Intent Based Targeting

How Intent Based Targeting Works

+---------------------+      +----------------------+      +--------------------+
|   Incoming Traffic  |----->| Intent Analyzer (ML) |----->|  Decision Engine   |
| (Click/Impression)  |      |                      |      |                    |
+---------------------+      +----------+-----------+      +----------+---------+
         │                             │                           │
         │                             │                           │
         ▼                             ▼                           ▼
+---------------------+      +----------------------+      +--------------------+
|  Data Collection    |      |  Behavioral Signals  |      |   Action Taken     |
| (IP, UA, Referrer)  |      | (e.g., Mouse, Time)  |      | (Block/Allow/Flag) |
+---------------------+      +----------------------+      +--------------------+
         │                             │                           │
         └─────────────-───────>|   Risk Scoring       |<────────-─────────┘
                               +----------------------+

🧠 Core Detection Logic

Example 1: Session Velocity Scoring

This logic tracks the speed and frequency of a user's actions within a single session. It helps identify bots that attempt to perform actions much faster than a typical human user would. This is a crucial component of real-time traffic filtering, as it catches automated scripts designed for rapid, repeated clicks.

FUNCTION calculate_session_velocity(session_data):
  click_timestamps = session_data.get_timestamps("click")
  page_load_timestamps = session_data.get_timestamps("load")

  IF count(click_timestamps) < 2:
    RETURN "LOW_VELOCITY"

  time_diffs = []
  FOR i FROM 1 TO count(click_timestamps) - 1:
    diff = click_timestamps[i] - click_timestamps[i-1]
    time_diffs.append(diff)

  average_time_between_clicks = average(time_diffs)

  IF average_time_between_clicks < 2 seconds:
    RETURN "HIGH_RISK_VELOCITY"
  ELSE IF average_time_between_clicks < 10 seconds:
    RETURN "MEDIUM_RISK_VELOCITY"
  ELSE:
    RETURN "NORMAL_VELOCITY"

Example 2: Geographic Mismatch Detection

This logic compares the user's IP-based geolocation with other location signals, such as timezone settings from their browser or language preferences. A mismatch can indicate the use of a proxy or VPN to mask the user's true location, a common tactic in sophisticated ad fraud. This helps ensure that geo-targeted campaigns reach the intended audience.

FUNCTION check_geo_mismatch(ip_address, browser_headers):
  ip_geo = get_geolocation(ip_address) // e.g., {country: "US", timezone: "America/New_York"}
  browser_timezone = browser_headers.get("Timezone") // e.g., "Asia/Tokyo"
  browser_language = browser_headers.get("Accept-Language") // e.g., "ja-JP"

  IF ip_geo.country != get_country_from_timezone(browser_timezone):
    RETURN "GEO_MISMATCH_DETECTED"

  IF ip_geo.country == "US" AND browser_language.starts_with("ru"):
    RETURN "LANGUAGE_MISMATCH_DETECTED"

  RETURN "GEO_CONSISTENT"

Example 3: Behavioral Heuristics Analysis

This logic analyzes on-page behavior, such as mouse movements and scroll patterns, to distinguish between human and bot activity. Bots often exhibit unnatural, perfectly straight mouse paths or no movement at all. This type of analysis is key to detecting advanced bots that can successfully mimic basic user attributes but fail to replicate human-like interaction.

FUNCTION analyze_behavior(mouse_events, scroll_events):
  mouse_path = mouse_events.get_path()
  scroll_depth = scroll_events.get_max_depth()
  
  // Rule 1: No mouse movement before click is suspicious
  IF is_empty(mouse_path):
    RETURN "BOT_BEHAVIOR_SUSPECTED"

  // Rule 2: Perfectly linear mouse movement is a strong bot signal
  IF is_linear(mouse_path) AND count(mouse_path) > 10:
    RETURN "LINEAR_MOUSE_PATH_BOT"

  // Rule 3: Instant scroll to bottom of page is not human-like
  IF scroll_depth == 100% AND session_duration < 3 seconds:
    RETURN "INSTANT_SCROLL_BOT"

  RETURN "HUMAN_LIKE_BEHAVIOR"

📈 Practical Use Cases for Businesses

• Campaign Shielding: Protects PPC campaign budgets by proactively blocking clicks from known bots, click farms, and competitors before they deplete advertising funds.
• Data Integrity: Ensures marketing analytics are based on genuine human engagement by filtering out fraudulent traffic that would otherwise skew key metrics like click-through rates and conversion rates.
• Lead Generation Filtering: Improves the quality of leads generated from online forms by analyzing user intent to discard submissions from automated scripts or malicious actors.
• Return on Ad Spend (ROAS) Optimization: Increases ROAS by ensuring ad spend is directed only toward authentic audiences who have a genuine potential for conversion, rather than being wasted on invalid clicks.

Example 1: Geofencing Rule for Local Services

A local service business wants to ensure its ads are only clicked by users genuinely located within its service area. This pseudocode filters out clicks originating from outside the target country and flags those using proxies to appear local.

PROCEDURE enforce_geofencing(click_data):
  user_ip = click_data.get("ip")
  ip_info = get_ip_details(user_ip)
  
  target_country = "US"
  
  IF ip_info.country != target_country:
    BLOCK_CLICK(user_ip, "OUTSIDE_SERVICE_AREA")
    
  IF ip_info.is_proxy == TRUE:
    BLOCK_CLICK(user_ip, "PROXY_DETECTED")

Example 2: Session Authenticity Scoring

An e-commerce site scores user sessions to identify non-genuine shoppers before they can trigger conversion events. The score is based on a combination of behavioral signals, with a high score indicating probable fraud.

FUNCTION get_session_authenticity_score(session):
  score = 0
  
  // Abnormal click frequency
  IF session.clicks_per_minute > 30:
    score += 50
    
  // Lack of mouse movement
  IF session.mouse_movement_events == 0:
    score += 30

  // Known fraudulent user agent
  IF is_known_bot_user_agent(session.user_agent):
    score += 100

  RETURN score
  
// In practice: IF get_session_authenticity_score(current_session) > 80 THEN invalidate_session()

🐍 Python Code Examples

This code demonstrates a basic check for abnormal click frequency from a single IP address. Tracking the number of clicks within a short time window helps detect simple bots or manual fraud attempts designed to rapidly deplete an ad budget.

from collections import defaultdict
import time

CLICK_LOGS = defaultdict(list)
TIME_WINDOW = 60  # seconds
CLICK_THRESHOLD = 15

def is_click_fraud(ip_address):
    """Checks if an IP exceeds the click threshold within the time window."""
    current_time = time.time()
    
    # Filter out clicks older than the time window
    CLICK_LOGS[ip_address] = [t for t in CLICK_LOGS[ip_address] if current_time - t < TIME_WINDOW]
    
    # Add the current click
    CLICK_LOGS[ip_address].append(current_time)
    
    # Check if the number of clicks exceeds the threshold
    if len(CLICK_LOGS[ip_address]) > CLICK_THRESHOLD:
        print(f"Fraud Detected: IP {ip_address} exceeded {CLICK_THRESHOLD} clicks in {TIME_WINDOW} seconds.")
        return True
        
    return False

# Simulation
test_ips = ["192.168.1.101"] * 20
for ip in test_ips:
    is_click_fraud(ip)
    time.sleep(1)

This example provides a function to filter traffic based on suspicious user agent strings. Bots often use generic, outdated, or known fraudulent user agents, making this a straightforward yet effective method for initial traffic filtering.

SUSPICIOUS_USER_AGENTS = [
    "bot",
    "spider",
    "headlesschrome", # Often used in automated scripts
    "phantomjs"
]

def filter_by_user_agent(user_agent_string):
    """Filters traffic based on a list of suspicious user agent keywords."""
    ua_lower = user_agent_string.lower()
    for suspicious_ua in SUSPICIOUS_USER_AGENTS:
        if suspicious_ua in ua_lower:
            print(f"Suspicious User Agent Detected: {user_agent_string}")
            return True # Indicates traffic should be blocked or flagged
            
    return False

# Example Usage
ua_human = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
ua_bot = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

print(f"Human UA: {'Blocked' if filter_by_user_agent(ua_human) else 'Allowed'}")
print(f"Bot UA: {'Blocked' if filter_by_user_agent(ua_bot) else 'Allowed'}")

Types of Intent Based Targeting

• First-Party Intent Analysis: This method relies on data collected directly from your own digital properties, such as your website or app. It analyzes how users interact with your content—like pages visited or time spent—to gauge their interest level and identify anomalies indicative of non-genuine traffic.
• Behavioral Intent Analysis: This focuses on specific user actions and patterns, like repeated visits to competitor sites, searches for product reviews, or unusually rapid click-through rates. It is highly effective for spotting both automated bots and organized human fraud by identifying behaviors outside the norm.
• Bidstream Intent Data: This type uses data available within the programmatic advertising ecosystem to determine intent based on the context of the pages a user visits. While broad, it can help identify trends and filter out traffic from sources known for low-quality or fraudulent activity before a bid is even placed.
• Predictive Intent Modeling: This advanced approach uses AI and machine learning to forecast a user's intent based on historical and real-time data. In fraud detection, it can predict which traffic segments are most likely to be fraudulent, allowing for proactive blocking and more efficient allocation of security resources.