Digital Ad Intelligence

How Digital Ad Intelligence Works

  Incoming Ad Traffic
        │
        ▼
+---------------------+
│   Data Collection   │
│ (IP, UA, Behavior)  │
+---------------------+
        │
        ▼
+---------------------+
│  Analysis Engine    │←───────────[Threat Intel & Rules]
│ (Pattern Matching)  │
+---------------------+
        │
        ▼
+---------------------+
│  Action & Filtering │
│  (Block / Allow)    │
+---------------------+
        │
        └─ Invalid Traffic (Blocked)
        │
        ▼
  Clean Traffic to Ad/Site

🧠 Core Detection Logic

Example 1: IP Reputation Filtering

This logic checks the visitor’s IP address against a known database of fraudulent or suspicious sources. It is a fundamental, first-line defense used to block obvious non-human traffic originating from data centers, public proxies, or networks associated with previous malicious activity.

FUNCTION checkIP(ip_address):
  // Database of known bad IP addresses and types (e.g., data center, proxy)
  DATABASE bad_ip_list

  IF ip_address IS IN bad_ip_list:
    // Check if the IP type is a data center or known proxy
    ip_type = bad_ip_list.getType(ip_address)
    IF ip_type == "datacenter" OR ip_type == "proxy":
      RETURN "BLOCK"
    END IF
  END IF

  RETURN "ALLOW"
END FUNCTION

Example 2: Session Heuristics Analysis

This logic analyzes the behavior of a user within a single session to detect anomalies. It focuses on patterns that are unnatural for genuine human interaction, such as an impossibly high number of clicks in a short time or instantaneous actions that defy human physical limitations.

FUNCTION analyzeSession(session_data):
  // Define thresholds for suspicious behavior
  MAX_CLICKS_PER_MINUTE = 5
  MIN_TIME_BETWEEN_EVENTS_MS = 100

  // Calculate click frequency
  click_rate = session_data.clicks.count() / session_data.duration_minutes
  
  IF click_rate > MAX_CLICKS_PER_MINUTE:
    RETURN "FLAG_FOR_REVIEW"
  END IF

  // Check time between page load and first action
  IF session_data.first_action_timestamp - session_data.page_load_timestamp < MIN_TIME_BETWEEN_EVENTS_MS:
    RETURN "FLAG_FOR_REVIEW"
  END IF

  RETURN "PASS"
END FUNCTION

Example 3: Geo-Mismatch Detection

This logic compares the geographical location reported by the user's browser or device with the location associated with their IP address. A significant mismatch can indicate the use of GPS spoofing tools or other methods designed to conceal the user's true origin, a common tactic in sophisticated ad fraud.

FUNCTION checkGeoMismatch(ip_geo, device_geo):
  // ip_geo is the location derived from the IP address
  // device_geo is the location from the device's GPS or browser API

  IF ip_geo AND device_geo:
    // Calculate distance between the two geographic points
    distance = calculate_distance(ip_geo.coordinates, device_geo.coordinates)

    // If the distance is greater than a plausible threshold (e.g., 100 km)
    IF distance > 100:
      RETURN "BLOCK_SUSPICIOUS_GEO"
    END IF
  END IF

  RETURN "ALLOW"
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding – Actively blocks clicks and impressions from bots and other non-human sources, ensuring that PPC and CPM budgets are spent only on reaching genuine potential customers.
• Analytics Purification – Filters out fraudulent traffic from analytics platforms. This provides a clean, accurate view of campaign performance and user behavior, leading to better strategic decisions.
• ROAS Optimization – Improves Return on Ad Spend (ROAS) by eliminating wasted expenditure on fraudulent clicks that will never convert. This allows advertisers to reallocate their budget to higher-performing, legitimate channels.
• Lead Generation Integrity – Prevents bots from submitting fake information through lead generation forms, ensuring that sales teams receive valid, high-quality leads and are not wasting time on fraudulent submissions.

Example 1: Geofencing Enforcement Rule

This logic ensures that ads are only shown to users within a specific geographic region defined by the campaign's targeting settings, blocking clicks from outside the target area.

// USE CASE: A local business wants to ensure its ad spend is not wasted on clicks from outside its service area.

FUNCTION enforceGeofence(user_ip, campaign_target_region):
  user_location = getLocation(user_ip)

  IF user_location IS_NOT_IN campaign_target_region:
    // Block the click and log the event
    log("Blocked out-of-region click from IP: " + user_ip)
    RETURN "BLOCK"
  END IF
  
  RETURN "ALLOW"
END FUNCTION

Example 2: Session Scoring for Conversion Fraud

This logic assigns a risk score to a user session based on multiple behavioral indicators. A high score suggests the user is likely a bot, preventing fraudulent conversion events.

// USE CASE: An e-commerce site wants to prevent bots from faking "add to cart" or "purchase" events.

FUNCTION scoreSession(session_events):
  risk_score = 0

  // Rule 1: Instantaneous form fill
  IF session_events.form_fill_time < 2 seconds:
    risk_score += 40
  END IF

  // Rule 2: No mouse movement detected
  IF session_events.mouse_movement_events == 0:
    risk_score += 30
  END IF

  // Rule 3: Traffic from known data center
  IF isDataCenterIP(session_events.ip_address):
    risk_score += 50
  END IF

  // If score is above threshold, flag as fraudulent
  IF risk_score > 60:
    RETURN "FRAUDULENT"
  ELSE:
    RETURN "LEGITIMATE"
  END IF
END FUNCTION

🐍 Python Code Examples

This Python function simulates checking for rapid-fire clicks from a single IP address. If the number of clicks from an IP exceeds a set limit within a short timeframe, it is flagged as suspicious, a common sign of bot activity.

CLICK_TIMESTAMPS = {}
TIME_WINDOW_SECONDS = 60
CLICK_THRESHOLD = 10

def is_click_flood(ip_address):
    """Checks if an IP is generating an abnormally high number of clicks."""
    import time
    current_time = time.time()
    
    if ip_address not in CLICK_TIMESTAMPS:
        CLICK_TIMESTAMPS[ip_address] = []

    # Remove timestamps older than the time window
    CLICK_TIMESTAMPS[ip_address] = [t for t in CLICK_TIMESTAMPS[ip_address] if current_time - t < TIME_WINDOW_SECONDS]
    
    # Add the current click timestamp
    CLICK_TIMESTAMPS[ip_address].append(current_time)
    
    # Check if click count exceeds the threshold
    if len(CLICK_TIMESTAMPS[ip_address]) > CLICK_THRESHOLD:
        print(f"ALERT: Click flood detected from IP {ip_address}")
        return True
        
    return False

# Example usage:
is_click_flood("192.168.1.100")

This code filters incoming traffic based on its user-agent string. It maintains a blocklist of user-agents known to be associated with bots and data center traffic, preventing them from interacting with the ad.

SUSPICIOUS_USER_AGENTS = [
    "HeadlessChrome",
    "PhantomJS",
    "python-requests",
    "curl"
]

def filter_by_user_agent(user_agent_string):
    """Blocks traffic from known suspicious user agents."""
    for suspicious_ua in SUSPICIOUS_USER_AGENTS:
        if suspicious_ua in user_agent_string:
            print(f"BLOCK: Suspicious user agent found: {user_agent_string}")
            return False
            
    print(f"ALLOW: User agent is clean: {user_agent_string}")
    return True

# Example usage:
filter_by_user_agent("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36")
filter_by_user_agent("python-requests/2.28.1")

Types of Digital Ad Intelligence

• Rule-Based Intelligence – This type uses a predefined set of static rules to filter traffic. For example, it might automatically block all traffic from a specific country, a list of known fraudulent IP addresses, or traffic using an outdated browser version. It is straightforward but less effective against new threats.
• Behavioral Intelligence – This method focuses on analyzing user actions in real-time to identify non-human patterns. It tracks metrics like mouse movement, click speed, and page scroll velocity, flagging traffic that behaves more like a bot than a person. It is highly effective at detecting sophisticated automated threats.
• Reputational Intelligence – This approach assesses traffic based on the historical reputation of its source. It leverages global data networks to check whether an IP address, device ID, or user agent has been associated with fraudulent activity in the past, blocking sources with a poor reputation.
• Heuristic Intelligence – This type combines multiple data points and analytical techniques to assign a "fraud score" to a visitor. It doesn't rely on a single red flag but rather the collective weight of several suspicious indicators, allowing for more nuanced and accurate detection of subtle or emerging fraud tactics.