This document provides an overview of fraud in event log analysis for real-time bidding (RTB) in online advertising. It discusses how RTB works, the role of logs, opportunities for video ad fraud, current industry solutions, and provides a taxonomy of different fraud types. The presentation includes an interactive demo of exploring log data to identify instances of fraud.

1. Fraud, Fun, and Fortune
in
Event Log Analy4cs
en zyme
Feyzi Bagirov

2. Who we are?
• en zyme
• Feyzi Bagirov

3. Acknowledgments
• Agnes O
• Hakim
• Eric

4. Agenda
• What is Real-Time Bidding and how does it
work (RTB)?
• What are logs and how do they work
• Describing a Fraud
• Explora4on Log Data Analysis demo

5. What is Real-Time Bidding?
• A technology (based on IAB OpenRTB
procotol) in online-adver4sement industry,
enabling real-4me auc4ons of online
adver4sement.

6. How does Real-Time Bidding work?
Par4cipants:
Supply Side
PlaPorm (SSP)
Data Management
PlaPorm (DMP)
Demand Side
PlaPorm (DSP)
An adver4sing network,
supplying spots for
impressions to the auc4on
An adver4sing network,
providing adver4sement
content to the auc4on
User Data Supplier

7. Adver4sing Server
RTB
PlaPorm
User Opens Browser
Goes to the Website,
e.g. cnn.com
• Request Ad from Ad Server
The site auc4ons ads
• Redirect to Ad Exchange
DSPs (DataXu, etc.)
Bid
• Send to Rela-Time Bidders
DSP Wins Bid
• Winner Serves Ad
User sees Ad
Adver4sing Server
Mechanics of Real-Time Bidding

8. Mechanics of Real Time Bidding

9. What are logs and how do they work?

10. Managing mul4ple sources of logs

11. Transpor4ng logs (Origin->Storage)
• Should cope with network failures
• Should be able to prevent data duplica4on

12. Video Ad Logs from Treasure Data
• Over a 162,000,000 records across 14 tables
• Some of the Log Variables…
– Referrer
– Ad source
– Agent (browser and device)
– Loca4ons
– Impression data (when somebody is actually viewing an
ad)
• Log Event types:
– Ad call started
– Ad call completed
– Error No Ad

13. Defining the Video Adver4sing Fraud
“And now Edgar’s gone…Something’s going on around here.”

14. Some Fraud Facts…
“The Bot Baseline: Fraud in Digital
Adver4sing”, Associa4on Of Na4onal
Adver4sers,

15. Interac4ve Adver4sing Bureau Webinar, “Valida4ng Inventory”

16. Opportuni4es for Video Ad Fraud
• Invalid Traffic
– Bot fraud
– Single pixel
– Stacked ads
– Below the fold
• Yield Op4miza4on
– Arbitrage problem
• Inventory Trading
– Publishers and user inventory

17. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

18. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

19. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

20. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

21. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

22. Interac4ve Adver4sing Bureau Webinar, “Valida4ng Inventory”

23. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

24. “The Bot Baseline: Fraud in Digital Adver4sing”, Associa4on Of Na4onal Adver4sers,

25. Current Industry Solu4ons:
Interac4ve Adver4sing Bureau Webinar, “Valida4ng Inventory”

26. Fraud Taxonomy (1/3)
• Illegi4mate and Non-Human Traffic Sources
– Hijacked device – any user’s device (browser, phone,
app or other system) that has been modified to call
html or make ad requests that is not under the
control of a user and made without the user’s content
– Crawler masquerading as a legi4mate user – a
browser, server or app that makes page load calls
automa4cally without declaring themselves as a
robot, instead declaring a valid regular browser or app
user agent where there is no real human user.

27. Fraud Taxonomy (2/3)
• Hijacked Tags:
– Ad Tag Hijacking – taking ad tags from a
publisher’s site and pukng them onto another
site without the publisher’s knowledge
– Crea4ve Hijacking – copying the crea4ng tags
from a legi4mately served ad so they can be
rendered at a later 4me, without the consent of
adver4ser or their contracted service provider

28. Fraud Taxonomy (3/3)
• Site or Impression Alributes:
– Hidden Ads – ads placed in such a manner that
they can not ever be viewable e.g. stacked ads,
ads clipped by iframes, zero opacity ads.
• Ad crea4ve/other
– Cookie-stuffing – the process by which a client is
provided with cookies from other domains as if
the user had visited those other domains.

29. Log Explora4ve Analysis demo