Programmatic DSP

How Programmatic DSP Works

Ad Request from Publisher → +-------------------------+
                           │   Programmatic DSP      │
                           │                         │
                           │ ┌─────────────────────┐ │
                           │ │ Pre-Bid Analysis    │ │
                           │ │ (IP, User Agent,    │ │
                           │ │  Geo, Behavior)     │ │
                           │ └─────────┬───────────┘ │
                           │           ↓             │
                           │ ┌─────────────────────┐ │
                           │ │ Fraud Check         │ │
                           │ │ (Blocklists, Rules) │ │
                           │ └─────────┬───────────┘ │
                           │           ↓             │
                           │  ┌────────┴───────┐   │
                           │  │ Bid? (Yes/No)  │   │
                           └─-└┬--------------┘----┘
                                 │
                 (No) ─ Stop     └─ (Yes) → Serve Ad

🧠 Core Detection Logic

Example 1: IP Blocklist Filtering

This logic prevents bids on traffic originating from sources known to be associated with non-human activity, such as data centers or public proxies. It is one of the most fundamental pre-bid checks performed by a DSP to eliminate common bot traffic before it consumes ad spend.

FUNCTION check_ip_reputation(ip_address):
  // Pre-defined list of fraudulent IP ranges (e.g., data centers)
  DATA_CENTER_IPS = ["198.51.100.0/24", "203.0.113.0/24"]
  
  FOR each blocked_range in DATA_CENTER_IPS:
    IF ip_address is within blocked_range:
      RETURN "BLOCK"
      
  RETURN "ALLOW"

// --- Usage ---
bid_request_ip = "198.51.100.10"
decision = check_ip_reputation(bid_request_ip) 
// Decision will be "BLOCK"

Example 2: Session Click Frequency Heuristics

This logic identifies non-human behavior by tracking the number of clicks from a single user session within a short timeframe. An impossibly high click rate is a strong indicator of an automated script or bot, prompting the DSP to disqualify the traffic.

FUNCTION analyze_session_clicks(user_id, click_timestamp):
  // Storage of recent click times per user
  SESSION_CLICKS = get_user_session_data(user_id)
  
  // Define rule: max 3 clicks within 10 seconds
  MAX_CLICKS = 3
  TIMEFRAME_SECONDS = 10
  
  // Add current click and filter out old ones
  SESSION_CLICKS.add(click_timestamp)
  SESSION_CLICKS = filter_old_clicks(SESSION_CLICKS, TIMEFRAME_SECONDS)
  
  IF count(SESSION_CLICKS) > MAX_CLICKS:
    RETURN "FLAG_AS_FRAUD"
    
  RETURN "VALID_SESSION"

// --- Usage ---
// User clicks 4 times in 5 seconds
user_clicks_fast = analyze_session_clicks("user-123", now())
// Result is "FLAG_AS_FRAUD"

Example 3: Geo Mismatch Detection

This rule flags traffic where there is a significant discrepancy between the location derived from the user’s IP address and other location data available in the bid request (e.g., GPS data from a mobile app). Such mismatches can indicate attempts to spoof location to target high-value regions.

FUNCTION check_geo_mismatch(ip_address, device_gps_coords):
  ip_location = get_location_from_ip(ip_address) // e.g., "USA"
  gps_location = get_location_from_coords(device_gps_coords) // e.g., "Vietnam"
  
  // If GPS data exists and doesn't match the IP country, flag it.
  IF device_gps_coords is not NULL and ip_location != gps_location:
    RETURN "HIGH_RISK_GEO"
    
  RETURN "GEO_OK"

// --- Usage ---
ip = "1.2.3.4" // Registered in USA
gps = {lat: 10.82, lon: 106.62} // Ho Chi Minh City, Vietnam
risk_status = check_geo_mismatch(ip, gps)
// risk_status will be "HIGH_RISK_GEO"

📈 Practical Use Cases for Businesses

• Campaign Shielding: A DSP automatically filters out impressions from known fraudulent sources like data centers or botnets, ensuring that ad budgets are spent on reaching genuine potential customers, not on fake traffic that provides no value.
• Budget Optimization: By avoiding bids on low-quality or fraudulent inventory, a DSP helps lower the effective cost per acquisition (CPA). Resources are automatically channeled toward publishers and audiences that deliver real engagement and conversions, improving overall return on ad spend (ROAS).
• Analytics Integrity: Preventing fraudulent clicks and impressions at the source ensures that campaign performance data remains clean and reliable. This allows businesses to make accurate decisions based on real user behavior, rather than data skewed by bot activity.

Example 1: Geofencing Rule

A business wants to run a campaign targeted only at users in Canada. The DSP implements a strict geofencing rule to automatically reject any bid request where the user’s IP address is not located in Canada, preventing spend on irrelevant and potentially fraudulent out-of-market traffic.

FUNCTION apply_geo_fence(bid_request):
  ALLOWED_COUNTRIES = ["CA"]
  user_country = get_country_from_ip(bid_request.ip)

  IF user_country in ALLOWED_COUNTRIES:
    RETURN "BID"
  ELSE:
    RETURN "REJECT"

// --- Usage ---
// Bid request from a US IP address
request_from_us = {ip: "73.12.144.11"}
decision = apply_geo_fence(request_from_us) // Returns "REJECT"

// Bid request from a Canadian IP address
request_from_ca = {ip: "142.114.115.0"}
decision = apply_geo_fence(request_from_ca) // Returns "BID"

Example 2: Session Risk Scoring

To combat sophisticated bots, a DSP scores each bid request based on multiple risk factors. For instance, traffic from a data center gets a high-risk score, while traffic from a common residential ISP gets a low score. The DSP will only bid if the total risk score is below a predefined threshold.

FUNCTION calculate_risk_score(bid_request):
  score = 0
  
  // Rule 1: IP Type
  ip_info = get_ip_info(bid_request.ip)
  IF ip_info.type == "Data Center":
    score += 50
  ELSE IF ip_info.type == "Residential":
    score += 5
    
  // Rule 2: User Agent Anomaly
  ua_string = bid_request.user_agent
  IF is_known_bot_ua(ua_string) OR is_ua_incomplete(ua_string):
    score += 40
    
  RETURN score

// --- Usage ---
// A request from a data center IP
request = {ip: "198.51.100.10", user_agent: "Mozilla/5.0..."}
risk = calculate_risk_score(request) // risk = 50

// Only bid if risk is below 40
IF risk < 40:
  // Place bid
ELSE:
  // Reject bid

🐍 Python Code Examples

This function detects abnormally high click frequency from a single user ID. It is useful for identifying automated clicker bots that generate a large volume of clicks in an unrealistically short period, a common sign of click fraud.

from collections import deque
import time

CLICK_HISTORY = {}
TIME_WINDOW = 60  # seconds
MAX_CLICKS_IN_WINDOW = 5

def is_click_fraud(user_id):
    """Checks if a user's click frequency is suspiciously high."""
    current_time = time.time()
    
    if user_id not in CLICK_HISTORY:
        CLICK_HISTORY[user_id] = deque()
        
    # Remove clicks older than the time window
    while CLICK_HISTORY[user_id] and CLICK_HISTORY[user_id] < current_time - TIME_WINDOW:
        CLICK_HISTORY[user_id].popleft()
        
    # Add the new click and check the count
    CLICK_HISTORY[user_id].append(current_time)
    
    if len(CLICK_HISTORY[user_id]) > MAX_CLICKS_IN_WINDOW:
        return True # Fraudulent activity detected
        
    return False

# Example Usage
user = "user-abc-123"
for _ in range(6):
    print(f"Click registered for {user}. Is it fraud? {is_click_fraud(user)}")
    time.sleep(1)

This script filters traffic based on suspicious user-agent strings. It helps block requests from known bots, crawlers, or headless browsers that are not declared, which is a common technique for generating invalid impressions and clicks at scale.

SUSPICIOUS_USER_AGENTS = [
    "HeadlessChrome", 
    "PhantomJS",
    "DataMiner",
    "AhrefsBot"
]

def filter_by_user_agent(user_agent_string):
    """Filters traffic based on a blocklist of user agents."""
    if not user_agent_string or any(suspicious in user_agent_string for suspicious in SUSPICIOUS_USER_AGENTS):
        print(f"Blocking suspicious user agent: {user_agent_string}")
        return False # Block request
    
    print(f"Allowing user agent: {user_agent_string}")
    return True # Allow request

# Example Usage
ua_real = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
ua_bot = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.150 Safari/537.36"

filter_by_user_agent(ua_real)
filter_by_user_agent(ua_bot)

Types of Programmatic DSP

• Pre-Bid Filtering DSP: This type focuses on analyzing and filtering traffic before an ad bid is ever placed. It uses real-time data like IP address and user agent to reject suspicious impressions instantly, preventing ad spend on obvious fraud and ensuring budget efficiency.
• Post-Bid Analysis DSP: While all DSPs operate pre-bid, some enhance their models using post-bid data. After an ad is served, they analyze performance metrics (e.g., conversions, bounce rates) to identify anomalies, then use these insights to refine pre-bid filters for future campaigns.
• AI-Driven DSP: This advanced DSP uses machine learning algorithms to detect sophisticated and evolving fraud patterns that static rules might miss. By analyzing vast datasets, it can identify human-like bot behavior, session hijacking, and other advanced threats in real time.
• Brand Safety-Focused DSP: This variant prioritizes placing ads in brand-safe and suitable contexts, which indirectly helps prevent fraud. It heavily vets publishers and uses contextual analysis to avoid low-quality sites that often rely on fraudulent traffic to generate revenue.