Archives: Glossary Terms

How Predictive Analytics Works

[Incoming Traffic] -> +----------------------+ -> [Scoring Engine] -> +------------------+ -> [Action]
 (Clicks, Events)    | Data Collection &     |   (ML Model)       |  Decision Logic  |   (Block/Allow)
                     | Preprocessing        |                    |  (Risk Thresholds) |
                     +----------------------+                    +------------------+
                                │                                     │
                                └──────> [Feature Engineering] <───────┘
                                           (Behavior, IP, etc.)

🧠 Core Detection Logic

Example 1: Behavioral Anomaly Detection

This logic identifies non-human or bot-like behavior by analyzing the timing and frequency of user actions. It fits into traffic protection by establishing a baseline for normal user engagement and flagging sessions that deviate significantly, which often indicates automated fraud.

function checkBehavior(session) {
  // Rule 1: More than 10 clicks in under 1 minute is suspicious
  if (session.clicks.length > 10 && session.duration < 60) {
    return "FLAG_AS_FRAUD";
  }

  // Rule 2: Time between clicks is consistently too short (e.g., < 1 sec)
  let timestamps = session.clicks.map(c => c.timestamp).sort();
  for (let i = 1; i < timestamps.length; i++) {
    if (timestamps[i] - timestamps[i-1] < 1000) {
      return "FLAG_AS_FRAUD";
    }
  }

  return "LEGITIMATE";
}

Example 2: IP Reputation and Geolocation Mismatch

This logic checks the user's IP address against known fraud blacklists (like data centers or proxies) and verifies that the IP's location matches the expected campaign target region. It prevents fraud by blocking traffic from sources that are known to be malicious or geographically irrelevant.

function validateIP(ipAddress, campaignTargetRegion) {
  // Check if IP is a known proxy or from a data center
  if (isKnownProxy(ipAddress) || isDataCenter(ipAddress)) {
    return "BLOCK_IP";
  }

  // Check if the user's location matches the campaign's target
  let userGeo = getLocation(ipAddress);
  if (userGeo.country !== campaignTargetRegion.country) {
    return "BLOCK_GEO_MISMATCH";
  }

  return "ALLOW";
}

Example 3: Device and User-Agent Fingerprinting

This logic analyzes device and browser attributes to detect inconsistencies that suggest spoofing or emulation. For instance, a mobile user-agent string paired with a desktop screen resolution is a red flag. This helps identify sophisticated bots trying to mimic real users.

function verifyFingerprint(requestHeaders) {
  let userAgent = requestHeaders["User-Agent"];
  let screenResolution = requestHeaders["Screen-Resolution"];

  // Example Rule: A mobile User-Agent should not have a typical desktop resolution
  if (userAgent.includes("iPhone") && screenResolution === "1920x1080") {
    return "FLAG_AS_SPOOFED_DEVICE";
  }

  // Example Rule: Headless browsers often used by bots
  if (userAgent.includes("HeadlessChrome")) {
    return "FLAG_AS_BOT";
  }

  return "VALID";
}

📈 Practical Use Cases for Businesses

• Campaign Shielding – Automatically block traffic from known data centers, VPNs, and malicious IP addresses in real-time. This protects advertising budgets by ensuring ads are only shown to genuine, relevant audiences, directly improving return on ad spend.
• Conversion Fraud Prevention – Analyze post-click behavior to identify users who click ads but show no legitimate engagement on the landing page. Predictive models can flag sessions with zero scroll depth or immediate bounce as likely fraud, protecting conversion data integrity.
• Competitor Click Mitigation – Identify and block patterns of behavior consistent with competitors attempting to exhaust ad budgets. This includes monitoring for repeated clicks from the same small set of IP ranges or unusual click activity outside of typical business hours.
• Audience Quality Optimization – Use predictive scoring to segment inbound traffic into quality tiers (e.g., high, medium, low). This allows businesses to focus budget allocation on the highest-quality traffic sources, improving overall campaign efficiency and lead generation quality.

Example 1: Geofencing Rule

This pseudocode demonstrates a basic geofencing rule that blocks clicks originating from outside a campaign's specified target countries. This is a simple but effective way to filter out irrelevant international traffic and reduce exposure to fraud from high-risk regions.

// Define a list of allowed countries for a specific campaign
ALLOWED_COUNTRIES = ["US", "CA", "GB"]

function checkGeoFence(userIP) {
  user_country = getCountryFromIP(userIP)

  if (user_country in ALLOWED_COUNTRIES) {
    return "ALLOW_TRAFFIC"
  } else {
    return "BLOCK_TRAFFIC"
  }
}

Example 2: Session Click Frequency Scoring

This pseudocode provides a simple scoring model for traffic based on click frequency within a single user session. Sessions with an unnaturally high number of clicks in a short time receive a higher fraud score, helping to identify automated bot activity.

// Score traffic based on click velocity
function scoreSession(session) {
  let click_count = session.clicks.length
  let time_seconds = session.duration_seconds
  let fraud_score = 0

  // More than 5 clicks in 30 seconds is highly suspicious
  if (click_count > 5 && time_seconds < 30) {
    fraud_score = 95 // High probability of fraud
  }
  // 3-5 clicks in 30 seconds is moderately suspicious
  else if (click_count >= 3 && time_seconds < 30) {
    fraud_score = 60 // Moderate probability of fraud
  }

  return fraud_score
}

🐍 Python Code Examples

This Python code simulates detecting abnormally high click frequencies from a single IP address within a short time frame. This is a common technique used to identify basic bot attacks or click-bombing activity that can quickly drain an ad budget.

# Dictionary to track clicks from IPs
ip_click_tracker = {}
from time import time

# Time window in seconds
TIME_WINDOW = 60
# Click threshold
CLICK_THRESHOLD = 10

def is_fraudulent_click(ip_address):
    current_time = time()
    if ip_address not in ip_click_tracker:
        ip_click_tracker[ip_address] = []

    # Remove clicks outside the time window
    ip_click_tracker[ip_address] = [t for t in ip_click_tracker[ip_address] if current_time - t < TIME_WINDOW]

    # Add current click
    ip_click_tracker[ip_address].append(current_time)

    # Check if click count exceeds threshold
    if len(ip_click_tracker[ip_address]) > CLICK_THRESHOLD:
        return True
    return False

# --- Simulation ---
clicks = ["1.2.3.4", "1.2.3.4", "5.6.7.8", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4", "1.2.3.4"]
for ip in clicks:
    if is_fraudulent_click(ip):
        print(f"Fraudulent click detected from IP: {ip}")

This example demonstrates filtering traffic based on suspicious user agents. Many automated bots use generic or headless browser user agents, which can be easily identified and blocked to protect against common forms of invalid traffic.

# List of known suspicious user agents
SUSPICIOUS_USER_AGENTS = [
    "HeadlessChrome",
    "PhantomJS",
    "Scrapy",
    "Selenium"
]

def is_suspicious_user_agent(user_agent_string):
    for suspicious_ua in SUSPICIOUS_USER_AGENTS:
        if suspicious_ua in user_agent_string:
            return True
    return False

# --- Simulation ---
traffic_logs = [
    {"ip": "1.1.1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"},
    {"ip": "2.2.2.2", "user_agent": "Mozilla/5.0 (compatible; Scrapy/2.5.0; +http://scrapy.org)"},
    {"ip": "3.3.3.3", "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.150 Safari/537.36"}
]

for log in traffic_logs:
    if is_suspicious_user_agent(log["user_agent"]):
        print(f"Blocking traffic from {log['ip']} due to suspicious user agent: {log['user_agent']}")

Types of Predictive Analytics

• Classification Models – These models categorize traffic into predefined classes, such as 'fraudulent' or 'legitimate'. They are trained on historical data where clicks have already been labeled, making them effective at identifying known patterns of bot behavior or other invalid activities based on specific attributes.
• Anomaly Detection Models – This approach identifies data points that deviate from a normal baseline. In traffic protection, it is used to flag unusual activity like sudden spikes in clicks from a new location or an impossibly high conversion rate, which could indicate a new type of fraud not seen before.
• Time Series Models – These models analyze data points collected over a sequence of time. For click fraud, they can forecast expected traffic volumes and patterns, and then identify deviations from these predictions. This is useful for detecting abnormal traffic surges that don't align with historical trends or marketing events.
• Behavioral Clustering – This technique groups users based on their on-site behavior, such as mouse movements, scroll speed, and time spent on page. It doesn't require pre-labeled data and can uncover clusters of non-human or bot-like behavior by identifying groups of users with highly similar, unnatural interaction patterns.

How Predictive Modeling Works

Incoming Traffic (Click Data)
           │
           ▼
+---------------------+      +----------------------+
│ Data Collection &   │      │ Historical Data &    │
│ Preprocessing       ├─────►│ Known Fraud Patterns │
│ (IP, UA, Timestamp) │      │ (Training Dataset)   │
+---------------------+      +----------------------+
           │
           ▼
+---------------------+
│ Feature Engineering │
│ (Create Predictors) │
+---------------------+
           │
           ▼
+---------------------+      +----------------------+
│ Predictive Model    ├─────►│  Real-time Scoring   │
│ (e.g., ML Algorithm)│      │   (Fraud vs. Legit)  │
+---------------------+      +----------------------+
           │
           ▼
    +--------------+
    │ Action/Filter│
    └─┬──────────┬─┘
      │          │
      ▼          ▼
  Allow Click   Block Click
 (Legitimate)    (Fraud)

🧠 Core Detection Logic

Example 1: Session Heuristics

This logic assesses the behavior of a user within a single session to determine if it appears automated. It focuses on patterns that are unnatural for human users, such as an excessively high number of clicks in a short period or impossibly fast navigation between pages, to flag suspicious activity.

FUNCTION analyze_session(session_data):
  clicks = session_data.get_click_count()
  duration = session_data.get_duration_in_seconds()
  pages_viewed = session_data.get_pages_viewed()

  // Rule 1: Abnormally high click rate
  IF clicks > 20 AND duration < 10:
    RETURN "FRAUD_HIGH_VELOCITY"

  // Rule 2: No time spent on page (instant bounce)
  IF duration < 1 AND pages_viewed == 1:
    RETURN "FRAUD_ZERO_DWELL_TIME"
  
  // Rule 3: Impossibly fast navigation
  time_per_page = duration / pages_viewed
  IF time_per_page < 0.5:
    RETURN "FRAUD_IMPOSSIBLE_NAVIGATION"

  RETURN "LEGITIMATE"
END FUNCTION

Example 2: IP Reputation Scoring

This logic evaluates the trustworthiness of an IP address based on its history and characteristics. It queries internal and external blocklists to check if the IP is associated with data centers, proxies, or previously identified fraudulent activity, assigning a risk score accordingly.

FUNCTION score_ip_reputation(ip_address):
  score = 0
  
  // Check if IP is from a known data center (common for bots)
  IF is_datacenter_ip(ip_address):
    score += 50

  // Check against internal fraud database
  IF is_in_fraud_database(ip_address):
    score += 40

  // Check if IP is an open proxy
  IF is_proxy_ip(ip_address):
    score += 25
  
  // Assign fraud label based on score threshold
  IF score > 60:
    RETURN "BLOCK_HIGH_RISK_IP"
  ELSE:
    RETURN "ALLOW_LOW_RISK_IP"
END FUNCTION

Example 3: Behavioral Anomaly Detection

This logic establishes a baseline for normal user behavior and flags deviations. It analyzes metrics like mouse movement, scroll velocity, and interaction patterns. Traffic that deviates significantly, such as showing no mouse movement before a click, is identified as likely bot activity.

FUNCTION check_behavioral_anomaly(user_events):
  has_mouse_movement = user_events.has("mouse_move")
  has_scroll_event = user_events.has("scroll")
  has_click_event = user_events.has("click")

  // Bots often click without any preceding mouse movement or scrolling
  IF has_click_event AND NOT has_mouse_movement AND NOT has_scroll_event:
    RETURN "ANOMALY_NO_PRIOR_INTERACTION"
  
  // Humans typically have variable time between events, bots are often uniform
  time_deltas = user_events.get_time_between_events()
  IF standard_deviation(time_deltas) < 0.1:
      RETURN "ANOMALY_UNIFORM_TIMING"

  RETURN "NORMAL_BEHAVIOR"
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Budget Shielding – Predictive modeling proactively identifies and blocks fake clicks before they are registered, preventing invalid traffic from draining advertising budgets and ensuring funds are spent on reaching genuine potential customers.
• Analytics and KPI Integrity – By filtering out bot traffic and other forms of invalid interactions, businesses can maintain clean data in their analytics platforms. This ensures that key performance indicators like CTR and conversion rates reflect true user engagement.
• Return on Ad Spend (ROAS) Optimization – Preventing click fraud means that ad spend is not wasted on clicks that will never convert. This directly improves the efficiency of advertising campaigns, leading to a higher and more accurate return on ad spend.
• Lead Generation Quality Control – For campaigns focused on lead generation, predictive models can filter out automated form submissions and fake sign-ups. This saves sales and marketing teams time by ensuring they only engage with legitimate, high-quality leads.

Example 1: Geofencing Rule

This pseudocode demonstrates a geofencing rule that blocks traffic from locations outside the campaign's target geography. This is a common and effective method to prevent fraud from click farms located in other countries.

FUNCTION apply_geofence(click_data, campaign_rules):
  user_country = click_data.get_country()
  target_countries = campaign_rules.get_allowed_countries()
  
  IF user_country NOT IN target_countries:
    RETURN "BLOCK_GEO_MISMATCH"
  ELSE:
    RETURN "ALLOW_TRAFFIC"
END FUNCTION

Example 2: Session Click Velocity Check

This logic scores a user session based on the rate of clicks. An unusually high number of clicks from a single user in a very short time is a strong indicator of an automated script or bot, which can then be blocked.

FUNCTION check_session_velocity(session):
  MAX_CLICKS_PER_MINUTE = 15
  
  click_timestamps = session.get_click_times()
  
  // Calculate clicks within the last minute
  current_time = now()
  recent_clicks = 0
  FOR time IN click_timestamps:
    IF current_time - time < 60 seconds:
      recent_clicks += 1
  
  IF recent_clicks > MAX_CLICKS_PER_MINUTE:
    RETURN "BLOCK_HIGH_VELOCITY"
  ELSE:
    RETURN "ALLOW_SESSION"
END FUNCTION

Example 3: Device Signature Match

This logic checks for inconsistencies in device or browser properties. For instance, a browser claiming to be Safari on an iPhone should not be running on a Windows operating system. Such mismatches are a red flag for manipulated or spoofed traffic.

FUNCTION validate_device_signature(headers):
  user_agent = headers.get_user_agent()
  platform = headers.get_platform() // e.g., 'Win32', 'MacIntel', 'iPhone'

  // Example Rule: A browser identifying as 'Safari' should not be on 'Win32'
  IF "Safari" in user_agent AND "Chrome" not in user_agent:
    IF platform == "Win32":
      RETURN "BLOCK_SIGNATURE_MISMATCH"
  
  // Example Rule: Check for known bot user agents
  IF "Bot" in user_agent OR "Spider" in user_agent:
    RETURN "BLOCK_BOT_SIGNATURE"
    
  RETURN "ALLOW_VALID_SIGNATURE"
END FUNCTION

🐍 Python Code Examples

This Python function simulates the detection of abnormal click frequency from a single IP address. If an IP exceeds a defined threshold of clicks within a short time window, it is flagged as suspicious, a common pattern for bot activity.

# In-memory store for click timestamps per IP
CLICK_LOGS = {}
TIME_WINDOW_SECONDS = 60
CLICK_THRESHOLD = 20

def is_click_flood(ip_address):
    """Checks if an IP address is generating an abnormally high click rate."""
    import time
    current_time = time.time()
    
    # Get timestamps for this IP, or an empty list if new
    timestamps = CLICK_LOGS.get(ip_address, [])
    
    # Filter out old timestamps
    recent_timestamps = [t for t in timestamps if current_time - t < TIME_WINDOW_SECONDS]
    
    # Add current click time
    recent_timestamps.append(current_time)
    
    # Update the log
    CLICK_LOGS[ip_address] = recent_timestamps
    
    # Check if click count exceeds the threshold
    if len(recent_timestamps) > CLICK_THRESHOLD:
        print(f"ALERT: Click flood detected from IP {ip_address}")
        return True
    
    return False

# Simulation
is_click_flood("192.168.1.10") # Returns False
# Simulate 25 rapid clicks
for _ in range(25):
  is_click_flood("192.168.1.101")

This example demonstrates how to filter traffic based on suspicious user-agent strings. The code checks if a user agent is on a predefined blocklist of known bots or automation tools, which is a straightforward way to reject low-quality traffic.

# A simple list of user agents known for bot activity
BOT_AGENTS_BLOCKLIST = {
    "AhrefsBot",
    "SemrushBot",
    "MJ12bot",
    "DotBot",
    "PetalBot"
}

def filter_by_user_agent(user_agent_string):
    """Filters traffic if the user agent is on the blocklist."""
    for bot_agent in BOT_AGENTS_BLOCKLIST:
        if bot_agent.lower() in user_agent_string.lower():
            print(f"BLOCK: Known bot user agent detected: {user_agent_string}")
            return True
    
    print(f"ALLOW: User agent appears valid: {user_agent_string}")
    return False

# Simulation
filter_by_user_agent("Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)")
filter_by_user_agent("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36")

Types of Predictive Modeling

• Heuristic-Based Modeling – This type uses predefined rules and thresholds based on expert knowledge to identify fraud. For instance, a rule might block any IP address that generates more than 10 clicks in one minute. It is fast and effective against known, simple fraud patterns.
• Behavioral Modeling – This approach focuses on user interaction patterns, such as mouse movements, scroll speed, and time between clicks, to differentiate humans from bots. It is powerful for detecting sophisticated bots that can mimic human-like network signals but fail to replicate genuine user behavior.
• Reputation-Based Modeling – This model assesses the risk of a click based on the reputation of its source, such as the IP address, user agent, or domain. Sources are scored based on their historical involvement in fraudulent activities, allowing for quick filtering of known bad actors.
• Anomaly Detection Models – These unsupervised models establish a baseline of "normal" traffic behavior and then flag any significant deviations as potential fraud. This is highly effective for identifying new and previously unseen fraud tactics that don't match any predefined rules or known patterns.

How Preferred deals Works

Incoming Ad Request
        │
        ▼
+---------------------+
│   DSP Decisioning   │
+---------------------+
        │
        ▼
   [Has Deal ID?]
      /      
    YES       NO
    /          
   ▼            ▼
+----------------+   +----------------------+
│ Preferred Path │   │ Open Exchange Path   │
+----------------+   +----------------------+
        │                    │
┌───────┴───────┐            │
│ Vetted Source │            ▼
│ (Low Risk)    │   +--------------------+
└───────┬───────┘   │ Additional Fraud   │
        │           │ & Quality Scanning │
        │           +--------------------+
        │                    │
        ▼                    ▼
+--------------------------------+
│         Bid Decision           │
+--------------------------------+
        │
        ▼
    Ad Served

🧠 Core Detection Logic

Example 1: Publisher ID Whitelisting

This logic ensures that bids are only considered for publishers that have been pre-vetted and added to a trusted “whitelist.” It’s a foundational step in creating a controlled environment, preventing spend on unknown or low-quality domains entirely. This filtering happens at the very start of the bid evaluation process within a Demand-Side Platform (DSP).

FUNCTION should_bid_on_request(request):
  // Define a set of trusted publisher IDs
  PREFERRED_PUBLISHERS = {'pub-12345', 'pub-67890', 'pub-abcde'}

  publisher_id = request.get_publisher_id()

  // Only proceed if the publisher is on the preferred list
  IF publisher_id IN PREFERRED_PUBLISHERS:
    RETURN TRUE // Allow bidding
  ELSE:
    RETURN FALSE // Block bid, source is not trusted

Example 2: Deal ID Enforcement

This logic gives priority to traffic coming through a specific Preferred Deal. A unique Deal ID is passed in the bid request, and the system is configured to recognize it and apply the pre-negotiated fixed price, bypassing the standard auction. This ensures the deal terms are enforced and separates this traffic from open market competition.

FUNCTION calculate_bid_price(request):
  DEAL_ID = "deal-xyz-789"
  DEAL_PRICE_CPM = 10.00 // Pre-negotiated fixed price

  request_deal_id = request.get_deal_id()

  IF request_deal_id == DEAL_ID:
    // This is our preferred deal, bid the fixed price
    RETURN DEAL_PRICE_CPM
  ELSE:
    // Proceed with standard real-time bidding logic for open market
    RETURN calculate_standard_rtb_price(request)

Example 3: Traffic Quality Score Gating

This logic is used to dynamically manage which publishers qualify for preferred status. It relies on a continuous monitoring system that scores publishers based on metrics like invalid traffic (IVT) rates, viewability, and conversion rates. Publishers must maintain a score above a certain threshold to remain in a preferred program.

FUNCTION update_preferred_status(publisher_stats):
  MIN_QUALITY_SCORE_THRESHOLD = 95.0
  publisher_id = publisher_stats.get_id()
  current_quality_score = publisher_stats.calculate_quality_score()

  // Check if the publisher meets the minimum quality standard
  IF current_quality_score >= MIN_QUALITY_SCORE_THRESHOLD:
    add_to_preferred_list(publisher_id)
    log(f"Publisher {publisher_id} maintained preferred status.")
  ELSE:
    remove_from_preferred_list(publisher_id)
    log(f"Publisher {publisher_id} dropped below quality threshold.")

📈 Practical Use Cases for Businesses

• Campaign Shielding – Advertisers can protect high-budget or brand-sensitive campaigns by exclusively running them on a small set of hand-picked, premium publisher sites. This ensures brand safety and dramatically reduces the risk of ad spend being wasted on fraudulent impressions from the open market.
• Performance Consistency – By limiting ad delivery to publishers that have historically provided high-quality traffic (e.g., high conversion rates, low bot traffic), businesses can achieve more stable and predictable campaign performance and a better return on ad spend.
• Retargeting Integrity – For retargeting campaigns, it is crucial that ads are shown to real users who have previously visited a site. Using Preferred Deals with high-quality publishers ensures that the limited pool of retargeting candidates is reached in fraud-free environments, improving conversion rates.
• Local Market Targeting – A business targeting a specific geographic region can create Preferred Deals with top local news outlets or community sites. This guarantees their budget is spent reaching a relevant, local audience on trusted domains, avoiding widespread, irrelevant, or fraudulent global traffic.

Example 1: Brand Safety Whitelist Rule

A global consumer brand wants to ensure its ads only appear on family-friendly, high-authority news and lifestyle domains. They create a “whitelist” of publisher IDs to enforce this in their buying platform.

// Whitelist rule to ensure brand safety
WHITELISTED_DOMAINS = [
  'premium-news.com',
  'trusted-lifestyle-mag.com',
  'major-sports-network.com'
]

FUNCTION is_brand_safe(bid_request):
  IF bid_request.domain IN WHITELISTED_DOMAINS:
    RETURN TRUE
  ELSE:
    RETURN FALSE

Example 2: High-Value Audience Geofencing

A luxury car brand wants to target high-net-worth individuals in specific zip codes. They create Preferred Deals with publishers known to have this audience and add a geofencing layer to ensure impressions are only bought within those exact regions.

// Geofencing logic for a high-value audience campaign
ALLOWED_ZIP_CODES = {'90210', '10021', '33109'}

FUNCTION is_in_target_geo(bid_request):
  user_zip = bid_request.geo.zip
  IF user_zip IN ALLOWED_ZIP_CODES:
    RETURN TRUE
  ELSE:
    RETURN FALSE

🐍 Python Code Examples

This function simulates a basic check to determine if a given publisher is on an advertiser’s pre-approved list. Using a Python set for the whitelist provides fast lookup times, making the check efficient for real-time bidding environments.

# A simple whitelist of trusted publisher IDs
PREFERRED_PUBLISHER_IDS = {
    "publisher-111",
    "publisher-222",
    "publisher-333",
}

def is_traffic_from_preferred_source(publisher_id):
    """Checks if a publisher ID is in the set of preferred sources."""
    if publisher_id in PREFERRED_PUBLISHER_IDS:
        print(f"'{publisher_id}' is a trusted source. Accepting traffic.")
        return True
    else:
        print(f"'{publisher_id}' is not on the preferred list. Rejecting.")
        return False

# --- Simulation ---
is_traffic_from_preferred_source("publisher-222")
is_traffic_from_preferred_source("unknown-publisher-999")

This example demonstrates how an advertiser might prioritize and price a bid based on whether it comes through a specific Deal ID. If the bid request contains the recognized Deal ID, it applies a pre-negotiated fixed price; otherwise, it could fall back to a default bidding strategy.

def decide_bid_for_impression(impression_data):
    """Decides bid price based on whether a preferred deal ID is present."""
    deal_id = impression_data.get("deal_id")
    
    PREFERRED_DEAL = {
        "id": "DEAL-7890",
        "fixed_cpm": 15.50
    }

    if deal_id == PREFERRED_DEAL["id"]:
        # Traffic is from a preferred deal, use the fixed price
        bid_price = PREFERRED_DEAL["fixed_cpm"]
        print(f"Preferred Deal '{deal_id}' found. Bidding fixed price: ${bid_price}")
        return bid_price
    else:
        # Not a preferred deal, use standard auction logic (e.g., a lower bid)
        bid_price = 2.50
        print(f"No preferred deal. Making a standard bid: ${bid_price}")
        return bid_price

# --- Simulation ---
impression_with_deal = {"id": "imp123", "deal_id": "DEAL-7890"}
impression_without_deal = {"id": "imp456", "deal_id": None}

decide_bid_for_impression(impression_with_deal)
decide_bid_for_impression(impression_without_deal)

Types of Preferred deals

• Private Marketplace (PMP) – An invite-only auction where a publisher makes their inventory available to a select group of advertisers. While technically an auction, the vetted nature of the participants significantly lowers fraud risk compared to the open market. It offers a balance between exclusivity and competitive pricing.
• Programmatic Guaranteed (PG) – A 1-to-1 deal where an advertiser commits to buying a fixed number of impressions from a publisher at a pre-negotiated price. This is the most controlled environment, as inventory is reserved, offering high predictability and brand safety, effectively replacing traditional manual insertion orders with automated efficiency.
• Unreserved Fixed Rate – This is the classic “Preferred Deal” where a publisher offers a buyer a “first look” at inventory at a fixed price, but with no volume guarantee. If the buyer passes, the impression goes to the next priority level. It provides preferential access without the commitment of a guaranteed buy.

How Premium videoondemand PVOD Works

User Interaction → Initial Filtering → [PVOD Challenge] → Behavioral Analysis → Verdict
      │                  │                  │                  │                  │
      │                  │                  │                  │                  └─ (Invalid/Bot)
      │                  │                  │                  │
      │                  │                  │                  └─ (Valid/Human)
      │                  │                  │
      │                  │                  └─ [Mouse/Keyboard/Render Data]
      │                  │
      │                  └─ [IP Reputation/User-Agent Check]
      │
      └─ [Ad Click/Page View]

🧠 Core Detection Logic

Example 1: Session Interaction Scoring

This logic scores a session’s authenticity based on how the client interacts with a PVOD video challenge. It aggregates multiple behavioral signals into a single trust score. A score below a predefined threshold indicates bot-like behavior, which is then flagged for blocking or further review.

FUNCTION evaluate_session(session_data):
  // Initialize scores
  mouse_score = 0
  render_score = 0
  timing_score = 0

  // 1. Analyze mouse movement patterns
  IF session_data.mouse_events > 10 AND session_data.has_humanlike_curves THEN
    mouse_score = 50
  ELSE IF session_data.mouse_events > 0 THEN
    mouse_score = 10
  END IF

  // 2. Verify video rendering proof-of-work
  IF session_data.video_rendered_successfully AND session_data.render_time < 500ms THEN
    render_score = 30
  END IF

  // 3. Check interaction timing
  IF session_data.time_on_page > 5s AND session_data.has_variable_delays THEN
    timing_score = 20
  END IF

  total_score = mouse_score + render_score + timing_score

  IF total_score < 50 THEN
    RETURN "invalid"
  ELSE
    RETURN "valid"
  END IF
END FUNCTION

Example 2: Device and Environment Fingerprinting

This logic checks for inconsistencies between the device's purported identity (user-agent) and its underlying hardware or software signals collected during the PVOD challenge. Such mismatches are a strong indicator of sophisticated bots attempting to spoof their environment.

FUNCTION check_fingerprint(device_data):
  is_consistent = TRUE

  // Check 1: Does the reported OS match the browser's JS navigator object?
  IF device_data.user_agent_os != device_data.navigator_platform THEN
    is_consistent = FALSE
  END IF

  // Check 2: Are automation framework properties present?
  IF device_data.webdriver_flag_present THEN
    is_consistent = FALSE
  END IF

  // Check 3: Is there a mismatch between screen resolution and browser window size?
  IF device_data.screen_resolution == device_data.window_size AND device_data.is_mobile == FALSE THEN
    // Bots often run in maximized windows that perfectly match the screen resolution
    is_consistent = FALSE
  END IF

  RETURN is_consistent
END FUNCTION

Example 3: Network Anomaly Detection

This logic focuses on identifying traffic originating from networks commonly associated with fraud, such as data centers or anonymous proxies. Genuine residential users accessing premium content typically do not use such networks, making this a reliable filtering method.

FUNCTION check_network(ip_address):
  // Look up IP information from a reputation service
  ip_info = query_ip_reputation_service(ip_address)

  // Flag known non-residential traffic
  IF ip_info.type == "datacenter" OR ip_info.type == "proxy" THEN
    RETURN "block"
  END IF

  // Flag traffic from high-risk Autonomous System Numbers (ASNs)
  IF ip_info.asn IN known_fraudulent_asns THEN
    RETURN "block"
  END IF

  // Allow other traffic types for now
  RETURN "allow"
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding – PVOD prevents ad budgets from being wasted by ensuring that ads are served to real humans, not bots. This is achieved by validating each interaction before it is counted as a payable impression or click, directly protecting campaign funds.
• Data Integrity for Analytics – By filtering out non-human traffic, PVOD ensures that website analytics reflect genuine user engagement. This allows businesses to make accurate decisions based on clean data, free from the noise of fraudulent activity.
• Conversion Funnel Protection – The system protects lead generation forms and checkout pages from spam submissions and automated attacks. This ensures that sales and marketing teams engage with legitimate prospects, improving efficiency and conversion rates.
• Return on Ad Spend (ROAS) Improvement – By eliminating fraudulent clicks and impressions, PVOD ensures that advertising spend is directed only toward authentic audiences. This leads to a higher quality of traffic and a more accurate, improved ROAS.

Example 1: Geofencing and Content Restriction Rule

This logic ensures that users accessing geo-restricted video content are physically located in the permitted region, a common requirement for licensed media. Bots often use proxies to bypass these restrictions, and this rule helps detect such mismatches.

FUNCTION validate_geo_access(ip_address, claimed_country):
  // Get actual location from IP address
  actual_location = get_location_from_ip(ip_address)

  // Check for mismatches or proxy usage
  IF actual_location.country != claimed_country THEN
    // Block if the actual country doesn't match the claimed country
    RETURN "block_mismatch"
  ELSE IF actual_location.is_proxy OR actual_location.is_vpn THEN
    // Block if a proxy is detected, even if country matches
    RETURN "block_proxy"
  ELSE
    RETURN "allow"
  END IF
END FUNCTION

Example 2: Session Scoring for Sophisticated Bots

This pseudocode demonstrates a scoring system that evaluates the "humanness" of a session. It assigns points based on various interactions, and a low score indicates a high probability of bot activity. This is effective against bots that can bypass simple checks but fail to mimic complex human behavior.

FUNCTION score_session_authenticity(session_metrics):
  score = 0

  // Award points for human-like mouse activity
  IF session_metrics.mouse_moved_organically THEN
    score += 40
  END IF

  // Award points for plausible time on page
  IF session_metrics.time_on_page BETWEEN 10s AND 300s THEN
    score += 30
  END IF

  // Deduct points for known bot markers
  IF session_metrics.is_headless_browser THEN
    score -= 50
  END IF

  // Deduct points for originating from a data center
  IF session_metrics.ip_type == 'datacenter' THEN
    score -= 20
  END IF

  IF score >= 50 THEN
    RETURN "human"
  ELSE
    RETURN "bot"
  END IF
END FUNCTION

🐍 Python Code Examples

This Python function simulates checking for abnormal click frequency from a single IP address. In a real-world scenario, it would be used to detect click-spamming bots by flagging IPs that exceed a reasonable click threshold within a short time window.

# A simple dictionary to store click timestamps for each IP
ip_click_log = {}
from collections import deque
import time

# Rate limiting settings
MAX_CLICKS = 10
TIME_WINDOW = 60  # in seconds

def is_click_fraud(ip_address):
    current_time = time.time()
    
    # Initialize a deque for the IP if not present
    if ip_address not in ip_click_log:
        ip_click_log[ip_address] = deque()

    # Remove timestamps older than the time window
    while (ip_click_log[ip_address] and 
           current_time - ip_click_log[ip_address] > TIME_WINDOW):
        ip_click_log[ip_address].popleft()

    # Add the new click timestamp
    ip_click_log[ip_address].append(current_time)

    # Check if the number of clicks exceeds the maximum allowed
    if len(ip_click_log[ip_address]) > MAX_CLICKS:
        return True  # Fraudulent activity detected
    
    return False # Looks legitimate

This example demonstrates how to parse a user-agent string to identify suspicious clients. It checks for common markers of automated browsers (like HeadlessChrome) or known malicious bot signatures, helping to filter traffic at an early stage.

def validate_user_agent(user_agent_string):
    suspicious_keywords = ["bot", "spider", "headlesschrome", "crawler"]
    
    ua_lower = user_agent_string.lower()
    
    # Check if the user agent is empty or unusually short
    if not ua_lower or len(ua_lower) < 20:
        return False  # Suspicious

    # Check for known suspicious keywords
    for keyword in suspicious_keywords:
        if keyword in ua_lower:
            return False  # Suspicious

    # Example of a more specific check
    if "Mozilla/5.0" not in user_agent_string:
        return False # Highly irregular for modern browsers
        
    return True  # Appears to be a legitimate user agent

Types of Premium videoondemand PVOD

• Interactive PVOD – This type requires active user engagement with the video element, such as solving a simple puzzle, clicking a specific object within the video, or following an on-screen instruction. Its effectiveness lies in testing for cognitive and motor skills that most bots cannot replicate.
• Passive PVOD – This method operates transparently in the background without disrupting the user experience. It analyzes how a user's browser renders a complex, instrumented video, measuring metrics like frame rate, rendering time, and resource consumption to distinguish between a real browser and a fake or emulated environment.
• Dynamic PVOD – A more advanced form that adapts the difficulty of the challenge based on an initial risk score of the incoming traffic. Low-risk users may experience no challenge at all, while suspicious traffic is met with more complex interactive or passive validation tests to confirm authenticity.
• Honeypot PVOD – This technique involves embedding invisible video elements on a webpage that are designed to be undetectable to human users but discoverable by automated scripts. Any interaction with these honeypots immediately flags the visitor as a bot, providing a clear and decisive signal of fraudulent activity.

How Privacy preserving technologies Works

User Click on Ad → [Data Collection] → +------------------------+
                                 │ Anonymization/Encryption │ → [Fraud Analysis Engine]
                                 +------------------------+             │
                                                                        │
                                +---------------------------+           ↓
[Legitimate Traffic] ← └─┤   Rule-Based Filtering  ├─→ [Suspicious Traffic] → Block/Flag
                                +---------------------------+
                                              ↑
                                              │
                                 +-------------------------+
                                 │   Behavioral Analysis   │
                                 +-------------------------+

🧠 Core Detection Logic

Example 1: Anomalous Click Frequency

This logic identifies when a single source, identified by an anonymized ID, generates an unusually high number of clicks in a short period. It helps prevent automated bots or scripts from rapidly depleting an ad budget. This check is a fundamental part of real-time traffic filtering.

FUNCTION check_click_frequency(session_data):
  // Define time window and click threshold
  time_window = 60 // seconds
  max_clicks = 5

  // Get clicks from the same anonymized ID within the window
  recent_clicks = get_clicks_from_source(session_data.anonymized_id, time_window)

  IF count(recent_clicks) > max_clicks:
    RETURN "fraudulent"
  ELSE:
    RETURN "legitimate"
  ENDIF

Example 2: Session Heuristics and Engagement Scoring

This logic assesses the quality of a session by analyzing user engagement after a click. Low engagement, such as an immediate bounce or no mouse movement, suggests a non-human user. It helps filter out sophisticated bots that can mimic a single click but fail to replicate genuine user interaction.

FUNCTION score_session_engagement(session_metrics):
  // Score is based on engagement signals
  engagement_score = 0

  IF session_metrics.time_on_page > 3:
    engagement_score = engagement_score + 1
  ENDIF

  IF session_metrics.mouse_movements > 10:
    engagement_score = engagement_score + 1
  ENDIF

  IF session_metrics.scroll_depth > 20: // percentage
    engagement_score = engagement_score + 1
  ENDIF

  // If score is too low, flag as suspicious
  IF engagement_score < 1:
    RETURN "suspicious"
  ELSE:
    RETURN "legitimate"
  ENDIF

Example 3: Geo-Mismatch Detection

This logic checks for inconsistencies between the user's reported geographical location and the location of their IP address. Fraudsters often use proxies or VPNs to mask their true location, leading to mismatches that this rule can detect. This is particularly useful for campaigns targeting specific regions.

FUNCTION check_geo_mismatch(click_data):
  // Get location data from different sources
  ip_location = get_location_from_ip(click_data.ip_address)
  user_profile_location = click_data.user_profile.location

  // Compare locations
  IF ip_location != user_profile_location AND user_profile_location IS NOT NULL:
    // Mismatch found, could be a proxy or VPN
    RETURN "fraudulent"
  ELSE:
    RETURN "legitimate"
  ENDIF

📈 Practical Use Cases for Businesses

• Campaign Shielding: Protects advertising budgets by automatically blocking clicks from known fraudulent sources, such as data centers and proxy networks. This ensures that ad spend is directed at genuine users, not bots, maximizing ROI.
• Clean Analytics: Ensures that marketing analytics are based on real human interactions by filtering out bot-driven traffic. This leads to more accurate performance metrics, such as conversion rates and cost per acquisition, enabling better strategic decisions.
• Lead Generation Integrity: Prevents fake form submissions and lead spam by validating traffic sources before a user can interact with lead forms. This saves sales teams time and resources by ensuring they only follow up on legitimate prospects.
• Return on Ad Spend (ROAS) Optimization: Improves ROAS by eliminating wasteful spending on fraudulent clicks. By focusing the budget on legitimate traffic, businesses can achieve higher conversion rates and a better return on their advertising investment.

Example 1: Geofencing Rule for Local Businesses

A local business running a geo-targeted campaign can use this logic to block traffic from outside its service area, a common sign of click fraud.

// Define target business region
target_region = "California"

FUNCTION geofence_filter(click_data):
  // Get location from anonymized IP data
  click_location = get_location(click_data.anonymized_ip)

  IF click_location.region != target_region:
    // Block click if it's outside the target region
    block_traffic(click_data.source_id)
    RETURN "Blocked: Outside of geo-target"
  ELSE:
    RETURN "Allowed"
  ENDIF

Example 2: Session Scoring for E-commerce

An e-commerce site can score traffic based on engagement to differentiate between genuine shoppers and bots that browse without intent to purchase.

FUNCTION score_traffic_quality(session):
  score = 0
  // Low time on site is suspicious
  IF session.time_on_page < 2:
    score = score - 5
  
  // No interaction is suspicious
  IF session.mouse_clicks == 0 AND session.scroll_events == 0:
    score = score - 5

  // Clicks on product images are a good sign
  IF session.product_views > 0:
    score = score + 10

  // High score indicates a real user
  IF score > 0:
    RETURN "High-Quality Traffic"
  ELSE:
    RETURN "Low-Quality Traffic"
  ENDIF

🐍 Python Code Examples

This Python code demonstrates how to detect abnormally high click frequency from a single IP address. It helps identify bots or automated scripts that generate a large number of clicks in a short time frame.

from collections import defaultdict
import time

# Store click timestamps for each IP
clicks = defaultdict(list)
FRAUD_THRESHOLD = 10  # Clicks
TIME_WINDOW = 60  # Seconds

def is_fraudulent(ip_address):
    current_time = time.time()
    
    # Remove clicks outside the time window
    clicks[ip_address] = [t for t in clicks[ip_address] if current_time - t < TIME_WINDOW]
    
    # Add the new click
    clicks[ip_address].append(current_time)
    
    # Check if click count exceeds the threshold
    if len(clicks[ip_address]) > FRAUD_THRESHOLD:
        return True
    return False

# Simulate clicks
print(is_fraudulent("192.168.1.1")) # False
for _ in range(11):
    print(is_fraudulent("192.168.1.1")) # Last one will be True

This code filters traffic based on suspicious user agents. Many bots use generic or outdated user agents, which can be a simple but effective way to block a significant portion of fraudulent traffic.

# List of known suspicious user agents
SUSPICIOUS_USER_AGENTS = [
    "bot",
    "spider",
    "headlesschrome",
    "phantomjs"
]

def filter_by_user_agent(user_agent):
    user_agent_lower = user_agent.lower()
    for suspicious_ua in SUSPICIOUS_USER_AGENTS:
        if suspicious_ua in user_agent_lower:
            return "Blocked: Suspicious User Agent"
    return "Allowed"

# Example
user_agent_1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
user_agent_2 = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
print(f"'{user_agent_1}': {filter_by_user_agent(user_agent_1)}")
print(f"'{user_agent_2}': {filter_by_user_agent(user_agent_2)}")

Types of Privacy preserving technologies

• Homomorphic Encryption: Allows computations to be performed on encrypted data without decrypting it first. In ad fraud, it enables analysis of user behavior for anomalies without exposing the underlying personal data to the detection system.
• Differential Privacy: This technique adds statistical noise to data sets to protect individual identities. It allows advertisers to analyze aggregate trends in click data to identify widespread fraud patterns without being able to single out any individual user's activity.
• Federated Learning: A machine learning approach where a model is trained across multiple decentralized devices holding local data samples, without exchanging the data itself. This can be used to build a global fraud detection model by learning from user behavior on individual devices without centralizing personal information.
• Secure Multi-Party Computation (SMPC): Enables multiple parties to jointly compute a function over their inputs while keeping those inputs private. For example, an advertiser and a publisher could use SMPC to verify a conversion without either side having to reveal their full set of user data.
• Zero-Knowledge Proofs (ZKPs): A cryptographic method where one party can prove to another that they know a value, without revealing any information apart from the fact that they know the value. This could be used to verify that a user meets certain criteria for an ad campaign without revealing the user's specific attributes.

How Private marketplace Works

Advertiser (DSP) → Deal ID → Private Marketplace (PMP) ← Publisher (SSP)
      │                                   │
      └─────────[Bid Request]───────────► │
                                          ├─ 1. Vetting & Verification
                                          ├─ 2. Auction (Invited Bidders Only)
                                          └─ 3. Ad Served (If Bid Wins)
                                              │
                                              ▼
                                         Verified Impression

🧠 Core Detection Logic

Example 1: Publisher Whitelisting

This is the most fundamental logic of a PMP. Instead of reacting to bad traffic, it proactively ensures that ads are only served on a pre-approved list of high-quality, vetted publisher domains. It’s a foundational step in fraud prevention, eliminating the risk of ads appearing on spoofed or low-quality sites common in open exchanges.

// Logic to check if an impression is from an approved PMP publisher

FUNCTION handleBidRequest(request):
  dealId = request.getDealId()
  publisherDomain = request.getPublisherDomain()

  // PMPs are identified by a Deal ID
  IF dealId IS NOT NULL THEN
    // Check if the domain is on the pre-vetted list for this deal
    IF isDomainInPMPList(publisherDomain, dealId) THEN
      RETURN processBid(request)
    ELSE
      // Domain not authorized for this PMP deal, likely spoofing
      RETURN blockRequest("Domain not on PMP whitelist")
    END IF
  ELSE
    // Not a PMP request, handle through open market rules
    RETURN handleOpenMarketRequest(request)
  END IF

Example 2: Deal ID Verification

This logic ensures the integrity of the PMP itself. An advertiser’s DSP will check that the Deal ID received in a bid request is valid and matches the terms agreed upon with the publisher. This prevents fraudsters from injecting fake Deal IDs to try and mimic premium traffic and command higher prices.

// Logic to validate the Deal ID in a bid request

FUNCTION processBid(request):
  dealId = request.getDealId()
  publisherId = request.getPublisherId()
  
  // Retrieve the expected terms for the given Deal ID
  expectedTerms = getPMPTerms(dealId)
  
  IF expectedTerms IS NULL THEN
    // The Deal ID is unknown or invalid
    RETURN rejectBid("Invalid Deal ID")
  END IF
  
  // Verify that the publisher is the one associated with the deal
  IF expectedTerms.publisherId != publisherId THEN
    // Mismatch indicates a fraudulent request
    RETURN rejectBid("Publisher does not match Deal ID")
  END IF

  // Proceed with bidding based on agreed terms
  RETURN createBid(expectedTerms.floorPrice)

Example 3: Enhanced Ad Placement Scrutiny

Within a PMP, advertisers have greater transparency into where their ads will run. This allows for more granular checks, such as verifying ad dimensions, position (e.g., above-the-fold), and surrounding content against the terms of the deal. This mitigates placement fraud like hidden ads or ad stacking.

// Logic to verify ad placement details within a PMP

FUNCTION verifyAdPlacement(request):
  dealId = request.getDealId()
  placementDetails = request.getPlacementInfo()

  // Get the agreed placement rules for this PMP deal
  pmpRules = getPMPPlacementRules(dealId)

  // Check if placement adheres to the rules
  IF placementDetails.position NOT IN pmpRules.allowedPositions THEN
    RETURN flagAsNonCompliant("Ad position violates PMP rules")
  END IF
  
  IF placementDetails.size NOT IN pmpRules.allowedSizes THEN
    RETURN flagAsNonCompliant("Ad size violates PMP rules")
  END IF

  // All placement checks passed
  RETURN placementVerified()

📈 Practical Use Cases for Businesses

• Brand Safety Assurance – Advertisers can ensure their ads appear only on reputable, pre-vetted publisher sites, protecting their brand from association with inappropriate content. This direct relationship fosters trust and transparency.
• Improved Return on Ad Spend (ROAS) – By focusing budget on high-quality, fraud-free inventory, businesses reduce wasted ad spend on invalid clicks and fake impressions, leading to more efficient campaigns and better ROAS.
• Access to Premium Inventory – Businesses gain exclusive access to a publisher’s most valuable ad placements (e.g., homepage takeovers, high-traffic article pages), which are not available on the open market, leading to higher viewability and engagement.
• Supply Chain Transparency – PMPs simplify the programmatic supply chain. Advertisers know exactly who they are buying from, which helps eliminate hidden fees and fraudulent intermediaries that can exist in the more complex open exchange.

Example 1: Securing High-Viewability Placements

A luxury car brand wants to ensure its video ads are only shown above the fold and on specific, premium automotive review sites. They use a PMP to create a deal that enforces these placement rules, guaranteeing high visibility and relevance.

// Pseudocode for a high-viewability PMP deal

DEAL_ID: "LUXURY_AUTO_PMP_2025"
PARTICIPANTS:
  BUYER: "LuxuryCarBrand_DSP"
  SELLERS: ["TopAutoReviews.com", "MotorInsider.net"]
RULES:
  AD_FORMAT: ["video"]
  MIN_VIEWABILITY_SCORE: 75%
  ALLOWED_PLACEMENTS: ["above_the_fold"]
  FLOOR_PRICE: "$25.00 CPM"

Example 2: Geofenced Product Launch

A retail company is launching a new product available only in specific cities. It uses a PMP with local news publishers in those target regions to run its campaign, ensuring the budget is spent only on reaching geographically relevant audiences and avoiding click fraud from outside the target areas.

// Pseudocode for a geo-targeted PMP

DEAL_ID: "RETAIL_LAUNCH_NYC_SF"
PARTICIPANTS:
  BUYER: "BigRetailer_DSP"
  SELLERS: ["NY-Local-News.com", "SF-Chronicle-Online.com"]
RULES:
  GEO_TARGETING: {
    CITIES: ["New York, NY", "San Francisco, CA"]
    RADIUS_EXCLUDE_KM: 50 // Exclude surrounding areas
  }
  DEVICE_TYPE: ["mobile", "desktop"]
  FLOOR_PRICE: "$15.00 CPM"

🐍 Python Code Examples

This Python code demonstrates a basic check against a publisher whitelist, a core principle of PMPs. It simulates a bid request and verifies if the publisher’s domain is on a pre-approved list before allowing the bid to proceed, filtering out unauthorized inventory.

PMP_WHITELIST = {
    "DEAL123": ["premium-news-site.com", "trusted-sports-blog.com"],
    "DEAL456": ["finance-weekly.com"]
}

def process_bid_request(request):
    deal_id = request.get("deal_id")
    domain = request.get("domain")

    if not deal_id:
        print(f"No Deal ID. Sending to open market.")
        return False # Not a PMP deal

    if deal_id in PMP_WHITELIST and domain in PMP_WHITELIST[deal_id]:
        print(f"Domain '{domain}' is whitelisted for Deal ID '{deal_id}'. Accepting bid.")
        return True
    else:
        print(f"Domain '{domain}' is NOT whitelisted for Deal ID '{deal_id}'. Blocking.")
        return False

# Simulate an incoming bid request
bid_request = {"deal_id": "DEAL123", "domain": "premium-news-site.com", "user_id": "xyz-789"}
process_bid_request(bid_request)

This example simulates a traffic scoring system that could be used within a PMP. It assigns a risk score based on known suspicious indicators like datacenter IPs or outdated user agents. Traffic with a high risk score would be blocked, ensuring higher quality within the private marketplace.

import ipaddress

# Known datacenter IP ranges (often a source of bot traffic)
DATACENTER_IP_RANGES = [
    ipaddress.ip_network('198.51.100.0/24'),
    ipaddress.ip_network('203.0.113.0/24')
]
SUSPICIOUS_USER_AGENTS = ["OldBrowser/1.0", "GenericBot/2.1"]

def get_traffic_risk_score(ip_addr, user_agent):
    score = 0
    ip = ipaddress.ip_address(ip_addr)
    
    # Check if IP is from a known datacenter
    for network in DATACENTER_IP_RANGES:
        if ip in network:
            score += 50
            
    # Check for suspicious user agents
    if user_agent in SUSPICIOUS_USER_AGENTS:
        score += 50
        
    return score

# Simulate checking an incoming request
request_ip = "198.51.100.10" # This is a datacenter IP
request_ua = "Mozilla/5.0"
risk_score = get_traffic_risk_score(request_ip, request_ua)

if risk_score > 40:
    print(f"High risk score ({risk_score}). Blocking request.")
else:
    print(f"Low risk score ({risk_score}). Allowing request.")

Types of Private marketplace

• Invite-Only Auctions – This is the standard PMP model where publishers invite a select group of advertisers to bid on premium inventory. Because all participants are vetted, it drastically reduces the risk of bot traffic and domain spoofing prevalent in open auctions.
• Preferred Deals – An advertiser gets a “first look” at inventory before it’s made available to the broader PMP or open auction. They can purchase it at a pre-negotiated fixed price. This offers price predictability and priority access, ensuring traffic quality by locking in trusted sources.
• Programmatic Guaranteed – This model mimics traditional direct ad buys, but uses programmatic pipes for execution. A publisher reserves a specific amount of inventory for one advertiser at a fixed price. It provides the highest level of control and completely eliminates fraud risk from unknown third parties.
• Automated Guaranteed – Similar to Programmatic Guaranteed, this type automates the process of reserving inventory for a single buyer. It focuses on efficiency for direct deals, providing the same brand safety and fraud protection benefits by operating in a one-to-one, trusted environment.

How Private set intersection Works

+----------------------+                            +-----------------------+
│ Advertiser's Data    │                            │ Publisher's Traffic   │
│ (e.g., Fraud List)   │                            │ (e.g., Visitor IPs)   │
+----------------------+                            +-----------------------+
           │                                                    │
           └───────────┐                         ┌────────────┘
                       ▼                         ▼
            +-------------------------------------+
            │   Private Set Intersection Protocol   │
            │   (Secure Cryptographic Comparison)   │
            +-------------------------------------+
                               │
                               ▼
                  +--------------------------+
                  │ Intersection Result      │
                  │ (e.g., Matched Fraud IPs)│
                  +--------------------------+
                               │
                               ▼
                   +------------------------+
                   │ Action (Block/Flag)    │
                   +------------------------+

🧠 Core Detection Logic

Example 1: Vetting Publisher Traffic Against a Blacklist

An advertiser uses PSI to check a publisher’s traffic quality without directly sharing its proprietary blacklist of fraudulent IP addresses. The protocol reveals only the count or specific members of the intersection, allowing the advertiser to assess the publisher’s risk level before committing a larger budget.

FUNCTION VetPublisher(advertiser_blacklist, publisher_traffic_sample):
  // Both parties privately hash their data
  hashed_blacklist = HASH_SET(advertiser_blacklist)
  hashed_traffic = HASH_SET(publisher_traffic_sample)

  // PSI protocol securely finds the intersection
  intersection = PSI_PROTOCOL(hashed_blacklist, hashed_traffic)

  // Advertiser calculates a risk score based on the size of the overlap
  fraud_overlap_percentage = (COUNT(intersection) / COUNT(publisher_traffic_sample)) * 100

  IF fraud_overlap_percentage > 5 THEN
    RETURN "High Risk"
  ELSE
    RETURN "Low Risk"
  ENDIF

Example 2: Identifying Coordinated Bot Attacks Across Campaigns

Two different advertisers collaborate to find botnets targeting them both. They use PSI to compare lists of suspicious user IDs from their respective campaigns. Finding a significant overlap indicates a coordinated attack, which helps them and their ad security provider identify and block the botnet’s signature.

FUNCTION DetectCoordinatedAttack(advertiser_A_users, advertiser_B_users):
  // Data is prepared and sent to the PSI protocol
  // Only the intersection is learned, typically by a trusted third party or one of the advertisers
  shared_bot_list = PSI_PROTOCOL(advertiser_A_users, advertiser_B_users)

  // If a substantial number of users are shared, it signals a coordinated fraud ring
  IF COUNT(shared_bot_list) > 1000 THEN
    // Flag these user IDs for global blocking
    FireAlert("Coordinated attack detected. Shared users: " + COUNT(shared_bot_list))
    BlockUsers(shared_bot_list)
  ENDIF

Example 3: Validating App Installs with Device IDs

A mobile advertiser wants to verify installs generated by an ad network. The advertiser uses PSI to compare the list of device IDs from the network’s install claims with its own first-party list of device IDs that actually opened the app for the first time. The non-intersecting IDs from the network’s list are likely fraudulent.

FUNCTION ValidateAppInstalls(network_claimed_installs, advertiser_first_opens):
  // The advertiser initiates the protocol to find which claimed installs are legitimate
  valid_installs = PSI_PROTOCOL(network_claimed_installs, advertiser_first_opens)

  // The set difference reveals installs that were claimed but never resulted in an app open
  fraudulent_installs = SET_DIFFERENCE(network_claimed_installs, valid_installs)

  // Advertiser can now dispute the cost of these fraudulent installs
  ReportFraudulentInstalls(fraudulent_installs)
  RETURN fraudulent_installs

📈 Practical Use Cases for Businesses

• Campaign Shielding – Protects active campaigns by using PSI to cross-reference incoming traffic against a real-time threat intelligence database, blocking fraudulent clicks before they deplete the advertising budget.
• Secure Data Collaboration – Allows multiple companies (e.g., two advertisers) to pool their fraud data and identify common threats like coordinated bot attacks, without exposing their sensitive customer or campaign data to each other.
• Supply Chain Verification – Enables advertisers to vet publishers and ad networks by securely checking a sample of their audience against internal blacklists of fraudulent user IDs or device IDs, ensuring cleaner traffic sources.
• Enhanced Audience Segmentation – Improves return on ad spend by using PSI to filter known bots and fraudulent users out of targeting segments, ensuring marketing messages reach genuine potential customers.

Example 1: Geolocation Mismatch Rule

// Logic to check if a user ID from a US-only campaign is also on a list of known offshore bot IPs.

FUNCTION CheckGeoMismatch(US_campaign_clicks, offshore_bot_IPs):
  // The advertiser securely checks for overlap
  mismatched_traffic = PSI_PROTOCOL(US_campaign_clicks.getIPs(), offshore_bot_IPs)

  IF COUNT(mismatched_traffic) > 0 THEN
    // Block the matched IPs and flag the campaign for review
    BlockIPs(mismatched_traffic)
    LogIncident("Geo-mismatch fraud detected in US campaign.")
  ENDIF

Example 2: Session Scoring with Threat Intelligence

// Logic to increase a session's fraud score if its device ID is found in a shared threat database.

FUNCTION ScoreSession(session_data, third_party_threat_feed):
  session_device_id = {session_data.getDeviceID()} // Create a set with one item
  score = 0

  // Use PSI to check if the session's device ID is in the threat feed
  is_match = PSI_CARDINALITY_PROTOCOL(session_device_id, third_party_threat_feed)

  IF is_match > 0 THEN
    // If a match is found, significantly increase the fraud score
    score = score + 50
  ENDIF

  RETURN score

🐍 Python Code Examples

Simulating IP Blacklist Matching

This code simulates how PSI can identify fraudulent IP addresses by finding the intersection between a publisher’s traffic log and an advertiser’s private blacklist. In a real implementation, the raw IP lists would not be directly compared; instead, a cryptographic protocol would operate on encrypted, hashed representations of this data.

# Advertiser's private blacklist of known fraudulent IPs
advertiser_blacklist = {"1.2.3.4", "5.6.7.8", "9.10.11.12"}

# Publisher's recent traffic log
publisher_traffic = {"100.1.2.3", "5.6.7.8", "200.4.5.6", "9.10.11.12"}

# In a real PSI protocol, these sets would be encrypted and compared securely.
# Here, we simulate the outcome using Python's set intersection.
def simulate_psi(set1, set2):
    # The '&' operator calculates the intersection of two sets
    return set1 & set2

# The intersection reveals which of the publisher's IPs are on the blacklist
fraudulent_ips_found = simulate_psi(advertiser_blacklist, publisher_traffic)

print(f"Detected fraudulent IPs: {fraudulent_ips_found}")
# Expected Output: Detected fraudulent IPs: {'5.6.7.8', '9.10.11.12'}

Detecting Abnormal Click Frequency

This example demonstrates how to identify users engaging in click fraud by checking which user IDs appear in both a real-time click log and a pre-compiled list of users with suspicious high-frequency activity. PSI enables this check without the click source (e.g., an ad network) needing to see the entire suspicious activity list.

# A list of user IDs flagged for abnormally high activity across the network
suspiciously_active_users = {"user-111", "user-222", "user-333"}

# A list of user IDs that clicked on a specific campaign in the last minute
campaign_click_log = {"user-abc", "user-222", "user-def", "user-111"}

# The PSI protocol simulation finds the common users
def find_high_frequency_fraud(suspicious_list, click_list):
    return suspicious_list.intersection(click_list)

# The result identifies users from the campaign who are known for suspicious behavior
fraudulent_users = find_high_frequency_fraud(suspiciously_active_users, campaign_click_log)

print(f"High-frequency fraudulent users in campaign: {fraudulent_users}")
# Expected Output: High-frequency fraudulent users in campaign: {'user-111', 'user-222'}

Types of Private set intersection

• Diffie-Hellman-based PSI – A classic and widely-used approach where parties use cryptographic key-exchange principles to securely discover the intersection. It’s known for its relative simplicity and efficiency, making it suitable for many real-time fraud detection scenarios where two parties need to compare lists.
• PSI-Cardinality – A variation where the protocol only reveals the *size* of the intersection, not the actual items in it. This is useful for risk assessment, as an advertiser can learn how much overlap their audience has with a known fraud list without identifying specific users.
• Labeled PSI – An enhanced version where one party (e.g., a threat intelligence provider) can attach a label (like “bot” or “proxy”) to their data. When a match is found, the other party receives the corresponding label, providing richer context for fraud detection rules.
• Oblivious Transfer (OT)-based PSI – A highly secure and efficient method that is a building block for many modern PSI protocols. It allows a receiver to obtain one item from a sender’s database without the sender knowing which item was chosen, forming the basis for very private comparisons.
• Authorized PSI (APSI) – A stricter form where each item in a party’s set must be digitally signed by a trusted authority. This prevents a malicious party from fabricating items to probe the other party’s set, making it highly effective against sophisticated fraud attempts.

How Probabilistic modeling Works

Incoming Traffic (Click/Impression)
           │
           ▼
+---------------------+
│ 1. Data Collection  │
│ (IP, UA, Timestamp) │
+---------------------+
           │
           ▼
+-----------------------+
│ 2. Feature Extraction │
│ (Behavior, Session)   │
+-----------------------+
           │
           ▼
+---------------------+
│ 3. Probability      │
│    Scoring Engine   │
└──────────┬──────────┘
           │
           ▼
+---------------------+
│ 4. Decision Logic   │
│ (Threshold Check)   │
+----------┬----------+
           │
           ├─→ [FRAUD] → Block & Report
           │
           └─→ [VALID] → Allow

🧠 Core Detection Logic

Example 1: Session Heuristics

This logic assesses the behavior of a user within a single session to identify non-human patterns. It’s used in real-time traffic filtering to spot bots that perform actions too quickly or in a perfectly uniform manner, which is atypical for human users.

FUNCTION evaluate_session(session_data):
  // Check time between page load and first click
  IF session_data.time_to_first_click < 2 SECONDS:
    session_data.risk_score += 0.3

  // Check for unnaturally smooth mouse movements
  IF session_data.mouse_variance < THRESHOLD_LOW:
    session_data.risk_score += 0.4

  // Check for excessively high number of clicks in short time
  IF session_data.clicks_per_minute > 100:
    session_data.risk_score += 0.5

  RETURN session_data.risk_score

Example 2: Timestamp Anomaly Detection

This logic analyzes the timing of clicks to detect coordinated fraud. It is effective against botnets programmed to execute clicks at specific, unnatural intervals or at odd hours across different geos. This is often used in post-click analysis to find patterns in large datasets.

FUNCTION analyze_timestamps(click_events):
  // Detect rapid, successive clicks from the same source
  FOR i FROM 1 to length(click_events):
    time_diff = click_events[i].timestamp - click_events[i-1].timestamp
    IF time_diff < 1 SECOND:
      flag_as_suspicious(click_events[i])

  // Detect clicks occurring at unusual hours (e.g., 3 AM local time)
  FOR each click IN click_events:
    IF hour(click.timestamp) >= 2 AND hour(click.timestamp) <= 5:
      click.risk_score += 0.25

  RETURN modified_click_events

Example 3: Geographic Mismatch

This logic checks for inconsistencies between different location signals associated with a user. It's crucial for identifying attempts to hide a user's true origin, a common tactic in ad fraud where fraudsters use proxies or VPNs to mimic traffic from high-value regions.

FUNCTION check_geo_mismatch(user_data):
  ip_location = get_location(user_data.ip_address)
  language_header = user_data.browser_language
  timezone_offset = user_data.browser_timezone

  // If IP is in USA but browser language is Russian
  IF ip_location.country == 'USA' AND language_header == 'ru-RU':
    RETURN {status: 'SUSPICIOUS', reason: 'IP/Language Mismatch'}

  // If IP is in Germany but timezone is for Asia/Tokyo
  IF ip_location.country == 'DE' AND timezone_offset == 'UTC+9':
    RETURN {status: 'SUSPICIOUS', reason: 'IP/Timezone Mismatch'}

  RETURN {status: 'VALID'}

📈 Practical Use Cases for Businesses

Probabilistic modeling offers businesses a dynamic and intelligent way to protect their advertising investments and ensure data integrity. By assessing the likelihood of fraud, companies can move beyond simple blocklists and create a more nuanced defense that adapts to new threats. This approach is critical for maximizing return on ad spend (ROAS), maintaining clean analytics for better decision-making, and safeguarding brand reputation.

• Campaign Shielding – Real-time analysis of incoming traffic to filter out fraudulent clicks before they can drain a campaign's budget, ensuring that ad spend is directed toward genuine users.
• Analytics Purification – By assigning fraud probability scores to events, businesses can cleanse their analytics data. This leads to more accurate reporting on user engagement, conversion rates, and campaign performance.
• ROAS Optimization – Eliminating spend on fraudulent traffic means that the return on ad spend is calculated based on legitimate interactions, providing a true measure of campaign effectiveness and profitability.
• Budget Protection – Probabilistic models help prevent sudden budget depletion from large-scale bot attacks by identifying anomalous traffic spikes and blocking them before significant financial damage occurs.

Example 1: Geofencing Rule

A business wants to ensure that traffic claiming to be from a high-value country is legitimate. This pseudocode checks for consistency between the IP address location and the browser's timezone, a common method for unmasking proxy usage.

FUNCTION enforce_geofencing(traffic_event):
  ip_geo = get_geo_from_ip(traffic_event.ip)
  browser_timezone = traffic_event.headers.timezone

  // Target campaign is for USA (UTC-4 to UTC-10)
  IF ip_geo.country == 'USA':
    IF browser_timezone NOT IN ['UTC-4', 'UTC-5', 'UTC-6', 'UTC-7', 'UTC-8', 'UTC-9', 'UTC-10']:
      // High probability of proxy usage
      traffic_event.fraud_score = 0.9
      block_request(traffic_event)
      RETURN 'BLOCKED'
    END IF
  END IF
  RETURN 'ALLOWED'

Example 2: Session Velocity Scoring

To prevent rapid-fire bot clicks, this logic scores a session based on the speed and frequency of events. A user session that racks up an abnormally high number of clicks in a few seconds is assigned a high fraud probability score.

FUNCTION score_session_velocity(session):
  start_time = session.start_timestamp
  current_time = now()
  click_count = session.click_count
  
  session_duration_seconds = current_time - start_time
  
  IF session_duration_seconds < 10 AND click_count > 15:
    // 15+ clicks in under 10 seconds is highly suspicious
    session.fraud_probability = 0.95
  ELSE IF session_duration_seconds < 30 AND click_count > 30:
    session.fraud_probability = 0.85
  ELSE:
    session.fraud_probability = 0.1
  END IF
  
  RETURN session.fraud_probability

🐍 Python Code Examples

Example 1: Detect Abnormal Click Frequency

This script analyzes a list of click timestamps from a single IP address to determine if the frequency exceeds a reasonable threshold, a common sign of an automated bot.

def analyze_click_frequency(timestamps, time_window_seconds=60, click_threshold=20):
    """Checks if the number of clicks within a time window is suspicious."""
    if len(timestamps) < click_threshold:
        return False

    timestamps.sort()
    
    for i in range(len(timestamps) - click_threshold + 1):
        # Calculate time difference between the first and last click in the window
        time_diff = timestamps[i + click_threshold - 1] - timestamps[i]
        
        if time_diff.total_seconds() < time_window_seconds:
            print(f"Fraudulent activity detected: {click_threshold} clicks in under {time_window_seconds} seconds.")
            return True
            
    return False

# Example Usage:
from datetime import datetime, timedelta
# Simulate a rapid burst of clicks
clicks = [datetime.now() + timedelta(seconds=x*0.5) for x in range(25)]
analyze_click_frequency(clicks)

Example 2: Filter Suspicious User Agents

This code checks a user agent string against a list of known suspicious or outdated patterns. Bots often use generic, headless, or non-standard user agents that can be flagged.

def filter_suspicious_user_agents(user_agent):
    """Identifies user agents associated with bots or automation tools."""
    suspicious_patterns = [
        "HeadlessChrome",  # Common for automated scripts
        "PhantomJS",       # A headless browser used for automation
        "curl/",           # Command-line tool, not a real user
        "Python-urllib",   # Python script library
        "bot",             # General keyword for bots
    ]
    
    for pattern in suspicious_patterns:
        if pattern.lower() in user_agent.lower():
            print(f"Suspicious User-Agent detected: {user_agent}")
            return True
            
    return False

# Example Usage:
ua_string = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/90.0.4430.93 Safari/537.36"
filter_suspicious_user_agents(ua_string)

Example 3: Score Traffic Authenticity

This example demonstrates a simple probabilistic scoring function. It takes multiple factors (e.g., IP reputation, user agent validity, click timing) and combines their individual risk scores into a final probability of fraud.

def calculate_fraud_score(ip_risk, ua_is_suspicious, timing_anomaly_score):
    """Calculates a combined fraud score based on multiple risk factors."""
    # Weights for each factor
    weights = {
        "ip": 0.5,
        "ua": 0.3,
        "timing": 0.2
    }
    
    # Normalize suspicious UA to a score of 1.0 if True, 0.0 if False
    ua_score = 1.0 if ua_is_suspicious else 0.0
    
    # Calculate weighted average score
    final_score = (ip_risk * weights["ip"] + 
                   ua_score * weights["ua"] + 
                   timing_anomaly_score * weights["timing"])
                   
    return final_score

# Example Usage:
# Assume: IP has a known risk score of 0.8 (from a database)
# Assume: User agent was flagged as suspicious
# Assume: Timing analysis yielded an anomaly score of 0.6
score = calculate_fraud_score(ip_risk=0.8, ua_is_suspicious=True, timing_anomaly_score=0.6)
print(f"Final Fraud Probability Score: {score:.2f}")

if score > 0.7:
    print("Action: Block this request.")

Types of Probabilistic modeling

• Heuristic-Based Modeling – This type uses a set of "rules of thumb" or heuristics to calculate a fraud score. Each rule that is met adds to the overall probability of fraud. It is effective for catching known fraud patterns, such as rapid clicks from a single IP address.
• Bayesian Networks – These models map out the conditional dependencies between different variables (e.g., IP address, device type, time of day). They are powerful for understanding how different factors collectively contribute to the likelihood of fraud, even with incomplete data.
• Behavioral Modeling – This approach focuses on creating a baseline of normal user behavior and then flags deviations from it. By analyzing session duration, click-through rates, and post-click activity, it can identify behavior that is too random or too perfect to be human.
• Temporal Analysis Models – These models focus specifically on the time element of interactions. They analyze patterns over different time scales (seconds, minutes, hours) to detect coordinated attacks or unnatural timing, which are strong indicators of automated bot activity.
• Ensemble Models – This method combines multiple different probabilistic models (like logistic regression and decision trees) to produce a single, more accurate prediction. By leveraging the strengths of various algorithms, ensemble models can identify a wider range of fraudulent activities with greater confidence.

How Programmatic DSP Works

Ad Request from Publisher → +-------------------------+
                           │   Programmatic DSP      │
                           │                         │
                           │ ┌─────────────────────┐ │
                           │ │ Pre-Bid Analysis    │ │
                           │ │ (IP, User Agent,    │ │
                           │ │  Geo, Behavior)     │ │
                           │ └─────────┬───────────┘ │
                           │           ↓             │
                           │ ┌─────────────────────┐ │
                           │ │ Fraud Check         │ │
                           │ │ (Blocklists, Rules) │ │
                           │ └─────────┬───────────┘ │
                           │           ↓             │
                           │  ┌────────┴───────┐   │
                           │  │ Bid? (Yes/No)  │   │
                           └─-└┬--------------┘----┘
                                 │
                 (No) ─ Stop     └─ (Yes) → Serve Ad

🧠 Core Detection Logic

Example 1: IP Blocklist Filtering

This logic prevents bids on traffic originating from sources known to be associated with non-human activity, such as data centers or public proxies. It is one of the most fundamental pre-bid checks performed by a DSP to eliminate common bot traffic before it consumes ad spend.

FUNCTION check_ip_reputation(ip_address):
  // Pre-defined list of fraudulent IP ranges (e.g., data centers)
  DATA_CENTER_IPS = ["198.51.100.0/24", "203.0.113.0/24"]
  
  FOR each blocked_range in DATA_CENTER_IPS:
    IF ip_address is within blocked_range:
      RETURN "BLOCK"
      
  RETURN "ALLOW"

// --- Usage ---
bid_request_ip = "198.51.100.10"
decision = check_ip_reputation(bid_request_ip) 
// Decision will be "BLOCK"

Example 2: Session Click Frequency Heuristics

This logic identifies non-human behavior by tracking the number of clicks from a single user session within a short timeframe. An impossibly high click rate is a strong indicator of an automated script or bot, prompting the DSP to disqualify the traffic.

FUNCTION analyze_session_clicks(user_id, click_timestamp):
  // Storage of recent click times per user
  SESSION_CLICKS = get_user_session_data(user_id)
  
  // Define rule: max 3 clicks within 10 seconds
  MAX_CLICKS = 3
  TIMEFRAME_SECONDS = 10
  
  // Add current click and filter out old ones
  SESSION_CLICKS.add(click_timestamp)
  SESSION_CLICKS = filter_old_clicks(SESSION_CLICKS, TIMEFRAME_SECONDS)
  
  IF count(SESSION_CLICKS) > MAX_CLICKS:
    RETURN "FLAG_AS_FRAUD"
    
  RETURN "VALID_SESSION"

// --- Usage ---
// User clicks 4 times in 5 seconds
user_clicks_fast = analyze_session_clicks("user-123", now())
// Result is "FLAG_AS_FRAUD"

Example 3: Geo Mismatch Detection

This rule flags traffic where there is a significant discrepancy between the location derived from the user’s IP address and other location data available in the bid request (e.g., GPS data from a mobile app). Such mismatches can indicate attempts to spoof location to target high-value regions.

FUNCTION check_geo_mismatch(ip_address, device_gps_coords):
  ip_location = get_location_from_ip(ip_address) // e.g., "USA"
  gps_location = get_location_from_coords(device_gps_coords) // e.g., "Vietnam"
  
  // If GPS data exists and doesn't match the IP country, flag it.
  IF device_gps_coords is not NULL and ip_location != gps_location:
    RETURN "HIGH_RISK_GEO"
    
  RETURN "GEO_OK"

// --- Usage ---
ip = "1.2.3.4" // Registered in USA
gps = {lat: 10.82, lon: 106.62} // Ho Chi Minh City, Vietnam
risk_status = check_geo_mismatch(ip, gps)
// risk_status will be "HIGH_RISK_GEO"

📈 Practical Use Cases for Businesses

• Campaign Shielding: A DSP automatically filters out impressions from known fraudulent sources like data centers or botnets, ensuring that ad budgets are spent on reaching genuine potential customers, not on fake traffic that provides no value.
• Budget Optimization: By avoiding bids on low-quality or fraudulent inventory, a DSP helps lower the effective cost per acquisition (CPA). Resources are automatically channeled toward publishers and audiences that deliver real engagement and conversions, improving overall return on ad spend (ROAS).
• Analytics Integrity: Preventing fraudulent clicks and impressions at the source ensures that campaign performance data remains clean and reliable. This allows businesses to make accurate decisions based on real user behavior, rather than data skewed by bot activity.

Example 1: Geofencing Rule

A business wants to run a campaign targeted only at users in Canada. The DSP implements a strict geofencing rule to automatically reject any bid request where the user’s IP address is not located in Canada, preventing spend on irrelevant and potentially fraudulent out-of-market traffic.

FUNCTION apply_geo_fence(bid_request):
  ALLOWED_COUNTRIES = ["CA"]
  user_country = get_country_from_ip(bid_request.ip)

  IF user_country in ALLOWED_COUNTRIES:
    RETURN "BID"
  ELSE:
    RETURN "REJECT"

// --- Usage ---
// Bid request from a US IP address
request_from_us = {ip: "73.12.144.11"}
decision = apply_geo_fence(request_from_us) // Returns "REJECT"

// Bid request from a Canadian IP address
request_from_ca = {ip: "142.114.115.0"}
decision = apply_geo_fence(request_from_ca) // Returns "BID"

Example 2: Session Risk Scoring

To combat sophisticated bots, a DSP scores each bid request based on multiple risk factors. For instance, traffic from a data center gets a high-risk score, while traffic from a common residential ISP gets a low score. The DSP will only bid if the total risk score is below a predefined threshold.

FUNCTION calculate_risk_score(bid_request):
  score = 0
  
  // Rule 1: IP Type
  ip_info = get_ip_info(bid_request.ip)
  IF ip_info.type == "Data Center":
    score += 50
  ELSE IF ip_info.type == "Residential":
    score += 5
    
  // Rule 2: User Agent Anomaly
  ua_string = bid_request.user_agent
  IF is_known_bot_ua(ua_string) OR is_ua_incomplete(ua_string):
    score += 40
    
  RETURN score

// --- Usage ---
// A request from a data center IP
request = {ip: "198.51.100.10", user_agent: "Mozilla/5.0..."}
risk = calculate_risk_score(request) // risk = 50

// Only bid if risk is below 40
IF risk < 40:
  // Place bid
ELSE:
  // Reject bid

🐍 Python Code Examples

This function detects abnormally high click frequency from a single user ID. It is useful for identifying automated clicker bots that generate a large volume of clicks in an unrealistically short period, a common sign of click fraud.

from collections import deque
import time

CLICK_HISTORY = {}
TIME_WINDOW = 60  # seconds
MAX_CLICKS_IN_WINDOW = 5

def is_click_fraud(user_id):
    """Checks if a user's click frequency is suspiciously high."""
    current_time = time.time()
    
    if user_id not in CLICK_HISTORY:
        CLICK_HISTORY[user_id] = deque()
        
    # Remove clicks older than the time window
    while CLICK_HISTORY[user_id] and CLICK_HISTORY[user_id] < current_time - TIME_WINDOW:
        CLICK_HISTORY[user_id].popleft()
        
    # Add the new click and check the count
    CLICK_HISTORY[user_id].append(current_time)
    
    if len(CLICK_HISTORY[user_id]) > MAX_CLICKS_IN_WINDOW:
        return True # Fraudulent activity detected
        
    return False

# Example Usage
user = "user-abc-123"
for _ in range(6):
    print(f"Click registered for {user}. Is it fraud? {is_click_fraud(user)}")
    time.sleep(1)

This script filters traffic based on suspicious user-agent strings. It helps block requests from known bots, crawlers, or headless browsers that are not declared, which is a common technique for generating invalid impressions and clicks at scale.

SUSPICIOUS_USER_AGENTS = [
    "HeadlessChrome", 
    "PhantomJS",
    "DataMiner",
    "AhrefsBot"
]

def filter_by_user_agent(user_agent_string):
    """Filters traffic based on a blocklist of user agents."""
    if not user_agent_string or any(suspicious in user_agent_string for suspicious in SUSPICIOUS_USER_AGENTS):
        print(f"Blocking suspicious user agent: {user_agent_string}")
        return False # Block request
    
    print(f"Allowing user agent: {user_agent_string}")
    return True # Allow request

# Example Usage
ua_real = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
ua_bot = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.150 Safari/537.36"

filter_by_user_agent(ua_real)
filter_by_user_agent(ua_bot)

Types of Programmatic DSP

• Pre-Bid Filtering DSP: This type focuses on analyzing and filtering traffic before an ad bid is ever placed. It uses real-time data like IP address and user agent to reject suspicious impressions instantly, preventing ad spend on obvious fraud and ensuring budget efficiency.
• Post-Bid Analysis DSP: While all DSPs operate pre-bid, some enhance their models using post-bid data. After an ad is served, they analyze performance metrics (e.g., conversions, bounce rates) to identify anomalies, then use these insights to refine pre-bid filters for future campaigns.
• AI-Driven DSP: This advanced DSP uses machine learning algorithms to detect sophisticated and evolving fraud patterns that static rules might miss. By analyzing vast datasets, it can identify human-like bot behavior, session hijacking, and other advanced threats in real time.
• Brand Safety-Focused DSP: This variant prioritizes placing ads in brand-safe and suitable contexts, which indirectly helps prevent fraud. It heavily vets publishers and uses contextual analysis to avoid low-quality sites that often rely on fraudulent traffic to generate revenue.

How Programmatic guaranteed Works

+-------------------+      +----------------------+      +---------------------+
|   Advertiser      |      |      Publisher       |      |    Ad Platform      |
| (Demand-Side)     |      | (Supply-Side)        |      | (DSP/SSP)           |
+-------------------+      +----------------------+      +---------------------+
         │                         │                         │
         │ 1. Negotiate Deal       │                         │
         ├─────────────────────────►                         │
         │ (Price, Volume,         │                         │
         │  Targeting)             │                         │
         │                         │                         │
         │                         │ 2. Reserve Inventory   │
         │                         ├─────────────────────────►
         │                         │                         │
         │                         │                         │
         │◄────────────────────────| 3. Generate Deal ID    │
         │                         │                         │
         │                         │                         │
         │  4. Send Ad Request     │                         │
         ├───────────────────────────────────────────────────►
         │   (with Deal ID)        │                         │
         │                         │                         │
         │                         │                         │
         │                         │     +------------------+
         │                         │     | Fraud Detection  |
         │                         │     | Layer (Pre-Bid)  |
         │                         │     +------------------+
         │                         │              │
         │                         │  5. Validate Request
         │                         │◄─────────────┤
         │                         │              │
         │                         │              │
         │                         │  6. Serve Ad if Valid
         └─────────────────────────|──────────────┤
                                   │              │

🧠 Core Detection Logic

Example 1: Pre-Bid IP Reputation Scoring

This logic checks the reputation of an incoming IP address against a known blocklist before the ad request is processed. It is a fundamental layer of defense in a traffic protection system, preventing interaction with sources that have a history of fraudulent activity. This happens in real-time to stop fraud before an ad is served.

FUNCTION handle_ad_request(request):
  ip_address = request.get_ip()
  
  // Check against a real-time IP reputation blocklist
  IF is_on_blocklist(ip_address):
    // Flag as fraudulent and reject the bid
    RETURN { status: "rejected", reason: "IP on blocklist" }
  ELSE:
    // Proceed with ad serving
    RETURN { status: "approved" }
  ENDIF
END FUNCTION

Example 2: Session Heuristics and Behavior Analysis

This logic analyzes user behavior within a single session to identify non-human patterns. It looks for anomalies like impossibly fast clicks after a page load or an unusually high number of ad interactions in a short time. This helps detect sophisticated bots that may have clean IPs but exhibit unnatural behavior.

FUNCTION analyze_session(session_data):
  click_timestamps = session_data.get_clicks()
  page_load_time = session_data.get_load_time()
  
  // Rule: Check for clicks happening too soon after page load
  FOR each_click_time IN click_timestamps:
    time_to_click = each_click_time - page_load_time
    IF time_to_click < 2_SECONDS: // Threshold for humanly possible interaction
      RETURN { is_fraud: TRUE, reason: "Implausible click speed" }
    ENDIF
  ENDFOR
  
  // Rule: Check for an excessive number of clicks in a short period
  IF count(click_timestamps) > 10 WITHIN 60_SECONDS:
    RETURN { is_fraud: TRUE, reason: "Abnormal click frequency" }
  ENDIF
  
  RETURN { is_fraud: FALSE }
END FUNCTION

Example 3: Geo Mismatch Detection

This logic cross-references the geographic location claimed in the bid request with the location derived from the IP address. A significant mismatch can indicate domain spoofing or a proxy server being used to mask the true origin of the traffic, which is a common tactic in ad fraud.

FUNCTION verify_geo_data(request):
  declared_country = request.get_declared_geo().country
  ip_address = request.get_ip()
  
  // Use a geo-IP lookup service to get the IP's actual location
  ip_geo_info = lookup_ip_location(ip_address)
  actual_country = ip_geo_info.country
  
  // Compare declared country with the IP's country
  IF declared_country != actual_country:
    // Flag the discrepancy for review or automatic rejection
    RETURN { is_valid: FALSE, reason: "Geographic mismatch" }
  ELSE:
    RETURN { is_valid: TRUE }
  ENDIF
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding: Programmatic guaranteed allows businesses to pre-negotiate with trusted publishers, ensuring ads run in brand-safe environments. This direct relationship minimizes exposure to fraudulent domains and improves overall campaign integrity, protecting advertising budgets from being wasted on invalid traffic.
• Improved Return on Ad Spend (ROAS): By guaranteeing impressions on premium inventory, advertisers can reach high-value audiences more effectively. Integrated fraud detection ensures that the budget is spent on real users, leading to cleaner analytics, more reliable performance metrics, and a higher ROAS.
• Enhanced Analytics and Optimization: With traffic filtered for fraud, the resulting campaign data is more accurate. Businesses can make better optimization decisions based on real user engagement, not skewed metrics from bots. This leads to more efficient budget allocation and smarter retargeting strategies.
• Brand Safety Assurance: Advertisers have direct control over where their ads appear, avoiding placements on inappropriate or low-quality sites. This direct-buy nature, combined with fraud verification, protects brand reputation and ensures a positive association between the ad and the content.

Example 1: Geofencing for Local Campaigns

FUNCTION filter_by_geofence(request, campaign_rules):
  // Get IP address from the incoming ad request
  ip_address = request.get_ip()
  
  // Look up the geographic location of the IP
  user_location = get_location_from_ip(ip_address)
  
  // Check if the user's location is within the campaign's target area
  IF user_location.is_within(campaign_rules.target_geofence):
    // Allow the bid to proceed
    return "ALLOW"
  ELSE:
    // Block the bid as it's outside the desired geographic area
    return "BLOCK"
  ENDIF
END FUNCTION

Example 2: Bot Signature Matching

FUNCTION check_bot_signature(request):
  // Extract user agent string and other header information
  user_agent = request.get_header("User-Agent")
  
  // Maintain a database of known bot signatures
  bot_signatures = ["KnownBot/1.0", "BadCrawler/2.1", "DataScraper/3.0"]
  
  // Check if the request's user agent matches a known bot signature
  FOR signature IN bot_signatures:
    IF signature in user_agent:
      // Flag as a bot and reject the request
      return { is_bot: TRUE, reason: "Matched known bot signature" }
    ENDIF
  ENDFOR
  
  return { is_bot: FALSE }
END FUNCTION

🐍 Python Code Examples

This code filters out ad clicks originating from IP addresses known for fraudulent activity. It checks an incoming IP against a predefined set of suspicious IPs to block invalid traffic in real-time.

# A simple set of suspicious IP addresses for demonstration
FRAUDULENT_IPS = {"192.168.1.101", "10.0.0.5", "203.0.113.15"}

def filter_suspicious_ips(click_event):
    """
    Checks if a click event's IP is in the fraudulent IP set.
    """
    ip_address = click_event.get("ip")
    if ip_address in FRAUDULENT_IPS:
        print(f"Fraudulent click detected from IP: {ip_address}")
        return False  # Block the click
    return True  # Allow the click

# Example usage
click = {"ip": "203.0.113.15", "ad_id": "ad-123"}
if filter_suspicious_ips(click):
    print("Click is valid.")
else:
    print("Click was blocked.")

This script analyzes a series of clicks to detect abnormally high click frequencies from a single IP address within a short time frame. Such patterns are indicative of bot activity rather than genuine user interaction.

from collections import defaultdict
import time

CLICK_LOG = defaultdict(list)
TIME_WINDOW = 60  # seconds
CLICK_THRESHOLD = 15 # max clicks allowed in the time window

def detect_abnormal_click_frequency(click_event):
    """
    Analyzes click frequency to identify potential bot activity.
    """
    ip_address = click_event.get("ip")
    current_time = time.time()

    # Clean up old clicks outside the time window
    CLICK_LOG[ip_address] = [t for t in CLICK_LOG[ip_address] if current_time - t < TIME_WINDOW]

    # Add the new click
    CLICK_LOG[ip_address].append(current_time)

    # Check if the click count exceeds the threshold
    if len(CLICK_LOG[ip_address]) > CLICK_THRESHOLD:
        print(f"Abnormal click frequency detected for IP: {ip_address}")
        return False  # Flag as fraud
    return True  # Clicks are within normal limits

# Example usage
for _ in range(16):
    detect_abnormal_click_frequency({"ip": "198.51.100.20"})

Types of Programmatic guaranteed

• Programmatic Direct: This is the foundational type where an advertiser and publisher agree to a direct deal for ad inventory. It bypasses auctions for a fixed price and guaranteed volume, offering transparency and control over ad placements. This setup is ideal for minimizing fraud by working only with trusted partners.
• Preferred Deals: A variation where a publisher offers inventory to a specific advertiser at a fixed price before it’s made available in a private or open auction. While the price is negotiated, the volume isn’t guaranteed, giving the advertiser a “first look” at premium placements with more flexibility than a standard guaranteed deal.
• Private Marketplace (PMP): This is an invitation-only auction where a publisher makes inventory available to a select group of advertisers. While not strictly “guaranteed” like a one-to-one deal, it provides a more controlled, fraud-resistant environment than the open market by limiting participation to vetted buyers.
• Automated Guaranteed: This refers to the technology-driven execution of a programmatic guaranteed deal. It automates the one-to-one arrangement of buying reserved inventory, combining the security and predictability of a traditional direct buy with the efficiency of programmatic platforms.