Method and system for detecting fraudulent advertisement activity

1. A method, implemented on a machine having at least one processor, storage, and a communication platform capable of connecting to a network for providing protection against fraudulent advertisement requests, the method comprising:

determining, via machine learning, a list of designated identifiers of fraudulent sources of requests for advertisements by:

creating a multiple dimensional space including multiple regions that denote non-fraudulent activities, wherein multiple rules are determined based on multiple features of a user request, and wherein each of the multiple regions is created based on each of the rules including upper and lower limits of a value of a corresponding one of multiple features of a user request,

extracting features from logged requests for advertisements from fraudulent sources and non-fraudulent sources, and

if the extracted features lie outside the regions, including identifiers of the fraudulent sources into the list of designated identifiers of the fraudulent sources of requests for advertisements;

receiving, by a request handling unit implemented by the at least one processor, a request for an advertisement;

extracting, by the request handling unit, an identifier included in the request, the identifier being associated with a source from which the request originates;

determining whether the extracted identifier is included in the list of designated identifiers;

in response to determining that the identifier is included in the list of designated identifiers, denying the request for the advertisement; and

in response to determining that the identifier is not included in the list of designated identifiers,

providing the advertisement in response to the request,

extracting a set of features from the request and previous requests that originated from the source,

based on the set of features, determining that:

a botnet including a plurality of bots related to each other is associated with fraudulent activities, and

the source is one of the plurality of bots in the botnet, and

adding the identifier associated with the source to the list of designated identifiers.

2. The method of claim 1 , further comprising:

generating a boundary condition for each extracted feature of the set of features; and

aggregating the generated boundary conditions to determine a set of rules, each rule corresponding to at least one extracted feature of the set of features.

3. The method of claim 2 , further comprising:

classifying the request based on the set of rules and one or more models;

generating a label based on the classification of the request; and

updating the one or more models with the generated label.

4. The method of claim 1 , wherein the set of features include a type of device from which the request originates, a type of browser being executed on the device, a traffic parameter associated with the request, and a user behavior associated with the request.

5. The method of claim 4 , wherein the user behavior associated with the request includes an average query length of the request and a click through rate of the request, and the traffic parameter associated with the request corresponds to a number of distinct queries associated with the source from the request originates.

6. The method of claim 1 , wherein the extracted identifier corresponds to an IP address associated with the source, and the determining of whether the extracted identifier is included in the list of designated identifiers includes performing a real-time look-up of the extracted identifier in the list of designated identifiers, each identifier in the list being a classless inter-domain routing (CIDR) IP identifier, the list of CIDR IP identifiers being maintained in a radix tree format.

7. A system for providing protection against fraudulent advertisement requests, the system comprising:

a list generator implemented by at least one processor, and configured to determine, via machine learning, a list of designated identifiers of fraudulent sources of requests for advertisements by:

creating a multiple dimensional space including multiple regions that denote non-fraudulent activities, wherein multiple rules are determined based on multiple features of a user request, and wherein each of the multiple regions is created based on each of the rules including upper and lower limits of a value of a corresponding one of multiple features of a user request,

extracting features from logged requests for advertisements from fraudulent sources and non-fraudulent sources, and

if the extracted features lie outside the regions, including identifiers of the fraudulent sources into the list of designated identifiers of the fraudulent sources of requests for advertisements;

a request handling unit implemented by at least one processor, and configured to receive a request for an advertisement;

an extracting unit implemented by the at least one processor and configured to extract an identifier included in the request, the identifier being associated with a source from which the request originates; and

an advertisement response unit implemented by the at least one processor and configured to

determine whether the extracted identifier is included in the list of designated identifiers;

in response to determining that the identifier is included in the list of designated identifiers, deny the request for the advertisement;

in response to determining that the identifier is not included in the list of designated identifiers,

provide the advertisement in response to the request,

extract a set of features from the request and previous requests that originated from the source,

based on the set of features, determine that:

a botnet including a plurality of bots related to each other is associated with fraudulent activities, and

the source is one of the plurality of bots in the botnet, and

add the identifier associated with the source to the list of designated identifiers.

8. The system of claim 7 , wherein the advertisement response unit is further configured to:

generate a boundary condition for each extracted feature of the set of features; and

aggregate the generated boundary conditions to determine a set of rules, each rule corresponding to at least one extracted feature of the set of features.

9. The system of claim 8 , wherein the advertisement response unit is further configured to:

classify the request based on the set of rules and one or more models;

generate a label based on the classification of the request; and

update the one or more models with the generated label.

10. The system of claim 7 , wherein the set of features include a type of device from which the request originates, a type of browser being executed on the device, a traffic parameter associated with the request, and a user behavior associated with the request.

11. The system of claim 10 , wherein the user behavior associated with the request includes an average query length of the request and a click through rate of the request, and the traffic parameter associated with the request corresponds to a number of distinct queries associated with the source from the request originates.

12. The system of claim 7 , wherein the extracted identifier corresponds to an IP address associated with the source, and the determining of whether the extracted identifier is included in the list of designated identifiers includes performing a real-time look-up of the extracted identifier in the list of designated identifiers, each identifier in the list being a classless inter-domain routing (CIDR) IP identifier, the list of CIDR IP identifiers being maintained in a radix tree format.

13. A non-transitory computer readable medium including computer executable instructions, wherein the instructions, when executed by a computer, cause the computer to perform a method for providing protection against fraudulent advertisement requests, the method comprising:

determining, via machine learning, a list of designated identifiers of fraudulent sources of requests for advertisements by:

creating a multiple dimensional space including multiple regions that denote non-fraudulent activities, wherein multiple rules are determined based on multiple features of a user request, and wherein each of the multiple regions is created based on each of the rules including upper and lower limits of a value of a corresponding one of multiple features of a user request,

extracting features from logged requests for advertisements from fraudulent sources and non-fraudulent sources, and

if the extracted features lie outside the regions, including identifiers of the fraudulent sources into the list of designated identifiers of the fraudulent sources of requests for advertisements;

receiving a request for an advertisement;

extracting an identifier included in the request, the identifier being associated with a source from which the request originates;

determining whether the extracted identifier is included in the list of designated identifiers;

in response to determining that the identifier is included in the list of designated identifiers, denying the request for the advertisement; and

in response to determining that the identifier is not included in the list of designated identifiers,

providing the advertisement in response to the request,

extracting a set of features from the request and previous requests that originated from the source,

based on the set of features, determining that:

a botnet including a plurality of bots related to each other is associated with fraudulent activities, and

the source is one of the plurality of bots in the botnet, and

adding the identifier associated with the source to the list of designated identifiers.

14. The non-transitory computer readable medium of claim 13 , the method further comprising:

generating a boundary condition for each extracted feature of the set of features; and

aggregating the generated boundary conditions to determine a set of rules, each rule corresponding to at least one extracted feature of the set of features.

15. The non-transitory computer readable medium of claim 14 , the method further comprising:

classifying the request based on the set of rules and one or more models;

generating a label based on the classification of the request; and

updating the one or more models with the generated label.

16. The non-transitory computer readable medium of claim 13 , wherein the set of features include a type of device from which the request originates, a type of browser being executed on the device, a traffic parameter associated with the request, and a user behavior associated with the request.

17. The non-transitory computer readable medium of claim 16 , wherein the user behavior associated with the request includes an average query length of the request and a click through rate of the request, and the traffic parameter associated with the request corresponds to a number of distinct queries associated with the source from the request originates.