FRAUD DISCOVERY IN A DIGITAL ADVERTISING ECOSYSTEM

1 . A method comprising:

obtaining a plurality of signals purported to have been generated by respective ones of a plurality of client devices;

calculating a summary value for the plurality of signals indicating a measure of similarity between the plurality of signals and an expected distribution of signals;

determining, by a computer processing device, that the summary value represents a statistically significant deviation of the plurality of signals from the expected distribution of signals; and

labeling the plurality of signals as fraudulently generated based on the statistically significant deviation.

2 . The method of claim 1 , wherein the plurality of signals are purported to be a plurality of unique device identifications for the respective ones of the plurality of client devices.

3 . The method of claim 2 , further comprising:

determining that a unique device identification comprises an invalid character; and

labeling the unique device identification as fraudulently generated.

4 . The method of claim 1 , wherein the expected distribution of signals represents a known character distribution of a plurality of alphanumeric strings.

5 . The method of claim 1 , further comprising:

uploading data labeling the plurality of signals as fraudulent to a database to provide a historical collection of fraudulent signals.

6 . The method of claim 1 , wherein calculating the summary value comprises:

performing a chi-square goodness of fit test on the plurality of signals and the expected distribution of signals.

7 . The method of claim 1 , further comprising:

generating a fraud report of the fraudulent plurality of signals; and

sending the fraud report to one or more third-party publishers or partners.

8 . The method of claim 1 , wherein the summary value is a significance level calculated by performing a chi-square goodness of fit test.

9 . The method of claim 1 , wherein the plurality of signals are purported to be a plurality of timestamps associated with a plurality of clicks within an application, and wherein the expected distribution of signals represents an expected distribution of timestamps for a plurality of legitimate clicks within the application.

10 . The method of claim 1 , wherein calculating the summary value is associated with a batched fraud-detector test, and the method further comprises:

performing a real-time fraud-detection test comprising:

obtaining a stream of data comprising a plurality of signals, wherein each signal of the plurality of signals comprises a plurality of characters;

parsing each character to identify an invalid character, wherein the invalid character is not included in a set of accepted characters; and

labeling the signal associated with the invalid character as fraudulently generated.

11 . A system, comprising:

one or more computer processing devices programmed to:

obtain a plurality of signals purported to have been generated by respective ones of a plurality of client devices;

calculate a summary value for the plurality of signals indicating a measure of similarity between the plurality of signals and an expected distribution of signals;

determine that the summary value represents a statistically significant deviation of the plurality of signals from the expected distribution of signals; and

label the plurality of signals as fraudulently generated based on the statistically significant deviation.

12 . The system of claim 11 , wherein the plurality of signals are purported to be a plurality of unique device identifications for the respective ones of the plurality of client devices.

13 . The system of claim 12 , wherein the one or more computer processing devices are further programmed to:

determine that a unique device identification comprises an invalid character; and

label the unique device identification as fraudulently generated.

14 . The system of claim 11 , wherein the expected distribution of signals represents a known character distribution of a plurality of alphanumeric strings.

15 . The system of claim 11 , to calculate the summary value, the one or more computer processing devices are further programmed to perform a Chi-Square Goodness of Fit test on the plurality of signals and the expected distribution of signals.

16 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processing devices, cause the one or more computer processing devices to:

obtain a plurality of signals purported to have been generated by respective ones of a plurality of client devices;

calculate a summary value for the plurality of signals indicating a measure of similarity between the plurality of signals and an expected distribution of signals;

determine that the summary value represents a statistically significant deviation of the plurality of signals from the expected distribution of signals; and

label the plurality of signals as fraudulently generated based on the statistically significant deviation.

17 . The non-transitory computer readable storage medium of claim 16 , wherein the plurality of signals are purported to be a plurality of unique device identifications the respective ones of the plurality of client devices.

18 . The non-transitory computer readable storage medium of claim 17 , wherein the instructions further cause the one or more computer processing devices to:

determine that a unique device identification comprises an invalid character; and

label the unique device identification as fraudulently generated.

19 . The non-transitory computer readable storage medium of claim 16 , wherein the expected distribution of signals represents a known character distribution of a plurality of alphanumeric strings.

20 . The non-transitory computer readable storage medium of claim 16 , wherein calculating the summary comprises performing a chi-square goodness of fit test on the plurality of signals and the expected distribution of signals.