The Lane’s Gifts vs. Google Report part 2 Andrew Holoman.

Slides:



Advertisements
Similar presentations
Use-Cases.
Advertisements

HOW DO FIRMS ENSURE QUALITY? Quality Control Total Quality Management Benchmarking Quality Circles.
HONEYPOTS Mathew Benwell, Sunee Holland, Grant Pannell.
Google Confidential and Proprietary Trademarks on the Internet: Problems and Solutions Terri Chen September 2012.
Addressing spam and enforcing a Do Not Registry using a Certified Electronic Mail System Information Technology Advisory Group, Inc.
Red Flags Rule & Municipal Utilities
Bank Account Fraud Kimberly Sidden, Vice President Government Banking, UMB Bank.
Information System Engineering
Insider Access Behavior Team May 06 Brandon Reher Jake Gionet Steven Bromley Jon McKee Advisor Client Dr. Tom DanielsThe Boeing Company Contact Dr. Nick.
Intrusion Detection Systems and Practices
CS 290C: Formal Models for Web Software Lecture 10: Language Based Modeling and Analysis of Navigation Errors Instructor: Tevfik Bultan.
Beyond the perimeter: the need for early detection of Denial of Service Attacks John Haggerty,Qi Shi,Madjid Merabti Presented by Abhijit Pandey.
Lesson 13-Intrusion Detection. Overview Define the types of Intrusion Detection Systems (IDS). Set up an IDS. Manage an IDS. Understand intrusion prevention.
 Proxy Servers are software that act as intermediaries between client and servers on the Internet.  They help users on private networks get information.
Department Of Computer Engineering
CLICK FRAUD Alexander Tuzhilin By Vinny Rey. Why was the study done? Google was getting sued by advertisers because of click fraud. Google agreed to have.
Building Survivable Systems based on Intrusion Detection and Damage Containment Paper by: T. Bowen Presented by: Tiyseer Al Homaiyd 1.
Network security policy: best practices
Intrusion Prevention, Detection & Response. IDS vs IPS IDS = Intrusion detection system IPS = intrusion prevention system.
Security Guidelines and Management
Copyright © 2015 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
Lucent Technologies – Proprietary Use pursuant to company instruction Learning Sequential Models for Detecting Anomalous Protocol Usage (work in progress)
1 Intrusion Detection Systems. 2 Intrusion Detection Intrusion is any use or attempted use of a system that exceeds authentication limits Intrusions are.
APA of Isfahan University of Technology In the name of God.
S E C U R E C O M P U T I N G Intrusion Tolerant Server Infrastructure Dick O’Brien, Tammy Kappel, Clint Bitzer OASIS PI Meeting March 14, 2002.
Copyright © 2015 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
REFACTORING Lecture 4. Definition Refactoring is a process of changing the internal structure of the program, not affecting its external behavior and.
Computer Based Information Systems Control UAA – ACCT 316 – Fall 2003 Accounting Information Systems Dr. Fred Barbee.
The Islamic University of Gaza
Update from Business Week Number of Net Fraud Complaints – 2002 – 48,252 – 2004 – 207,449.
Using Routing and Tunnelling to Combat DoS Attacks Adam Greenhalgh, Mark Handley, Felipe Huici Dept. of Computer Science University College London
Intrusion Prevention System. Module Objectives By the end of this module, participants will be able to: Use the FortiGate Intrusion Prevention System.
SIGCOMM 2002 New Directions in Traffic Measurement and Accounting Focusing on the Elephants, Ignoring the Mice Cristian Estan and George Varghese University.
Click Fraud Forensics Dean Qudah Pace University DPS 2010.
Dividing the Pizza An Advanced Traffic Billing System An Advanced Traffic Billing System Christopher Lawrence Burke The University of Queensland.
Systems Development and Analysis. ©2003 Prentice Hall Business Publishing, Accounting Information Systems, 9/e, Romney/Steinbart Lecture 03-2 Introduction.
Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,
Information Systems Security Operational Control for Information Security.
Testing -- Part II. Testing The role of testing is to: w Locate errors that can then be fixed to produce a more reliable product w Design tests that systematically.
Red Flag Training IDENTITY THEFT PREVENTION PROGRAM OVERVIEW AUTOMOTIVE.
Chapter 2 Specifying and Assessing What You Want to Change.
User Support Chapter 8. Overview Assumption/IDEALLY: If a system is properly design, it should be completely of ease to use, thus user will require little.
Automatic Detection of Emerging Threats to Computer Networks Andre McDonald.
Switch Features Most enterprise-capable switches have a number of features that make the switch attractive for large organizations. The following is a.
AJ Guardado Comp. Sci. 49S.  In order to correctly manage programs (AdSense, AdWords), properly charge for the PPC revenue model, and detect invalid.
Unix Security Assessing vulnerabilities. Classifying vulnerability types Several models have been proposed to classify vulnerabilities in UNIX-type Oses.
Cryptography and Network Security Sixth Edition by William Stallings.
Johannes Brodwall Chief Scientist Smidig arkitektur.
European Middleware Initiative (EMI) The Software Engineering Model Alberto Di Meglio (CERN) Interim Project Director.
CHAPTER 7 Unexpected Input. INTRODUCTION What is Unexpected Input? Something (normally user-supplied data) that is unexpected happen to an application.
Crowd Fraud Detection in Internet Advertising Tian Tian 1 Jun Zhu 1 Fen Xia 2 Xin Zhuang 2 Tong Zhang 2 Tsinghua University 1 Baidu Inc. 2 1.
Control Plans Control Kaizen Facilitation.
Katrine Evans: Current issues Key themes in enquiries and complaints “Privacy at work” Neil Sanson: Risk Data breach guidelines Data encryption Combining.
1 1 Syniverse Proprietary Fraud Management in the Cloud.
Role Of Network IDS in Network Perimeter Defense.
By Steve Shenfield COSC 480.  Definition  Incidents  Damages  Defense Mechanisms Firewalls/Switches/Routers Routing Techniques (Blackholing/Sinkholing)
Microsoft NDA Material Adwait Joshi Sr. Technical Product Manager Microsoft Corporation.
Case Brief Gregory Morton William Campbell Dave Wildner.
Practice Test Questions QUESTION 1 Which two actions must you perform to enable and use window scaling on a router? (Choose two.) A. Execute the.
FIREWALLS By k.shivakumar 08k81f0025. CONTENTS Introduction. What is firewall? Hardware vs. software firewalls. Working of a software firewalls. Firewall.
Some Great Open Source Intrusion Detection Systems (IDSs)
Detecting Web Attacks Using Multi-Stage Log Analysis
PUBLICATION PRINCIPLES for PUBLICATION PROFESSIONALS
Introduction to Networking
Strategies For Software Test Documentation
Software Verification, Validation, and Acceptance Testing
MIS2502: Data Analytics Classification Using Decision Trees
Test Cases, Test Suites and Test Case management systems
Internal Control Internal control is the process designed and affected by owners, management, and other personnel. It is implemented to address business.
CS 325: Software Engineering
Presentation transcript:

The Lane’s Gifts vs. Google Report part 2 Andrew Holoman

Google’s Approach to Detecting Invalid Clicks Google’s Click Quality Team’s Mission Statement states: Protect Google’s advertising network and provide excellent customer service to clients by: –Vigilantly monitoring invalid clicks/impressions and removing its source –Reviewing all client requests and responding in a timely manner –Developing and improving systems that remove invalid clicks/impressions and properly credit clients for invalid traffic –Educating clients and employees on invalid clicks/impressions  The Click Quality Team practices this by raising the levels of click fraud detection methods where it becomes hard and unrewarding to commit click fraud against Google

Strategic Objectives Google tries to achieve these objectives in two ways: –Prevention  Discouraging invalid clicking activities on its Network by making life of unethical users more difficult and less rewarding –Detection  Detecting and removing invalid clicks and the perpetrators

Preventive Measures Google tries to build mechanisms for preventing invalid clicking that reduce inappropriate activities and some of these are: –Making it hard to create duplicate accounts and open new accounts after the old ones are terminated –Making it hard to register using false identities –Development of certain mechanisms that automatically reduce fraudulent activities

Characterization of Invalid Click Detection  Online filtering vs. Offline monitoring and analysis –Are there some time constraints on how fast the invalid click detection should be done?  Automated vs. Manual detection –Were invalid clicks detected by a special-purpose software or by human expert?  Proactive vs. Reactive detection –Has the detection of invalid clicks occurred before or after the advertisers complaint ?  Where were invalid clicks made?  Were invalid clicks associated with the AdSense or AdWords programs ?

Process of Detecting and Removing Invalid Clicks  Pre-filtering - removal of the most obvious invalid clicks, such as “testing” and “meaningless” clicks before they are even seen by the filters  Online Filtering – several online filters monitor various logs for satisfying these conditions and detect the clicks in these logs satisfying these conditions; such clicks are marked as “invalid” and are subsequently removed  Post-filtering – offline detection and removal of invalid clicks that managed to pass the online filtering stage

Post-filtering Sub-stages What are the two sub-stages of post- filtering? –Automated monitoring –Manual reviews

Performance of Online Filters  A true click is either valid or invalid  Google filters can label a click as valid or invalid  The actual click vs. click labeling can raise confusion within the filters –In finding the accurate number of valid and invalid clicks: TP+TN+FP+FN=N –The accuracy rate is equal to (TP+TN)/N –The error rate is equal to (FP+FN)/N

Indirect Evidence  Two main pieces of evidence for Google’s filters: –Newly introduce and revised filters detect only few additional invalid clicks –The offline invalid click detection methods detect relatively few invalid clicks in comparison to the filters

Performance of Filters  Why do Google's simple filters work well most of the time? –The Combination of Filters –Extra complexity of some of the filters –Simplicity of most of the attacks –The Long Tail of invalid clicks Frequency Rank Long Tail Left Part

Conflict of Interest  Two cases: –When one particular IP address was disabled due to inappropriate clicking activities –The change in the double-click policy that was considered in the Winter of 2005 and implemented in March 2005

Automated Offline Detection Methods  Alerts  Auto-termination system for publishers

Alerts  They are used for detecting more complex and more subtle patterns of invalid clicking activities that may or may not be valid –In what stage do alerts identify invalid clicks? –What are the two types of alerts? –What are the two ways that alerts are issued?

Auto-termination System for AdSense Publishers  It’s an automated offline system for detecting the AdSense publishers who performing inappropriate behavior by violating the Terms and Conditions of the AdSense program – What are these conditions?

Manual Offline Detection Methods  Investigation of Advertisers  Investigation of Publishers

Investigation of Advertisers  Advertiser complaints: an advertiser notices unusual clicking activities and requests Google to investigate those activities for the presence of invalid clicks  Alerts: alerts detect unusual patterns of behavior of advertisers and trigger manual investigations of these patterns  Customer Service Representatives: they may request to investigate an advertiser based on the advertiser’s request or based on their own initiatives

Investigations of the Publishers  Publishers complaint  Advertiser’s complaint  Auto-termination system  Classifier  Detection of duplicate publishers  Second-review publishers  Customer service representatives  Requests from the Click Quality Team

Results of Investigations  The invalid clicks are present  No invalid clicks are present  It is unclear if invalid clicks are present