DESC:METHOD AND SYSTEM TO DETECT ADVERTISEMENT FRAUD

TECHNICAL FIELD

[0001] The present disclosure relates to the field of fraud detection systems and, in particular, relates to a method and system to detect advertisement fraud based on incentive and non-incentive traffic.

BACKGROUND

[0002] With the advancements in technology over the last few years, users have predominantly shifted towards smartphones for accessing multimedia content. Nowadays, users access content through a number of applications available for download through various online application stores. Businesses (Advertisers) have started focusing on generating revenue by targeting consumers through these applications. In addition, businesses have started investing heavily in doing business with these applications. Moreover, businesses (publishers and/or advertising networks) have started developing capable advertisement applications for serving advertisements through these applications. These advertisements are published in real time or fixed placements through these applications and watched by the users. The advertisers are benefited in terms of internet traffic generated by clicking, taking action like installing or on watching these advertisements. However, certain online publishers and advertising networks working with these publishers take undue advantage of this in order to generate high revenues. These online publishers and advertising networks employ fraudulent techniques in order to generate clicks or to increase actions like increasing number of application install for the advertisers through fraudulent means. In addition, these online publishers incentivize the users for clicking on links, downloading applications and the like. This results in a loss of advertisers marketing budget spent as many times these publishers claim a normal user-initiated action (Organic action, e.g. Organic Install) as one initiated by them or at times the clicks or application installs are not driven by humans at all and instead by bots. There is a consistent need to stop publishers from performing such types of click fraud and transaction fraud.

OBJECT OF THE DISCLOSURE

[0003] A primary object of the present disclosure is to provide a method and system to detect fraud in advertisements based on incentive and non-incentive traffic.

[0004] Another object of the present disclosure is to alert an advertiser about the incentive and non-incentive traffic for driving application installs for taking action accordingly.

[0005] Another object of the present disclosure is to deter publishers from performing click spamming techniques and driving installs by incentivizing users.

[0006] Yet another object of the present disclosure is to stop publishers who are performing fraudulent techniques to generate more revenue.

[0007] Yet another object of the present disclosure is to prevent loss to advertisers by providing access to information related to incentivized traffic.

SUMMARY

[0008] In one aspect, the present disclosure provides a computer system. The computer system includes one or more processors and a memory. The memory is coupled to the one or more processors. The memory stores instructions. The instructions are executed by the one or more processors. The execution of instructions causes the one or more processors to perform a method to detect advertisement fraud based on time between events. The method includes a first step to cluster a traffic data into slots of install. The clustering is done after receiving the traffic data in real time. In addition, the method includes a second step to determine a high conversion rate and a low conversion rate for the slots of install. Further, the method includes a third step to analyze deviation of the high conversion rate and the low conversion rate with a pre-defined threshold. Furthermore, the method includes a fourth step to segregate incentive traffic and non-incentive traffic based on the analysis. The clustering is done based on one of a plurality of criteria by adaptive slot grouping engine. The determination is done by using segmentation statistical models in real time. The determination is done for the slots of install where the number of install is above a minimum install based on examination of user behavior. The analysis is done to identify fraud in the traffic data. The analysis is done when a signal generator circuitry embedded inside a plurality of media devices generates a signal to trigger one or more hardware components of the plurality of media devices. The segregation is done to generate report of the traffic data. The segregation is done to determine a incentive time in real time.

BRIEF DESCRIPTION OF FIGURES
[0009] Having thus described the invention in general terms, references will now be made to the accompanying figures, wherein:

[0010] FIG. 1A illustrates an interactive computing environment for identification of advertisement fraud in real time, in accordance with various embodiments of the present disclosure;

[0011] FIG. 1B illustrates a block diagram of various components of the interactive computing environment for the detection of fraud in the advertisements, in accordance with various embodiments of the present disclosure; and

[0012] FIG. 2 illustrates a block diagram of a computing device, in accordance with various embodiments of the present disclosure.

[0013] It should be noted that the accompanying figures are intended to present illustrations of exemplary embodiments of the present invention. These figures are not intended to limit the scope of the present invention. It should also be noted that accompanying figures are not necessarily drawn to scale.

DETAILED DESCRIPTION

[0014] Reference will now be made in detail to selected embodiments of the present invention in conjunction with accompanying figures. The embodiments described herein are not intended to limit the scope of the invention, and the present invention should not be construed as limited to the embodiments described. This invention may be embodied in different forms without departing from the scope and spirit of the invention. It should be understood that the accompanying figures are intended and provided to illustrate embodiments of the invention described below and are not necessarily drawn to scale. In the drawings, like numbers refer to like elements throughout, and thicknesses and dimensions of some components may be exaggerated for providing better clarity and ease of understanding.

[0015] It should be noted that the terms "first", "second", and the like, herein do not denote any order, ranking, quantity, or importance, but rather are used to distinguish one element from another. Further, the terms "a" and "an" herein do not denote a limitation of quantity, but rather denote the presence of at least one of the referenced item.

[0016] FIG. 1A illustrates an interactive computing environment 100 for detection of an advertisement fraud in real time, in accordance with various embodiments of the present disclosure. The interactive computing environment 100 shows a relationship between various entities involved in detection of fraud in one or more advertisements 108 based on incentive traffic and non-incentive traffic. The advertisement fraud is a type of fraud which is being done to generate more revenue from the one or more advertisements 108 being displayed by generating fake install or clicks. The fake install is done with the help of software, bots. The fake install or fake traffic is faked through techniques such as click fraud, transaction fraud and the like. The click fraud corresponds to regular or constant clicking by at least one of a plurality of users 102 on the one or more advertisements 108 in order to generate more revenue for a publisher 106. The click fraud is when the publisher 106 gets paid based on pay-per-click or pay-per-view bases whenever the one or more advertisements 108 get clicked. The click fraud refers to the generation of fraudulent clicks through online bots which are not identifiable and are treated as genuine install. The transaction fraud refers to initiating install via fake clicks and bots (as described above in the application). The transaction fraud takes place when the publisher 106 applies fraudulent techniques to drive fake installs of applications in order to generate more revenue.

[0017] The incentive traffic or incent traffic corresponds to advertisement traffic generated by clicking on the one or more advertisements 108, installing an application after clicking on the one or more advertisement 108 and the like. The incentive traffic is generated when the plurality of users 102 is rewarded by the publisher 106 for clicking on the one or more advertisements 108, installing an application, and the like. The plurality of users 102 is rewarded by giving points, coins, lifeline, in-app purchase and the like. The plurality of users 102 may be redirected to a website associated with one or more advertisers 114 after clicking on the one or more advertisements 108. The incentive traffic includes a list of users who do not use the applications actively or uninstall the one or more advertisers 114 application after some time. The plurality of users 102 in the incentive based traffic click on the one or more advertisements 108 or watch the one or more advertisements 108 for their own purposes. In an example, a user click on an advertisement to earn some points for a game he or she is playing on a device.

[0018] The non-incentive traffic or non-incent traffic corresponds to the advertisement traffic wherein no benefit is provided to the plurality of users 102 for clicking or downloading the one or more advertisements 108. The non-incentive traffic is a list of users who click on the one or more advertisements 108 as per their choice with no such incentive to lure the plurality of users 102. In addition, the non-incentive traffic is a list of the plurality of users 102 who are interested in using the one or more advertisers 114 application or interested in what the one or more advertisements 108 is about.

[0019] The interactive computing environment 100 includes the plurality of users 102, a plurality of media devices 104, the publisher 106 and the one or more advertisements 108. Further, the interactive computing environment 100 includes one or more hardware components 110, a signal generator circuitry 112, the one or more advertisers 114, a fraud identification system 116, a server 118 and a database 120. In addition, the fraud identification system 116 includes a plurality of components (as shown in FIG. 1B). The plurality of components includes a machine learning engine 116a, adaptive slot grouping engine 116b, s segmentation engine 116c and a blacklisting engine 116d. Each of the components of the interactive computing environment 100 interacts with each other to enable detection of advertisement fraud in real time based on incentive and non-incentive traffic.

[0020] The interactive computing environment includes the plurality of users 102 who is any person present at any location and accessing the multimedia content. The plurality of users 102 is any legal person or natural person who access online multimedia content and need an IP based network for accessing the multimedia content. In addition, the plurality of users 102 is an individual or person who access online multimedia content on the plurality of media devices 104. Further, the plurality of users 102 is a computer or bots which is programmed to view the one or more advertisements 108 and performs click and transaction in order to do fraud. In an embodiment of the present disclosure, the plurality of users 102 includes but may not be limited to a natural person, legal entity, individual, machine and robots for viewing advertisement. The plurality of users 102 is associated with the plurality of media devices 104.

[0021] The interactive computing environment further includes the plurality of media devices 104 which help to communicate information. The plurality of media devices 104 includes but may not be limited to a Smartphone, a laptop, a desktop computer, a tablet and a personal digital assistant. In an embodiment of the present disclosure, the plurality of media devices 104 includes a smart television, a workstation, an electronic wearable device and the like. In an embodiment, the plurality of media devices 104 includes portable communication devices and fixed communication devices. In an embodiment of the present disclosure, the plurality of media devices 104 is currently in the switched-on state. The plurality of users 102 accesses the plurality of media devices 104 in real time. The plurality of media devices 104 are any type of devices having an active internet. The plurality of media devices 104 are internet-enabled device for allowing the plurality of users 102 to access the publisher 106. In an embodiment of the present disclosure, the plurality of users 102 is owner of the plurality of media devices 104. In another embodiment of the present disclosure, the plurality of users 102 is not the owner of the plurality of media devices 104. In addition, the plurality of media devices 104 are used for viewing an application which is installed on the plurality of media devices 104.

[0022] The interactive computing environment 100 further includes the publisher 106 which is used for viewing content on the plurality of media devices 104. The publisher 106 includes but may not be limited to mobile application, web application and website. The publisher 106 is the mobile application which displays content to the plurality of users 102 on the plurality of media devices 104. The content includes one or more publisher content, one or more video content and the like. The application or the publisher 106 accessed by the plurality of users 102 shows content related to interest of the plurality of users 102. In an example, the plurality of users 102 may be interested in watching online videos, reading blogs, play online games, accessing social networking sites and the like. The publisher 106 is the application developed by the application developer for viewing or accessing specific content. The publisher 106 or applications are advertisement supporting applications which are stored on the plurality of media devices 104. The publishers 106 or mobile applications are of many type which includes gaming application, a utility application, a service based application and the like. The publishers 106 provide space, frame, area or a part of their application pages for advertising purposes which is referred to as advertisement slots. The publisher 106 consists of various advertisement slots which depend on the choice of the publisher 106. The publishers 106 advertise products, services or businesses to the plurality of users 102 for generating revenue. The publisher 106 displays the one or more advertisements 108 on the plurality of media devices 104 when the plurality of users 102 is accessing the publisher 106.

[0023] The one or more advertisements 108 are a graphical or pictorial representation of the information in order to promote a product, an event, service and the like. In general, the one or more advertisements 108 are a medium for promoting a product, a service, or an event. The one or more advertisements 108 include text advertisement, video advertisement, graphic advertisement and the like. The one or more advertisements 108 are displayed in third party applications developed by application developers. The one or more advertisements 108 are presented to attract the plurality of users 102 based on his interest in order to generate revenue. The one or more advertisements 108 are presented to the plurality of users 102 on the publisher 106 based on interest of the plurality of users 102 which is shown for a specific period of time. The plurality of users 102 click on the one or more advertisements 108 and the plurality of users 102 is re-directed to a website or application or application store associated with the one or more advertisements 108. The one or more advertisements 108 are provided to the publisher 106 by the one or more advertisers 114 who want to advertise their product, service through the publisher 106. The publisher 106 gets paid if the plurality of users 102 visits the application or website through the one or more advertisements 108 of the one or more advertisers 114. The number of plurality of users 102 who visits the one or more advertisements 108 through the publisher 106 generates more revenue for the publisher 106.

[0024] The one or more advertisers 114 are those who want to advertise their product or service and the like to the plurality of users 102. The one or more advertisers 114 approach the publisher 106 and provide the one or more advertisements 108 to be displayed for the plurality of users 102 on the publisher 106. The one or more advertisers 114 pay the publisher 106 based on the number of the plurality of users 102 being redirected or taking the product or services provided by the one or more advertisers 114.

[0025] The one or more advertisements 108 are placed on the advertisement slots in the publisher application on the plurality of media devices 104 associated with the plurality of users 102. The one or more advertisers 114 purchase the advertisement slots from the publisher 106. The one or more advertisements 108 is served based on a real-time bidding technique or a direct contract between the one or more advertisers 114 and the publisher 106. The one or more advertisers 114 provide the one or more advertisements 108 to advertising networks and information associated with advertising campaigns. The advertisement networks enable display of the one or more advertisements 108 in real time on the publisher 106 on behalf of the one or more advertisers 114. The advertising networks are entities that connect the one or more advertisers 114 to websites and mobile applications that are willing to serve advertisements.

[0026] The interactive computing environment 100 further includes the one or more hardware components 110 which are embedded inside the one or more media devices 104. The one or more hardware components 110 include but may not be limited to camera, microphone, LED, light sensor, proximity sensor and accelerometer sensor. The one or more hardware components 110 include but may not be limited to gyroscope, compass and the like. The one or more hardware components 110 are triggered when the signal generator circuitry 112 embedded inside the plurality of media devices 104 generates a signal to trigger the one or more hardware components 110.

[0027] The signal generator circuitry 112 is used for generating signal and to trigger the one or hardware components 110 associated with the plurality of media devices 104. The one or more hardware components 110 are triggered for one or more purposes. The one or more purposes include but may not be limited to sending, receiving, analyzing information and the like. The one or more purposes include generating a signal based on the requirement of the fraud identification system 116. The signal generator circuitry 112 triggers the one or more hardware components 110 to perform a specific task in the plurality of media devices 104.

[0028] The interactive computing environment 100 further includes the fraud identification system 116 which is associated with the publisher 106 and the one or more advertisers 114. The fraud identification system 116 detects advertisement fraud by segregating the incentive based traffic with the non-incentive based traffic. The fraud identification system 116 detects advertisement fraud being done by the publisher 106 in order to generated fake traffic for the one or more advertisements 108. The fraud identification system 116 is linked with the publisher 106 which may be more than one in real time. The fraud identification system 116 is a platform for detecting incentive traffic being generated for a non-incentive based advertisement campaign. The fraud identification system 116 performs the detection of fraud in the one or more advertisements 108 in real time. The fraud identification system 116 performs the detection of fraud by performing sequence of tasks which includes but may not be limited to receiving traffic data, receiving device data. Further, the fraud identification system 116 performs the tasks of clustering the traffic data, identifying conversion rate, analysis, segregating and the like.

[0029] The fraud identification system 116 receives the traffic data initiated through the plurality of media devices 104. The traffic data is generated when the one or more advertisements 108 are viewed on at least one publisher 106 on the plurality of media devices 104. The traffic data is generated when the one or more advertisements 108 are clicked by the plurality of users 102. In general, the traffic data include the list of the plurality of users 102 who has clicked the one or more advertisements 108 of the one or more advertisers 114. The traffic data includes both the incentive traffic and the non-incentive traffic based data.

[0030] In addition, the fraud identification system 116 clusters a traffic data into slots of install. The clustering is done based on one of a plurality of criteria. The plurality of criteria includes number of installs, time-interval, historical trends and predefined. In an embodiment of the present disclosure, the plurality of criteria is any other criteria based on requirement of the fraud identification system 116. The clustering is done in real time by the adaptive slot grouping engine 116b as shown in FIG. 1B. The adaptive slot grouping engine 116b is used for grouping or clustering the traffic data into the slots of install. The number of install is selected than the number of installs in a day is used for clustering the traffic data into the slots of install. In an example, if the number of installs in a day are 10000 than the clustering can be done based on 1000 install periods, 2000 install periods, and the like.

[0031] In another embodiment of the present disclosure, the time-interval is used by the adaptive slot grouping engine 116b for clustering the traffic data. In an example, 24 hours a day can be divided into slots of install of 1 hour each based on the traffic data. In yet another embodiment of the present disclosure, the historical trends is used by the adaptive slot grouping engine 116b for the clustering of the traffic data. In an example, if the historical trend shows the clustering being done based on the time-interval than it selects the time-interval for the clustering of the traffic data. In yet another embodiment of the present disclosure, the clustering method can be predefined which is used by the adaptive slot grouping engine 116b for the clustering of the traffic data.

[0032] Further, the fraud identification system 116 identifies user behavior from device data, application data, past data and third party database. The user behavior is identified by the machine learning engine 116a of the fraud identification system 116. The user behavior includes but may not be limited to user routine, time stamp, user interactions and application usage data. In an embodiment of the present disclosure, the device data includes a number of application install, a number of application uninstalled, time-stamp, location and the like. In another embodiment of the present disclosure, the device data includes but may not be limited to the operating system, network type, service provider and location. In yet another embodiment of the present disclosure, the device data includes but may not be limited to model number, device type network speed.

[0033] In an embodiment of the present disclosure, the application data includes but may not be limited to network download time, application usage time, and application idle time. In another embodiment of the present disclosure, the application data includes but may not be limited to network download time, application opening time and application size. In yet another embodiment of the present disclosure, the application data includes time to download, time to run, click to install, click to run, user click time, device load time, time to run and time to install. The third party database includes data which has been collected during past visits of the plurality of users 102 on third party publisher.

[0034] Furthermore, the fraud identification system 116 examines the user behavior to identify a downtime and minimum install. The downtime is the time during which the plurality of users 102 is inactive or not using the application due to which there is less traffic during such time-period. The downtime is the time during which there is less traffic on the number of clicks done by the plurality of users 102. The minimum install is the number of install that will be there in particular slots of install for it to be analyzed further. The minimum install is identified by the fraud identification system 116 based on the examination of the user behavior.

[0035] Furthermore, the fraud identification system 116 determines the high conversion rate and the low conversion rate for each slots of install where the number of install is above the minimum install. The determination is done at the segmentation engine 116c of the fraud identification engine 116. The conversion rate is the percentage of clicks on the one or more advertisements 108. In an example, if there are 10,000 clicks and 100 installs, then the conversion rate is 100 / 10000 which is 1%. The determination of the high conversion rate and the low conversion rate is done by using segmentation statistical models in real time. The segmentation statistical models include K-means algorithm with low and high seeds initially set to the low conversion rate and the high conversion rate.

[0036] In an example, if the plurality of users 102 is 2000 in city X than during the night hours there is inactivity of the number of users, this time of inactivity is considered as the downtime which would be around 6 hours. During the downtime there will be less number of the plurality of users 102 generating the traffic. The minimum install is the number of users clicking on the one or more advertisements 108 that would be around 300 users. Than the fraud identification system 116 will determine high conversion rate and the low conversion rate for those results which are having number of install more than the minimum install.

[0037] Moreover, the fraud identification system 116 analyzes deviation of the high conversion rate and the low conversion rate with a pre-defined threshold. The analysis is done when the signal generator circuitry 112 embedded inside the plurality of media devices 104 generates a signal. The signal is generated to trigger the one or more hardware components 110 of the plurality of media devices 104. The analysis is done at the machine learning engine 116a of the fraud identification system 116. The analysis is done of the high conversion rate and the low conversion rate for each of the slots of install. The pre-defined threshold is provided by the one or more advertisers 114. In an embodiment of the present disclosure, the pre-defined threshold is determined by the fraud identification system 116 based on the requirement of the one or more advertisers 114.

[0038] Moreover, the fraud identification system 116 segregates the incentive traffic and non-incentive traffic based on the analysis of the high conversion rate and the low conversion rate. The segregation is performed by the segmentation engine 116c. If the deviation is low than it is considered as the click spamming fraud is being committed in the traffic data. In addition, if the deviation is normal than it is considered to be normal traffic being generated by the one or more advertisements 108. Further, if the deviation is high than it is considered as the large amount of incentivized traffic has been added to the traffic data. In an example, if the deviation is 1 than it is considered as normal traffic for the traffic data for the slots of install.

[0039] Also, the fraud identification system 116 analyzes the slots of install for which difference between the average of the high conversion rate and the low conversion rate is above a pre-threshold. The analysis is done in real time. The difference is above the pre-threshold indicates that incentivized traffic mixing has been performed by the publisher 106. The pre-threshold is the threshold which has been provided by the one or more advertisers 114. In an embodiment of the present disclosure, the pre-threshold has calculated by the fraud identification system 116.

[0040] In an embodiment of the present disclosure, the fraud identification system 116 determines incentive time for which incents mixing was performed by the publisher 106. The determination is done based on the analysis of the slots of install. The incentive time is the time period for which the incentive is provided to the plurality of users 102 for clicking or installing an application though the one or more advertisements 108. The determination is done in real time.

[0041] Also, the fraud identification system 116 adds the publisher 106 in the blacklist. The publisher 106 is added in the blacklist by the blacklisting engine 112d. The blacklist contains the list of publishers 106 performing fraud for generating incentivized traffic. The blacklisting engine 112d contains the blacklist and white list which is stored in the database 120. The white list contains the list of publishers 106 providing genuine traffic for the one or more advertisements 108.

[0042] Also, the fraud identification system 116 generates report of the traffic data based on the segregation of the traffic data. The report is generated based on the analysis containing the list of the publishers 106 performing fraud. Also, the fraud identification system 116 blocks the publisher 106 performing fraud in the one or more advertisements 108 based on the analysis of the traffic data. The blocking of the publisher 106 performing fraud is blocked by the blacklisting engine 112d of the fraud identification system 116. The blocking is done in real time. The blocking is done of the publishers 106 providing fraud incentivized traffic. In an embodiment of the present disclosure, the fraud identification system 116 send list of the one or more advertisers 114 performing incent mixing and providing incentivized traffic.

[0043] In an embodiment of the present disclosure, the fraud identification system 116 receives user interaction after installing the application shown as the one or more advertisements 108 to the plurality of users 102. Further, the fraud identification system 116 analyzes the user interaction in order to identify if the activity of the plurality of users 102 is genuine. The analysis is done by identifying the correlation between the high conversion rate and low conversion rate to identify the installation being incentivized. In an example, if a user X is installing an application for first time and using the application after installation based on the user interaction than the traffic is not-incentivized.

[0044] The interactive computing environment 100 further includes the database 120 as shown in FIG. 1A is where all the information is stored for accessing. The database 120 includes data which is pre-stored in the database and data collected in real-time. The database 120 may be a cloud database or any other database based on the requirement for the fraud detection. The data is stored in the database 120 in various tables. The tables are matrix which stored different type of data. In an example, one table may store data related to the plurality of users 102 and in other table the plurality of media devices 104 related data is stored. The database 120 is included inside the server 118.

[0045] The server 118 is used to perform task of accepting request and respond to the request of other functions. The server 118 may be a cloud server which is used for cloud computing to enhance the real time processing of the system and using virtual space for task performance. In an embodiment of the present disclosure, the server 118 may be any other server based on the requirement for the fraud identification system 116.

[0046] FIG. 2 illustrates a block diagram of a device 200, in accordance with various embodiments of the present disclosure. The device 200 hosts the fraud identification system 116. The device 200 is a non-transitory computer readable storage medium. The device 200 includes a bus 202 that directly or indirectly couples the following devices: memory 204, one or more processors 206, one or more presentation components 208, one or more input/output (I/O) ports 210, one or more input/output components 212, and an illustrative power supply 214. The bus 202 represents what may be one or more busses (such as an address bus, data bus, or combination thereof). Although the various blocks of FIG. 2 are shown with lines for the sake of clarity, in reality, delineating various components is not so clear, and metaphorically, the lines would more accurately be grey and fuzzy. For example, one may consider a presentation component such as a display device to be an I/O component. Also, processors have memory. The inventors recognize that such is the nature of the art, and reiterate that the diagram of FIG. 2 is merely illustrative of an exemplary device 200 that can be used in connection with one or more embodiments of the present invention. Distinction is not made between such categories as “workstation,” “server,” “laptop,” “hand-held device,” etc., as all are contemplated within the scope of FIG. 2 and reference to “computing device.”

[0047] The device 200 typically includes a variety of computer-readable media. The computer-readable media can be any available media that can be accessed by the device 200 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, the computer-readable media may comprise computer storage media and communication media. The computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. The computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the device 200. The communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.

[0048] Memory 204 includes computer-storage media in the form of volatile and/or nonvolatile memory. The memory 204 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical-disc drives, etc. The device 200 includes the one or more processors 206 that read data from various entities such as memory 204 or I/O components 212. The one or more presentation components 208 present data indications to a user or other device. Exemplary presentation components include a display device, speaker, printing component, vibrating component, etc. The one or more I/O ports 210 allow the device 200 to be logically coupled to other devices including the one or more I/O components 212, some of which may be built in. Illustrative components include a microphone, joystick, game pad, satellite dish, scanner, printer, wireless device, etc.

[0049] The foregoing descriptions of specific embodiments of the present technology have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the present technology to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to explain the principles of the present technology best and its practical application, to thereby enable others skilled in the art to best utilize the present technology and various embodiments with various modifications as are suited to the particular use contemplated. It is understood that various omissions and substitutions of equivalents are contemplated as circumstance may suggest or render expedient, but such are intended to cover the application or implementation without departing from the spirit or scope of the claims of the present technology.

[0050] While several possible embodiments of the invention have been described above and illustrated in some cases, it should be interpreted and understood as to have been presented only by way of illustration and example, but not by limitation. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above-described exemplary embodiments.
,CLAIMS:What is claimed is:

1. A computer system comprising:

one or more processors (206); and

a memory (204) coupled to the one or more processors (206), the memory (204) for storing instructions which, when executed by the one or more processors (206), cause the one or more processors (206) to perform a method for detecting advertisement fraud based on incentive and non-incentive traffic, the method comprising:

clustering, at a fraud identification system (112), a traffic data into slots of install, wherein the clustering is done based on one of a plurality of criteria by a adaptive slot grouping engine (116b), wherein the clustering is done after receiving the traffic data in real time;

determining, at the fraud identification system (112), a high conversion rate and a low conversion rate for the slots of install, wherein the determination is done by using segmentation statistical models in real time, wherein the determination is done for the slots of install where the number of install is above a minimum install based on examination of user behavior;

analyzing, at the fraud identification system (112), deviation of the high conversion rate and the low conversion rate with a pre-defined threshold, wherein the analysis is done to identify fraud in the traffic data, wherein the analysis is done when a signal generator circuitry (112) embedded inside a plurality of media devices (106) generates a signal to trigger one or more hardware components (114) of the plurality of media devices (106); and

segregating, at the fraud identification system (112), incentive traffic and non-incentive traffic based on the analysis, wherein the segregation is done to generate report of the traffic data, wherein the segregation is done to determine a incentive time in real time.

2. The computer system as recited in claim 1, wherein the plurality of criteria comprises of a number of installs, time-interval, historical trends and predefined.

3. The computer system as recited in claim 1, wherein the device data comprises a number of application install, a number of application uninstalled, time-stamp, location, operating system, network type, service provider, location, model number, network speed and device type.

4. The computer system as recited in claim 1, wherein the application data comprises network download time, application usage time, application idle time, application opening time, application size, time to download, time to run, click to install, click to run, user click time, device load time, time to run and time to install.

5. The computer system as recited in claim 1, further comprising,

receiving, at the fraud identification system (112), the traffic data initiated through the plurality of media devices (104), wherein the traffic data is generated when one or more advertisements (108) are viewed on atleast one publisher (106) on the plurality of media devices (104).

6. The computer system as recited in claim 1, further comprising,

identifying, at the fraud identification system (116), the user behavior from device data, application data, past data and third party database, wherein the user behavior comprises user routine, time stamp, user interactions and application usage data.

7. The computer system as recited in claim 1, further comprising,

examining, at the fraud identification system (116), the user behaviour to identify a downtime and the minimum install, wherein the examination is done based on real-time data and user behavior, wherein the examination is done in real time.

8. The computer system as recited in claim 1, further comprising,

analyzing, at the fraud identification system (116), the slots of install for which difference between the average of the high conversion rate and the low conversion rate is above a pre-threshold, wherein the analysis is done in real time.

9. The computer system as recited in claim 1, further comprising,

determining, at the fraud identification system (116), the incentive time for which incent mixing is performed based on the analysis, wherein the determination is done in real time.

10. The computer system as recited in claim 1, further comprising

blocking, at the fraud identification system, the publisher performing fraud in the one or more advertisements based on the analysis of the traffic data, wherein the blocking is done in real time.