Event Risk Management

How Event Risk Management Works

  User Event     │        Data Pipeline         │      Decision Engine
┌───────────┐    │                              │      ┌───────────────┐
│ Ad Click  │───→│ Data Collection & Ingestion ] │───→│ Risk Score  │
└───────────┘    │        (IP, UA, Time)      │      │     (0-100)     │
                 │              ↓               │      └───────┬───────┘
                 │                              │              ↓
                 │ Analysis & Correlation  ] │      ┌───────────────┐
                 │    (Behavior, History)      │      │ Action      │
                 └──────────────────────────────┘      │ (Allow/Block) │
                                                       └───────────────┘

🧠 Core Detection Logic

Example 1: Click Frequency Analysis

This logic tracks how many times a single IP address clicks on an ad in a given timeframe. It is a frontline defense against basic bots and click farms that often use the same source to generate numerous invalid clicks. By setting a reasonable threshold, it filters out abnormally high-frequency behavior.

FUNCTION checkClickFrequency(event):
  ip = event.ipAddress
  timeframe = 60 // seconds
  maxClicks = 5

  // Get recent click timestamps for this IP
  clicks = getClicksByIP(ip, within=timeframe)

  IF count(clicks) > maxClicks:
    RETURN "FRAUDULENT"
  ELSE:
    RETURN "VALID"
  ENDIF

Example 2: Session Heuristics

This logic evaluates the quality of a user session by analyzing behavior between the click and subsequent actions. A legitimate user typically spends time on the landing page, whereas a bot might “bounce” immediately. A very short session duration is a strong indicator of non-human or uninterested traffic.

FUNCTION analyzeSession(session):
  landingTime = session.pageLoadTime
  exitTime = session.exitTime
  minDuration = 2 // seconds

  duration = exitTime - landingTime

  IF duration < minDuration:
    // User left almost instantly
    score = 80 // High risk score
    RETURN score
  ELSE:
    score = 10 // Low risk score
    RETURN score
  ENDIF

Example 3: Geo Mismatch Detection

This logic compares the geographic location of the user's IP address with the campaign's targeting settings. Clicks originating from countries or regions that are not being targeted are a common sign of fraud, often from proxy servers or bots located in different parts of the world.

FUNCTION verifyGeoLocation(event, campaign):
  userCountry = getCountryFromIP(event.ipAddress)
  targetCountries = campaign.targetLocations

  IF userCountry NOT IN targetCountries:
    // Click is from outside the target area
    logFraud("Geo Mismatch", event)
    RETURN FALSE
  ELSE:
    RETURN TRUE
  ENDIF

📈 Practical Use Cases for Businesses

• Campaign Shielding – Prevents ad budgets from being wasted on clicks from bots, competitors, or click farms, ensuring that spend is allocated toward reaching genuine potential customers.
• Data Integrity – Keeps analytics platforms clean by filtering out non-human and fraudulent traffic. This leads to more accurate metrics like Click-Through Rate (CTR) and Conversion Rate, enabling better strategic decisions.
• Lead Quality Improvement – Blocks low-quality traffic at the source, which prevents fake sign-ups and junk leads from entering the sales funnel. This allows sales teams to focus on legitimate prospects.
• ROAS Optimization – Improves Return On Ad Spend (ROAS) by ensuring that marketing funds are spent on traffic that has a real chance of converting, thereby maximizing the effectiveness of advertising campaigns.

Example 1: Geofencing Rule

A business running a local campaign for a service only available in the United Kingdom can use a geofencing rule to automatically block all clicks originating from outside the country, saving budget and preventing irrelevant traffic.

// Rule: GE-UK-ONLY
// Description: Blocks any click not originating from the United Kingdom.

RULE "Allow UK Traffic Only"
WHEN
  event.type == "click" AND
  ip.country_code != "GB"
THEN
  BLOCK_REQUEST()
  LOG "Blocked non-UK traffic"
END

Example 2: Session Behavior Scoring

An e-commerce store can score traffic based on engagement. A user who clicks an ad and immediately leaves the landing page (bounces) receives a high-risk score, while a user who browses multiple pages receives a low-risk score, helping to identify disinterested or bot traffic.

// Logic: Session Scoring
// Description: Scores a session based on user actions post-click.

FUNCTION scoreSession(session):
  score = 0
  IF session.duration < 3 seconds:
    score += 50 // High bounce rate
  ENDIF
  IF session.pages_viewed < 2:
    score += 30 // Low engagement
  ENDIF
  IF score > 60:
    FLAG "High Risk"
  ENDIF
  RETURN score
END

🐍 Python Code Examples

This code simulates checking for rapid, repeated clicks from a single IP address within a short time window. It helps block basic bot attacks where a script generates many clicks from the same source quickly.

CLICK_LOG = {}
TIME_WINDOW = 60  # seconds
CLICK_THRESHOLD = 10

def is_frequent_click(ip_address):
    import time
    current_time = time.time()
    
    # Remove old clicks from the log
    if ip_address in CLICK_LOG:
        CLICK_LOG[ip_address] = [t for t in CLICK_LOG[ip_address] if current_time - t < TIME_WINDOW]
    
    # Add the new click
    clicks = CLICK_LOG.setdefault(ip_address, [])
    clicks.append(current_time)
    
    # Check if the number of clicks exceeds the threshold
    if len(clicks) > CLICK_THRESHOLD:
        return True
    return False

# --- Simulation ---
test_ip = "198.51.100.1"
for i in range(12):
    if is_frequent_click(test_ip):
        print(f"Click {i+1} from {test_ip}: Flagged as fraudulent.")
    else:
        print(f"Click {i+1} from {test_ip}: Allowed.")

This example demonstrates filtering incoming traffic based on its user-agent string. It checks against a predefined list of known bot or non-browser agents to prevent common automated scripts from interacting with ads.

KNOWN_BOT_AGENTS = [
    "Bot/1.0",
    "DataScraper/2.1",
    "ValidationTool/3.0"
]

def filter_by_user_agent(user_agent):
    if user_agent in KNOWN_BOT_AGENTS:
        return "BLOCKED"
    
    # More advanced check for common bot signatures
    if "bot" in user_agent.lower() or "spider" in user_agent.lower():
        return "BLOCKED"
        
    return "ALLOWED"

# --- Simulation ---
traffic_requests = [
    {"ip": "203.0.113.5", "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..."},
    {"ip": "198.51.100.2", "ua": "DataScraper/2.1"},
    {"ip": "203.0.113.6", "ua": "Googlebot/2.1 (+http://www.google.com/bot.html)"}
]

for req in traffic_requests:
    status = filter_by_user_agent(req["ua"])
    print(f"Traffic from {req['ip']} with UA '{req['ua']}': {status}")

Types of Event Risk Management

• Rule-Based Management – This type uses a predefined set of static rules to identify fraud. For instance, a rule might automatically block all clicks from known data center IP addresses or TOR exit nodes. It is effective against known, unsophisticated threats but lacks flexibility.
• Behavioral Analysis – This method focuses on user behavior patterns rather than static attributes. It analyzes mouse movements, session duration, and click timing to determine if the activity is human-like. This is effective against bots that have not perfected mimicking human interaction.
• Reputation-Based Filtering – This type assesses the historical reputation of an event's source, such as an IP address, device ID, or user agent. Sources that have been previously associated with fraudulent activity are given a higher risk score and may be blocked proactively.
• Heuristic Analysis – This approach uses experience-based models and algorithms to detect suspicious anomalies. For example, it might flag a click that occurs within milliseconds of an ad loading, as this is faster than a human could react. It helps identify new or evolving fraud tactics.
• Predictive Scoring – Leveraging machine learning, this type predicts the likelihood of an event being fraudulent based on vast datasets of past activity. It identifies complex, subtle patterns that other methods might miss, offering a more proactive and adaptive form of protection.