The safe pixel is code embedded in a web page that is executed when the web page is accessed by a user agent. When the safe pixel is executed, the safe pixel collects information about the device and invokes the execution of one or more abuse detection functions. Each abuse detection function implements a different technique for estimating the likelihood of abusive behavior being the cause of the safe pixel being executed. The safe pixel transmits in a reporting message the local information and the results of the abuse detection function executions to a traffic server. The traffic server analyzes the reporting message to make a determination of the validity of the action that caused the safe pixel being executed.
1. A non-transitory computer readable medium comprising instructions that, when executed by a processor of a device, cause the processor to perform the steps of:
collecting, within the device upon the instructions having been received as part of a web page by a web browser operating on the device, an operating environment data set associated with the device executing the web browser being used to access the web page;
invoking for execution by the device at least one abuse detection function from a set of abuse detection functions, each abuse detection function configured to evaluate at least one distinct factor regarding a likelihood of the web page's access being associated with abusive behavior that artificially increases traffic to the web page;
evaluating, by the device, a result of the execution of the at least one abuse detection function to determine the likelihood of the web page's access being associated with abusive behavior;
responsive to the likelihood of the web page's access being associated with abusive behavior being lower than a threshold likelihood of being associated with abusive behavior, reporting, from the device to an external traffic server, that the web page was accessed; and
responsive to the likelihood of the web page's access being associated with abusive behavior being higher than a threshold likelihood of being associated with abusive behavior, preventing reporting to the external traffic server that the web page was accessed.
2. The non-transitory computer readable medium of claim 1 , wherein the at least one abuse detection function comprises computer code configured to:
identify an event that has occurred on the device;
determine whether the event requires human manipulation of an input device coupled to the device; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is low when the event requires human manipulation or that the likelihood of the web page's access being associated with abusive behavior is high when the event does not require human manipulation.
3. The non-transitory computer readable medium of claim 1 , wherein the at least one abuse detection function comprises computer code configured to:
determine whether the device executes a consumer application different from the web browser; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is low when the device executes a consumer application different from the web browser or that the likelihood of the web page's access being associated with abusive behavior is high when the device does not execute a consumer application different from the web browser.
4. The non-transitory computer readable medium of claim 3 , wherein the consumer application is a word processing application, a music playback application or a game application.
5. The non-transitory computer readable medium of claim 1 , wherein the at least one abuse detection function comprises computer code configured to:
generate one or more tasks for execution on the device;
evaluate a length of time taken by the device to execute the one or more tasks; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is high when the length of time is less than a threshold length of time or that the likelihood of the web page's access being associated with abusive behavior is low when the length of time is greater than or equal to the threshold length of time.
6. The non-transitory computer readable medium of claim 1 , wherein the at least one abuse detection function comprises computer code configured to:
determine that the web browser allows cookies to be set;
set a test cookie on the web browser;
determine whether the test cookie can be read from the web browser; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is high when the test cookie cannot be read or that the likelihood of the web page's access being associated with abusive behavior is low when the test cookie can be read.
7. The non-transitory computer readable medium of claim 1 , further comprising instructions that cause the processor to perform the steps of generating an identifier associated with the device, and reporting the that the web page was accessed in association with the identifier.
8. The non-transitory computer readable medium of claim 7 , wherein the traffic server determines based on the identifier whether the web page was previously accessed by the device, and determines that the web page's access is associated with abusive behavior when a number of times the web page was previously accessed by the device exceeds a threshold number of times.
9. The non-transitory computer readable medium of claim 1 , further comprising instructions that cause the processor to perform the steps of invoking for execution a second abuse detection function from the set of abuse detection functions, the second abuse detection function comprises computer code configured to wait a length of time before completely executing, and reporting that the web page was accessed to the external traffic server is stalled until the second abuse detection function is completely executed.
10. A method comprising:
retrieving, by a web browser operating on a device, a web page comprising computer code, the computer code comprising a pixel tag and a set of abuse detection functions; and
executing, by the web browser at the device, computer code of the pixel tag comprising instructions that cause the web browser to:
collect an operating environment dataset comprising a type of the web browser; select at least one of the abuse detection functions from the set of abuse detection functions for execution based on the operating environment dataset, each abuse detection function configured to evaluate at least one distinct factor regarding a likelihood of the web page's access being associated with abusive behavior that artificially increases traffic to the web page;
execute, by the web browser at the device, the at least one selected abuse detection function;
determine, by the web browser at the device, a likelihood of the web page's access being associated with abusive behavior based on the execution of the at least one selected abuse detection function;
responsive to the likelihood of the web page's access being associated with abusive behavior being lower than a threshold likelihood of being associated with abusive behavior, generate, by the web browser at the device, a reporting message based on a result of the execution of the at least one abuse detection function; and
transmit, by the web browser at the device, the reporting message to an external traffic server; and
responsive to the likelihood of the web page's access being associated with abusive behavior being higher than a threshold likelihood of being associated with abusive behavior, prevent reporting to the external traffic server that the web page was accessed.
11. The method of claim 10 , wherein the at least one abuse detection function comprises computer code configured to:
identify an event that has occurred on the device;
determine whether the event requires human manipulation of an input device coupled to the device; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is low when the event requires human manipulation or that the likelihood of the web page's access being associated with abusive behavior is high when the event does not require human manipulation.
12. The method of claim 10 , wherein the at least one abuse detection function comprises computer code configured to:
determine whether the device executes a consumer application different from the web browser; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is low when the device executes a consumer application different from the web browser or that the likelihood of the web page's access being associated with abusive behavior is high when the device does not execute a consumer application different from the web browser.
13. The method of claim 12 , wherein the consumer application is a word processing application, a music playback application or a game application.
14. The method of claim 10 , wherein the at least one abuse detection function comprises computer code configured to:
generate one or more tasks for execution on the device;
evaluate a length of time taken by the device to execute the one or more tasks; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is high when the length of time is less than a threshold length of time or that the likelihood of the web page's access being associated with abusive behavior is low when the length of time is greater than or equal to the threshold length of time.
15. The method of claim 10 , wherein the at least one abuse detection function comprises computer code configured to:
determine that the web browser allows cookies to be set;
set a test cookie on the web browser;
determine whether the test cookie can be read from the web browser; and
generate a result that indicates that the likelihood of the web page's access being associated with abusive behavior is high when the test cookie cannot be read or that the likelihood of the web page's access being associated with abusive behavior is low when the test cookie can be read.
16. The method of claim 10 , further comprising generating an identifier associated with the device, and transmitting the reporting message in associated with the identifier.
17. The method of claim 16 , wherein the traffic server determines based on the identifier whether the web page was previously accessed by the device, and determines that the web page's access is associated with abusive behavior when a number of times the web page was previously accessed by the device exceeds a threshold number of times.
18. The method of claim 10 , wherein the pixel tag computer code further comprises instructions that cause the web browser to invoke for execution a second abuse detection function from the set of abuse detection functions, the second abuse detection function comprises computer code configured to wait a length of time before completely executing, and wherein the transmission of the reporting message is stalled until the second abuse detection function is completely executed.