US 12,073,430 B2
Method and system for detecting fraudulent advertisement activity
Angus Xianen Qiu, Sunnyvale, CA (US); Liang Wang, San Jose, CA (US); Chun Han, Fremont, CA (US); and Jaime Morales, Urbana, IL (US)
Assigned to YAHOO AD TECH LLC, Dulles, VA (US)
Filed by YAHOO AD TECH LLC, Dulles, VA (US)
Filed on Oct. 26, 2017, as Appl. No. 15/794,991.
Prior Publication US 2019/0130440 A1, May 2, 2019
Int. Cl. G06Q 20/00 (2012.01); G06Q 30/0241 (2023.01); H04L 9/40 (2022.01); G06Q 10/067 (2023.01)
CPC G06Q 30/0248 (2013.01) [G06Q 30/0277 (2013.01); H04L 63/101 (2013.01); H04L 63/1425 (2013.01); G06Q 10/067 (2013.01); H04L 2463/144 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method, implemented on a machine having at least one processor, storage, and a communication platform capable of connecting to a network for providing protection against fraudulent advertisement requests, the method comprising:
determining, via machine learning, a list of designated identifiers of fraudulent sources of requests for advertisements by:
creating a multiple dimensional space including multiple regions that denote non-fraudulent activities, wherein multiple rules are determined based on multiple features of a user request, and wherein each of the multiple regions is created based on each of the rules including upper and lower limits of a value of a corresponding one of multiple features of a user request,
extracting features from logged requests for advertisements from fraudulent sources and non-fraudulent sources, and
if the extracted features lie outside the regions, including identifiers of the fraudulent sources into the list of designated identifiers of the fraudulent sources of requests for advertisements;
receiving, by a request handling unit implemented by the at least one processor, a request for an advertisement;
extracting, by the request handling unit, an identifier included in the request, the identifier being associated with a source from which the request originates;
determining whether the extracted identifier is included in the list of designated identifiers;
in response to determining that the identifier is included in the list of designated identifiers, denying the request for the advertisement; and
in response to determining that the identifier is not included in the list of designated identifiers,
providing the advertisement in response to the request,
extracting a set of features from the request and previous requests that originated from the source,
based on the set of features, determining that:
a botnet including a plurality of bots related to each other is associated with fraudulent activities, and
the source is one of the plurality of bots in the botnet, and
adding the identifier associated with the source to the list of designated identifiers.