Sven Hezel

Transcription

1 Sven Hezel

2 Uncovering Pattern using BigData and AI Identifying Relationships to high and low paying users (e.g.) - Screen Resolution - OS Detection (Win vs. Mac) - Order Value Analysis - Referral URL Checks - Conversion Rate Analysis Fraud Detection and Predictive Analytics

3 IS YOUR TRAFFIC HIGH-QUALITY? Our research suggests that 18% of all Paid Web Traffic is Fraudulent. It goes further than that with Mobile where Fraud can be as high as 40%.

4 COMMON BEST PRACTICES Order Value Analysis Affiliate Screening Conversion Rate Analysis Referer URL Checks IP Address Checks ROI Checks

5 ISSUES WITH FRAUD SCREENING Only sample checks Analysis is possible Precious time is wasted Affiliates sign up under multiple fake accounts Reliably Identifying Cookie Dropping Networks exchange offers between them Analytics takes a minimum of 2 weeks No permanent exclusion possible Not possible to analyze mixed traffic No Abusive User Exclusion Difficult to detect Adware / Bad Promotion (Order + Bonus Voucher that does not exist)

6 THE NETWORK DIAGRAM Your traffic presumably comes from a limited number of affiliate ID s. ADVERTISER Only a careful and complex analysis can bring your business back on the right track. Network 1 Network 2 Affiliate 1 Affiliate 2 FRAUDSTER Affiliate 3

7 BUT IN REALITY Networks are very often signed up as affiliates to other networks. ADVERTISER Network 1 Network 2 Fraudsters can only be driven away for a limited time. Affiliate 1 Affiliate 2 Network 3 Affiliate 3 Sub-affiliate 1 FRAUDSTER

8 POSSIBLITIES TO TACKLE PROFILE FRAUD Check your affiliate s IP on signup, as it might be a proxy. Limit countries that can join in. Fingerprinting to identify duplicate accounts Minimize Fraud already on signup Blacklisted Domains (mailinator.com)

9 Suspicious Spikes Plot Graphs to check Conversion Volume. Spiking Affiliate Traffic (especially from unknown affiliates are very often fraudulent) ! Check with Affiliate Clicks Convs 10 Hours Affiliate 1 Affiliate 2 Affiliate 3

10 CONVERSION RATE ANALYSIS Gain new insights by checking daily and hourly conversion rates. You can easily plot similar graphs in Excel or Google Sheets. Clicks Convs Hours

11 REFERER URL CHECKS Shows the source the traffic came from - Does the product match with site? (e.g. a Healthcare site delivering lots of Game Leads) - Banner Promotions should contain a Referer URL. - Blocking of Category (P2P / Adult etc) - Screenshot of Promotion Page at Conversion Time - Filtration of Sub URL / Keywords

12 DETECTION OF ABUSIVE USERS Automatic Detection of previously marked abuse Users (e.g. high return rate) Possible to check across brands

13 TOOLBAR DETECTION Detection of Traffic generated through Toolbars / Adware Checking on Fraud related Browser Extensions or Plugins to generate Fake Traffic

14 PROXY / VPN Proxies are very often identifiable just by their name. There are a variety of free resources on the web to check IP info such as whoer.net or freegeoip.net.

15 CLEAN IP vs TOR IP My IP address formats tor-exit2-readme.puckey.org Hostname Mail server epistle.puckey.org IP range ISP UK2 - Ltd Organization UK2 - Ltd Yes (Illegal 3rd party exploits, including proxies, Black list worms and trojan) Proxy headers No ports check TOR Yes Anonymizer No My IP address formats Hostname p5dcd622b.dip0.t-ipconnect.de Mail server rx.t-online.de IP range ISP Deutsche Telekom AG Organization Deutsche Telekom AG No Black list Proxy headers ports TOR Anonymizer No check No No Tor IP German Telekom DSL

16 TimeZone Offset When many conversions show a difference between the TimeZone of the IP-Address / Local Computer Time it can be an indication to fraud. Germany Country (DE) more Continent Europe Region Bayern City Munich ZIP code N/A Latitude Longitude Map show Time zone local system UTC GMT DST Europe/Berlin Sun Mar :03:52 GMT+0100 (CET) Sun Mar :03:52 GMT+0700 (KRAT) Sun Mar :03:52 UTC Sun Mar :03:52 GMT No

17 USER AGENT ANALYSIS Real traffic comes from a balanced mix of browsers and operating systems.

18 SESSION TIME Time between a click and a conversion (Registration / Install etc.) - Below-average session times indicate automation/ bots. - Above-average session in combination with a low CR (<0.1%) indicates Cookie Dropping

19 THANK YOU! Subtitle Sven Hezel List item List item List item Tel: List item Slide has a You can Download this presentation here: QUESTIONS? CONCLUSION