bots that use clean IPs, relies on reactive blocklists.
Open-Source Log Analyzer	Software that processes web server or ad server logs to identify patterns of fraudulent activity. Users can write their own scripts and rules to detect anomalies.	Free, highly customizable, provides full control over detection logic.	Requires significant technical expertise, analysis is post-click (not real-time), no dedicated support.
PPC Click Fraud Tool	A focused tool for platforms like Google and Facebook Ads that monitors clicks, automates IP exclusions, and provides reports to claim refunds for invalid traffic.	Affordable, easy to use for marketers, directly addresses budget waste on major ad networks.	Often limited to PPC campaigns, may not cover impression or conversion fraud, less effective for in-app fraud.

📊 KPI & Metrics

Tracking key performance indicators (KPIs) is essential to measure the effectiveness of fraud detection systems. It's important to monitor not just the volume of fraud detected but also the accuracy of the system and its impact on business outcomes like revenue and user experience.

Metric Name	Description	Business Relevance
Fraud Detection Rate	The percentage of total fraudulent transactions that were correctly identified and blocked by the system.	Measures the overall effectiveness of the fraud prevention solution in catching threats.
False Positive Rate	The percentage of legitimate transactions that were incorrectly flagged as fraudulent.	A high rate can harm user experience and block real customers, leading to lost revenue.
Invalid Traffic (IVT) %	The proportion of total traffic that is identified as invalid or fraudulent by the detection system.	Provides a high-level view of traffic quality and the scale of the fraud problem.
Approval Rate	The percentage of incoming transactions that are approved after screening by the fraud system.	Reflects the balance between security and enabling legitimate business; low rates may indicate overly strict rules.
Fraud-to-Sales Ratio	The ratio of fraudulent transaction volume to total transaction volume, indicating the overall impact of fraud.	Helps benchmark the organization's security performance against industry standards and assess financial risk.

These metrics are typically monitored through real-time dashboards and automated alerts. Feedback from these KPIs is crucial for continuously optimizing fraud filters and rules. For example, a rising false positive rate might prompt a review of a newly implemented detection rule, while a low detection rate could indicate that fraudsters have found a new way to bypass current defenses.

🆚 Comparison with Other Detection Methods

Accuracy and Speed

DAU analysis is a form of anomaly detection that is excellent for spotting large-scale, coordinated bot attacks that cause sudden statistical deviations. However, it is less effective at catching sophisticated bots that mimic human behavior closely. In contrast, signature-based methods (like IP blacklists) are very fast but only catch known offenders. Behavioral analytics is more accurate at catching sophisticated bots by analyzing post-click actions, but it is more computationally intensive and often slower than simple DAU thresholding.

Real-time vs. Batch Processing

DAU analysis is typically a near real-time or batch process, as it requires aggregating data over a period (e.g., hourly or daily) to identify trends. This makes it better suited for identifying ongoing attacks rather than blocking the very first fraudulent click. In comparison, methods like real-time IP filtering can block a request instantly. Deep behavioral analysis might also require a completed user session before making a definitive judgment, introducing a slight delay.

Scalability and Maintenance

Analyzing DAU is highly scalable, as it involves aggregating counts and comparing them to a baseline. However, maintaining the logic requires periodic adjustment of thresholds to account for organic growth or seasonality. Signature-based lists require constant updates to be effective. Behavioral models based on machine learning can be difficult to maintain and retrain, as fraudsters constantly change their tactics to evade detection.

⚠️ Limitations & Drawbacks

While analyzing Daily Active Users is a valuable technique in fraud detection, it has several limitations. It is most effective at identifying large-scale, unsophisticated attacks and may be less useful for detecting subtle or advanced fraudulent activity. Its reliance on historical data can also introduce delays in detection.

• Detection Delay – DAU analysis is often performed on aggregated data, meaning it detects fraud after it has already started, rather than preventing it in real-time.
• Inability to Catch Sophisticated Bots – Bots that mimic human browsing speeds and behavior patterns may not create the sudden statistical anomalies that DAU analysis is designed to catch.
• Difficulty with Organic Spikes – A successful marketing campaign or viral event can cause a legitimate spike in DAU, which may be difficult to distinguish from a fraudulent one without additional data.
• High False Positives – If baselines are not set correctly to account for seasonality or natural growth, the system can incorrectly flag legitimate traffic as fraudulent, potentially blocking real users.
• Data Granularity – Simply counting daily users is a high-level metric. It does not reveal intent or quality, and sophisticated fraud can hide within a large volume of legitimate traffic.

In cases of advanced or slow-moving fraud, hybrid strategies that combine DAU analysis with deep behavioral analytics or machine learning are often more suitable.

❓ Frequently Asked Questions

How does DAU analysis differentiate between a viral marketing spike and a bot attack?

It relies on secondary metrics. A legitimate viral spike usually brings increased engagement, longer session durations, and some conversions. A bot attack typically features a high DAU count with near-zero engagement, high bounce rates, and no conversions. Analyzing these behavioral patterns alongside the DAU count helps distinguish between the two.

Can DAU analysis detect click fraud in real-time?

Generally, no. DAU is a metric calculated over a 24-hour period, so it's a near real-time or post-facto detection method. It is used to identify ongoing attacks or to analyze traffic quality after the fact. For instant blocking, it must be combined with real-time methods like IP filtering or device fingerprinting.

Is a sudden drop in DAU a sign of successful fraud prevention?

It can be. If you implement a new blocking rule that successfully eliminates a large source of bot traffic, you would expect to see a corresponding drop in your DAU count. However, a drop could also indicate a technical issue or a problem with a legitimate traffic source, so it always requires further investigation.

How does Monetizable DAU (mDAU) improve fraud detection?

mDAU specifically counts unique users who are logged in or authenticated and can be shown ads. By focusing on this metric, systems can ignore anonymous, low-quality traffic where bots often hide. A stable mDAU count alongside a volatile total DAU count often indicates that the volatility is due to non-human traffic.

Does DAU analysis work for mobile app install fraud?

Yes, it's highly relevant. In mobile fraud, attackers use bots to generate fake app installs. A publisher delivering thousands of new "users" (installs) who never open the app again after day one would show a huge spike in DAU for that day, followed by zero engagement. This pattern is a strong indicator of install fraud.

🧾 Summary

Daily Active Users (DAU) serves as a fundamental metric in digital advertising fraud prevention by providing a baseline for normal user engagement. Security systems monitor this metric to detect anomalies, such as sudden, unexplainable spikes in traffic, which often indicate bot attacks or coordinated click fraud. By correlating DAU trends with behavioral data and conversion rates, businesses can identify and block invalid traffic, protecting their ad budgets and ensuring analytical accuracy.

🔗 Related Articles

• The Ultimate Guide to Click Fraud - How to Detect Click Fraud. - https://www.ppchero.com/the-ultimate-guide-to-click-fraud-how-to-detect-click-fraud/
• 9 tips on how to detect click fraud in 2024 - https://lunio.ai/blog/9-tips-on-how-to-detect-click-fraud-in-2024/
• Click Fraud Protection & Detection Software | ClickCease™ - https://www.clickcease.com/
• 4 Click Fraud Detection Techniques to Protect Your Campaigns - https://www.opticks.io/blog/click-fraud-detection-techniques/
• What Is Click Fraud? How to Identify and Prevent It | DataDome - https://datadome.co/learning-center/what-is-click-fraud/
• How Can Behavioral Analytics Help Detect Click Fraud? - https://spideraf.com/blog/how-can-behavioral-analytics-help-detect-click-fraud
• What is mDAU (Monetized daily active users) - https://www.bigabid.com/glossary/mdau-monetized-daily-active-users/
• Daily Active Users (DAUs): What Is It + How to Calculate - https://advertiser.review/dau-daily-active-users/