Firewall Protection

How Firewall Protection Works

Incoming Ad Traffic (Click)
           │
           ▼
+----------------------+
│  Firewall Gateway    │
│ (Initial Screening)  │
+----------------------+
           │
           ├─→ [Rule: IP Blacklist?] ───→ Block (Fraudulent)
           │
           ├─→ [Rule: Geo-Mismatch?] ───→ Block (Fraudulent)
           │
           ├─→ [Rule: Known Bot UA?] ───→ Block (Fraudulent)
           │
           ▼
+----------------------+
│  Behavioral Analysis │
+----------------------+
           │
           ├─→ [Heuristic: Click Storm?] ──→ Flag & Block
           │
           ├─→ [Heuristic: No Mouse?]  ──→ Flag & Block
           │
           ▼
+----------------------+
│   Legitimate Traffic │
└─→ (Passed to Site)

🧠 Core Detection Logic

Example 1: IP Filtering and Reputation

This logic checks the incoming click’s IP address against known lists of fraudulent sources. It’s a foundational layer of defense that quickly blocks traffic from data centers, VPNs/proxies, and IPs with a history of malicious activity, which are rarely used by genuine customers.

FUNCTION checkIP(request):
  ip_address = request.getIP()
  
  IF ip_address IS IN global_blacklist:
    RETURN "BLOCK"
  
  IF getIPInfo(ip_address).source == "DataCenter":
    RETURN "BLOCK"
    
  IF getIPInfo(ip_address).is_proxy == TRUE:
    RETURN "BLOCK"
    
  RETURN "PASS"

Example 2: User-Agent Validation

This logic inspects the user-agent (UA) string sent by the browser. Bots often use outdated, inconsistent, or “headless” browser UAs that differ from those of legitimate users. This check identifies non-standard UAs that are common indicators of automated traffic.

FUNCTION checkUserAgent(request):
  user_agent = request.getUserAgent()
  
  IF user_agent IS EMPTY or user_agent IS NULL:
    RETURN "BLOCK"
    
  IF user_agent CONTAINS "HeadlessChrome" OR user_agent IS IN known_bot_uas:
    RETURN "BLOCK"
  
  // Check for inconsistencies, e.g., a mobile UA with a desktop screen resolution
  IF is_inconsistent(user_agent, request.getDeviceInfo()):
    RETURN "BLOCK"
    
  RETURN "PASS"

Example 3: Click Frequency Analysis (Heuristics)

This logic analyzes the timing and frequency of clicks originating from the same device or IP address. A high volume of clicks in an unnaturally short period, or “click stacking,” is impossible for a human and is a strong signal of bot activity which this rule is designed to catch.

FUNCTION checkClickFrequency(request):
  device_id = request.getDeviceID()
  current_time = now()
  
  // Get timestamps of last 5 clicks from this device
  click_history = getClickHistory(device_id, limit=5)
  
  // If more than 3 clicks in the last 10 seconds, block
  clicks_in_10s = count_clicks_within_timespan(click_history, current_time, 10)
  
  IF clicks_in_10s > 3:
    log_event("Click Storm Detected", device_id)
    RETURN "BLOCK"
    
  RETURN "PASS"

📈 Practical Use Cases for Businesses

• Campaign Shielding – Firewall protection actively filters out bot clicks from paid campaigns in real-time. This prevents ad budgets from being wasted on non-human traffic, ensuring that spend is allocated toward reaching genuine potential customers and maximizing return on investment.
• Data Integrity – By blocking fraudulent traffic at the source, firewalls ensure that website analytics and campaign performance data are clean and accurate. This allows businesses to make reliable, data-driven decisions about marketing strategy, budget allocation, and audience targeting without skewed metrics.
• Lead Generation Funnel Protection – For businesses focused on acquiring leads, a firewall prevents bots from submitting fake forms or initiating fraudulent sign-ups. This keeps the sales pipeline clean, reduces the manual effort of sorting through junk leads, and ensures sales teams engage only with legitimate prospects.
• Preserving Retargeting Audiences – Firewalls prevent bots from polluting retargeting lists. By ensuring only genuinely interested users who visit the site are added to the audience, businesses can run more effective and cost-efficient retargeting campaigns that reach people who have shown actual interest.

Example 1: Geofencing Rule

This logic blocks clicks originating from countries outside of the campaign’s target market, preventing budget waste from irrelevant locations often associated with click farms.

FUNCTION applyGeofence(request):
  ip_address = request.getIP()
  country = getCountryFromIP(ip_address)
  
  allowed_countries = ["USA", "CAN", "GBR"]
  
  IF country NOT IN allowed_countries:
    RETURN "BLOCK"
  ELSE:
    RETURN "PASS"

Example 2: Session Scoring Rule

This logic assigns a risk score based on multiple factors. A click from a residential IP might get a low score, while a click from a data center with a mismatched timezone gets a high score. Clicks exceeding a score threshold are blocked.

FUNCTION calculateSessionScore(request):
  score = 0
  
  ip_info = getIPInfo(request.getIP())
  device_info = getDeviceInfo(request.getUserAgent())
  
  IF ip_info.source == "DataCenter":
    score += 50
  
  IF ip_info.is_proxy == TRUE:
    score += 30
    
  IF device_info.is_headless_browser == TRUE:
    score += 60
    
  // Block if score is dangerously high
  IF score >= 80:
    RETURN "BLOCK"
  ELSE:
    RETURN "PASS"

🐍 Python Code Examples

This Python function simulates checking a click’s IP address against a predefined blacklist. It’s a simple yet effective method to filter out traffic from known malicious sources before it consumes any ad budget.

KNOWN_FRAUDULENT_IPS = {"198.51.100.15", "203.0.113.22", "192.0.2.88"}

def block_by_ip(click_ip):
    """Blocks a click if its IP is in the known fraudulent list."""
    if click_ip in KNOWN_FRAUDULENT_IPS:
        print(f"Blocking fraudulent IP: {click_ip}")
        return False
    print(f"Allowing legitimate IP: {click_ip}")
    return True

# Simulate incoming clicks
block_by_ip("8.8.8.8")  # Legitimate
block_by_ip("198.51.100.15") # Fraudulent

This example demonstrates click frequency analysis. The code tracks click timestamps for each user ID and blocks users who click too frequently in a short time, a common sign of non-human bot activity.

from collections import defaultdict
import time

CLICK_HISTORY = defaultdict(list)
TIME_WINDOW_SECONDS = 10
MAX_CLICKS_IN_WINDOW = 4

def is_click_fraud(user_id):
    """Checks for rapid, successive clicks from the same user."""
    current_time = time.time()
    
    # Filter out clicks older than the time window
    CLICK_HISTORY[user_id] = [t for t in CLICK_HISTORY[user_id] if current_time - t < TIME_WINDOW_SECONDS]
    
    # Add the current click timestamp
    CLICK_HISTORY[user_id].append(current_time)
    
    if len(CLICK_HISTORY[user_id]) > MAX_CLICKS_IN_WINDOW:
        print(f"Fraud detected for user {user_id}: Too many clicks.")
        return True
    
    print(f"User {user_id} click is within limits.")
    return False

# Simulate clicks from a user
is_click_fraud("user-123")
is_click_fraud("user-123")
is_click_fraud("user-123")
is_click_fraud("user-123")
is_click_fraud("user-123") # This one will be flagged

Types of Firewall Protection

• Rule-Based Filtering – This is the most fundamental type of firewall. It operates on a strict set of predefined rules, such as blocking specific IP addresses, countries, or device types. It is effective against known and obvious sources of fraudulent traffic but lacks flexibility against new threats.
• Heuristic Analysis – This type uses “rules of thumb” to identify suspicious behavior that deviates from the norm. It analyzes patterns like click velocity, session duration, and mouse movement. For example, it can flag traffic where a click happens faster than a human could realistically react after seeing an ad.
• Behavioral Analysis – A more advanced method that creates a baseline of normal human visitor behavior and flags outliers. It tracks user interactions over time to distinguish between the nuanced patterns of genuine users and the more simplistic, repetitive actions of automated bots.
• Reputation-Based Filtering – This firewall leverages collective intelligence. It uses continuously updated databases of IPs, domains, and device fingerprints that have been previously associated with fraudulent activity across a wide network, allowing one advertiser’s discovery to help protect others.
• Signature-Based Detection – This approach identifies bots by matching their digital “signature”—such as their user-agent string, browser properties, or specific HTTP request headers—against a library of known fraudulent signatures. It is highly effective at stopping bots that have been identified before.