System for determining whether activity of client device is malicious based on activity threshold
One or more computing devices, systems, and/or methods for determining thresholds are provided. For example, first activity associated with a plurality of client devices may be detected. A first activity distribution associated with the plurality of client devices may be determined based upon the first activity. A plurality of peaks of the first activity distribution may be identified. A plurality of gradients associated with pairs of peaks of the plurality of peaks may be determined. A target peak of the plurality of peaks may be determined based upon the plurality of gradients. A threshold amount of activity associated with the first activity may be determined based upon the target peak. A first set of activity associated with a first client device may be detected. A fraudulence label associated with the first client device may be determined based upon the first set of activity and/or the threshold amount of activity.
1. A method, comprising:
detecting first activity associated with a plurality of client devices;
determining, based upon the first activity, a first activity distribution associated with the plurality of client devices;
identifying a plurality of peaks of the first activity distribution;
determining a plurality of gradients associated with pairs of peaks of the plurality of peaks;
determining, based upon the plurality of gradients, a target peak of the plurality of peaks;
determining, based upon the target peak and the first activity distribution, a first threshold amount of activity associated with the first activity;
detecting a first set of activity associated with a first client device; and
determining, based upon the first set of activity and the first threshold amount of activity, a fraudulence label associated with the first client device.
2. The method of claim 1 , wherein the detecting the first activity comprises:
receiving requests for content from the plurality of client devices, wherein the first activity distribution is indicative of:
a first quantity of client devices of the plurality of client devices associated with a first amount of activity associated with the first activity; and
a second quantity of client devices of the plurality of client devices associated with a second amount of activity associated with the first activity.
3. The method of claim 2 , wherein:
the first amount of activity corresponds to a first quantity of requests for content received from a client device;
the second amount of activity corresponds to a second quantity of requests for content received from a client device; and
the first threshold amount of activity corresponds to a threshold quantity of requests for content.
4. The method of claim 1 , wherein the detecting the first activity comprises:
identifying selections of content received from the plurality of client devices, wherein the first activity distribution is indicative of:
a first quantity of client devices of the plurality of client devices associated with a first amount of activity associated with the first activity; and
a second quantity of client devices of the plurality of client devices associated with a second amount of activity associated with the first activity.
5. The method of claim 4 , wherein:
the first amount of activity corresponds to a first quantity of selections of content associated with a client device;
the second amount of activity corresponds to a second quantity of selections of content associated with a client device; and
the first threshold amount of activity corresponds to a threshold quantity of selections of content.
6. The method of claim 1 , wherein the detecting the first activity comprises:
identifying content transmitted to the plurality of client devices, wherein the first activity distribution is indicative of:
a first quantity of client devices of the plurality of client devices associated with a first amount of activity associated with the first activity; and
a second quantity of client devices of the plurality of client devices associated with a second amount of activity associated with the first activity.
7. The method of claim 6 , wherein:
the first amount of activity corresponds to a first quantity of content items transmitted to a client device;
the second amount of activity corresponds to a second quantity of content items transmitted to a client device; and
the first threshold amount of activity corresponds to a threshold quantity of content items transmitted to a client device.
8. The method of claim 1 , wherein the detecting the first activity comprises:
identifying content presented via the plurality of client devices, wherein the first activity distribution is indicative of:
a first quantity of client devices of the plurality of client devices associated with a first amount of activity associated with the first activity; and
a second quantity of client devices of the plurality of client devices associated with a second amount of activity associated with the first activity.
9. The method of claim 8 , wherein:
the first amount of activity corresponds to a first quantity of content items presented via a client device;
the second amount of activity corresponds to a second quantity of content items presented via a client device; and
the first threshold amount of activity corresponds to a threshold quantity of content items presented via a client device.
10. The method of claim 1 , wherein the detecting the first activity comprises:
detecting conversion events associated with the plurality of client devices, wherein the first activity distribution is indicative of:
a first quantity of client devices of the plurality of client devices associated with a first amount of activity associated with the first activity; and
a second quantity of client devices of the plurality of client devices associated with a second amount of activity associated with the first activity.
11. The method of claim 10 , wherein:
the first amount of activity corresponds to a first quantity of conversion events associated with a client device;
the second amount of activity corresponds to a second quantity of conversion events associated with a client device; and
the first threshold amount of activity corresponds to a threshold quantity of conversion events.
12. The method of claim 1 , wherein the fraudulence label is indicative of at least one of:
activity associated with the first client device being fraudulent;
activity associated with the first client device being valid; or
a probability that activity associated with the first client device is fraudulent.
13. The method of claim 12 , wherein the first activity is associated with a first type of activity, wherein the determining the fraudulence label comprises:
determining, based upon the first set of activity, a first amount of activity, associated with the first type of activity, of the first set of activity, wherein the fraudulence label is determined based upon a comparison of the first amount of activity with the first threshold amount of activity.
14. The method of claim 12 , wherein the first activity is associated with a first type of activity, the method comprising:
detecting second activity associated with a second plurality of client devices, wherein the second activity is associated with a second type of activity different than the first type of activity;
determining, based upon the second activity, a second activity distribution associated with the second plurality of client devices;
identifying a second plurality of peaks of the second activity distribution;
determining a second plurality of gradients associated with pairs of peaks of the second plurality of peaks;
determining, based upon the second plurality of gradients, a second target peak of the second plurality of peaks; and
determining, based upon the second target peak, a second threshold amount of activity associated with the second type of activity.
15. The method of claim 14 , wherein the determining the fraudulence label comprises:
determining, based upon the first set of activity, a first amount of activity, associated with the first type of activity, of the first set of activity; and
determining, based upon the first set of activity, a second amount of activity, associated with the second type of activity, of the first set of activity, wherein the fraudulence label is determined based upon a first comparison of the first amount of activity with the first threshold amount of activity and a second comparison of the second amount of activity with the second threshold amount of activity.
16. The method of claim 1 , wherein the determining the target peak comprises:
analyzing the plurality of gradients to determine a greatest gradient of the plurality of gradients, wherein the target peak is comprised within a first pair of peaks, of the plurality of peaks, associated with the greatest gradient.
17. The method of claim 1 , wherein the determining the first threshold amount of activity comprises:
selecting a peak, of the plurality of peaks, based upon the target peak; and
determining an amount of activity associated with the peak, wherein the first threshold amount of activity is based upon the amount of activity.
18. A computing device comprising:
a processor; and
memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:
detecting first activity associated with a plurality of client devices;
determining, based upon the first activity, a first activity distribution associated with the plurality of client devices;
identifying a plurality of peaks of the first activity distribution;
determining a plurality of relationships between pairs of peaks of the plurality of peaks;
determining, based upon the plurality of relationships, a target peak of the plurality of peaks;
determining, based upon the target peak, a first threshold amount of activity associated with the first activity;
detecting a first set of activity associated with a first client device; and
determining, based upon the first set of activity and the first threshold amount of activity, a fraudulence label associated with the first client device.
19. The computing device of claim 18 , wherein the plurality of relationships comprises at least one of:
a plurality of gradients associated with the pairs of peaks of the plurality of peaks; or
a plurality of slopes associated with the pairs of peaks of the plurality of peaks.
20. A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:
detecting first activity associated with a plurality of client devices;
determining, based upon the first activity, a first activity distribution associated with the plurality of client devices;
identifying a plurality of peaks of the first activity distribution;
determining a plurality of relationships between pairs of peaks of the plurality of peaks;
determining, based upon the plurality of relationships, a target peak of the plurality of peaks; and
determining, based upon the target peak, a first threshold amount of activity associated with the first activity.