Malicious advertisement protection
There is disclosed in one example an advertisement reputation server, including: a hardware platform including a processor and a memory; a network interface; and an advertisement reputation engine including instructions encoded in memory to instruct the processor to: receive via the network interface a plurality of advertisement instances displayed on client devices; extract from the advertisement instances an advertiser identifier; analyze one or more advertisements associated with the advertiser identifier to assign an advertiser reputation; and publish via the network interface advertisement reputation information derived from the reputation for the advertisement identifier.
1. An advertisement reputation server, comprising:
a hardware platform comprising a processor and a memory;
a network interface; and
an advertisement reputation engine comprising instructions encoded in memory to instruct the processor to:
receive via the network interface a plurality of advertisement instances displayed on client devices;
extract from the advertisement instances an advertiser identifier;
analyze one or more advertisements associated with the advertiser identifier to assign an advertiser reputation, comprising applying a machine learning algorithm to the analysis if an advertisement has an unknown reputation, or is from an advertiser with an unknown reputation; and
publish via the network interface advertisement reputation information derived from the reputation for the advertisement identifier.
2. The advertisement reputation server of claim 1 , wherein the reputation engine further comprises instructions to determine that the advertiser reputation is a malicious advertiser.
3. The advertisement reputation server of claim 2 , wherein the reputation engine further comprises instructions to block advertisements from the malicious advertiser.
4. The advertisement reputation server of claim 1 , wherein the reputation engine further comprises instructions to determine that the advertiser reputation is a misleading advertiser and nota malicious advertiser, and to publish a security policy that does not block all advertisements from the misleading advertiser.
5. The advertisement reputation server of claim 1 , wherein the reputation engine further comprises instructions to determine that the advertiser reputation is obscene or contrary to community standards.
6. The advertisement reputation server of claim 1 , wherein the advertiser identifier comprises a tuple comprising a platform identifier and a platform-specific advertiser identifier.
7. The advertising reputation server of claim 1 , wherein the reputation engine comprises a feature extractor to extract a plurality of features, and wherein the machine learning algorithm is to analyze the advertisement or advertiser according to the plurality of features.
8. The advertising reputation server of claim 7 , further comprising a training module to train the machine learning engine on the plurality of features.
9. The advertisement reputation server of claim 1 , wherein the reputation engine further comprises instructions to assign an expiry to a negative advertiser reputation, and after the expiry to re-evaluate the negative advertiser reputation.
10. The advertisement reputation server of claim 1 , wherein analyzing the one or more advertisements associated with the advertiser comprises logistic regression.
11. The advertisement reputation server of claim 1 , wherein analyzing the one or more advertisements associated with the advertiser comprises computing a sum of products.
12. The advertisement reputation server of claim 1 , wherein the reputation engine comprises instructions to analyze the one or more advertisements associated with the advertiser asynchronously with a request.
13. The advertisement reputation server of claim 1 , wherein the reputation engine comprises instructions to publish to a plurality of client devices a policy according to the advertiser reputation.
14. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to:
collect a plurality of advertisements from client devices;
identify an advertiser from the plurality of advertisements;
assign the advertiser an advertiser identifier;
analyze advertisements from the advertiser, comprising applying a machine learning algorithm to the analysis if an advertisement has an unknown reputation, or is from an advertiser with an unknown reputation, and associate a reputation with the advertiser identifier; and
publish the reputation to the client devices.
15. The one or more tangible, non-transitory computer-readable mediums of claim 14 , wherein the instructions are further to determine that the reputation is a malicious advertiser.
16. The one or more tangible, non-transitory computer-readable mediums of claim 15 , wherein the instructions are further to deny advertisements from the malicious advertiser.
17. The one or more tangible, non-transitory computer-readable mediums of claim 14 , wherein the instructions are further to determine that the reputation is a misleading advertiser and nota malicious advertiser, and to publish a security policy that does not block advertisements from the misleading advertiser.
18. A computer-implemented method of providing advertiser reputations, comprising:
collecting advertisements provided by an advertising platform to client devices;
assigning an advertiser on the advertising platform a unique advertiser identifier;
providing the advertiser an advertiser reputation according to an analysis of advertisements from the advertiser, comprising applying a machine learning algorithm to the analysis if an advertisement has an unknown reputation, or is from an advertiser with an unknown reputation; and
generating a security policy based on the advertiser reputation.
19. The method of claim 18 , further comprising determining that the advertiser reputation is malicious.