Abstract: Mobile advertising plays a vital role in the mobile app ecosystem. A major threat to the sustainability of this ecosystem is click fraud, i.e., ad clicks performed by malicious code or automatic bot problems. Existing click fraud detection approaches focus on analyzing the ad requests at the server side. However, such approaches may suffer from high false negatives since the detection can be easily circumvented, e.g., when the clicks are behind proxies or globally distributed. In this project, we present AdSherlock, an efficient and deployable click fraud detection approach at the client side (inside the application) for mobile apps. AdSherlock splits the computation-intensive operations of click request identification into an offline procedure and an online procedure. In the offline procedure, AdSherlock generates both exact patterns and probabilistic patterns based on URL (Uniform Resource Locator) tokenization. These patterns are used in the online procedure for click request identification and further used for click fraud detection together with an ad request tree model. We implement a prototype of AdSherlock and evaluate its performance using real apps. The online detector is injected into the app executable archive through binary instrumentation. Results show that AdSherlock achieves higher click fraud detection accuracy compared with state of the art, with negligible runtime overhead
Field of the Invention
Mobile advertising plays a vital role in the mobile app ecosystem. A recent report shows that mobile advertising expenditure worldwide is projected to reach $247.4 billion in 2020 . To embed ads in an app, the app developer typically includes adlibraries provided by a third-party mobile ad provider such as AdMob . When a mobile user is using the app, the embedded ad library fetches ad content from the network and displays ads to the user. The most common charging model is PPC (Pay-Per-Click), where the developer and the ad provider get paid from the advertiser when a user clicks on the ad.
A major threat to the sustainability of this ecosystem is click fraud , i.e., clicks (i.e., touch events on mobile devices) on ads which are usually performed by malicious code programmatically or by automatic bot problems. There are many different click fraud tactics which can typically be characterized into two types: in-app frauds insert malicious code into the app to generate forged ad clicks; bots-driven frauds employ bot programs (e.g., a fraudulent application) to click on
advertisements automatically. To quantify the in-app ad fraud in real apps, a recent work MAdFraud conducts a large-scale measurement about ad fraud in real-world apps.
In a dataset including about 130K Android apps, MAdFraud reports that about 30% of apps make ad requests while running in the background. Focusing on bots-driven click fraud, another recent work uses an automated click generation tool ClickDroid to empirically evaluate eight popular advertising networks by performing real click fraud attacks on them. Results show that six advertising networks out of eight are vulnerable to these attacks. Aiming at detecting click frauds in mobile apps, a straightforward approach is a threshold-based detection at the serverside. If an ad server is receiving a high number of clicks with the same device identifier (e.g., IP address) in a short period, these clicks can be considered as fraud. This straightforward approach, however, may suffer from high false negatives since the detection can be easily circumvented when the clicks are behind proxies or globally distributed. In the literature, there are also more sophisticated approaches , focusing on detecting click frauds at the server-side.
Prior Art Of Invention
AdSherlock is an efficient and deployable click fraud detection approach for mobile apps at the client side. As a client-side approach, AdSherlock is orthogonal to existing server-side approaches. It splits the computation intensive operations of click request identification into an offline process and an online process. In the offline process, AdSherlock generates both exact patterns and probabilistic patterns based on url tokenization. These patterns are used in the online process for click request identification, and further used for click fraud detection together with an ad request tree model. Evaluation shows that AdSherlock achieves high click fraud
detection accuracy with a negligible runtime overhead. In the future, we plan to combine static analysis with the traffic analysis to improve the accuracy of ad request identification and explore attacks designed to evade Adsherlock. we propose an explorative study of ad fraud in Android apps. We first create a taxonomy of existing mobile ad frauds. Besides static placement fraud, we also created a new category called dynamic interactive fraud that has never been explored by previous work. Then we propose FrauDroid, a new approach to detect ad frauds based on UI transition graph and networking traffic. Based on extensive experiments on smartphones, we have identified 92 ad fraud apps, roughly accounted for 0.3% of the apps that use ad libraries in our study. The result suggests that ad fraud is threatening the mobile advertising ecosystem and should be paid more attentions.
Summary of Invention
We propose AdSherlock, an efficient and deployable click fraud detection approach for mobile apps at the client side. As a client-side approach, AdSherlock is orthogonal to existing server-side approaches. AdSherlock is designed to be used by app stores to ensure a healthy mobile app ecosystem. AdSherlock's high accuracy helps market operators to fight both in-app frauds and bots-driven frauds. Note that, AdSherlock can also be used by any third parties to detect in-app frauds. For example, ad providers can employ AdSherlock to check whether apps embedding their libraries have in-app fraudulent behaviours.
We propose two pattern classes: exact patterns and probabilistic patterns. Both of them are built from invariant substrings in the HTTP header. We refer to these substrings as tokens. Exact patterns consist of a set of sequential tokens and match
an HTTP request if and only if the request contains all tokens in the set with thesame ordering. Probabilistic patterns consist of a set of tokens, each of whichassociated with an ad score, and a non-ad score.
Statement of Invention
Publishing advertisements
Owner have to register in the application with his/ her details to post the advertisements. After owner login owner can able to post the ad by filling al, the ad details and by uploading the image of add. After uploading the advertisement, owner can able to view the advertisements posted by him/ her. All the advertisements are stored into MySQL database that can be viewed by users in their home page. The advertisement is stored with ad id, ad description, ad image and owner id who post the advertisement.
Viewing advertisements
User have to register in the application with their details. Then the total data of the user is stored into database and admin is able to see the user credentials. User home page contains all the advertisements posted by the owners and he/ she is able to watch the full ad by clicking on it. These clicks are analyzed by the admin whether they are done by authorized user or unauthorized user. That is done by verifying the id of user assigned in the user registration time. All the clicks done by the user on advertisement are stored in the clicks table with their id and user name.
Unauthorised clicks
Fraud can access the application the URL Page that is created in the application if the user changes the URL into this page, then the URL tokenization is done and a random id is generated for the fraud then if the click is done by fraud, then the total clicks done on each item s counted and noted it as fraud click. These fraud clicks on each advertisement id is verified by the admin in admin login. All the data are stored into the clicks table for finding the fraud clicks.
Analysis of user clicks
Admin have all users and owner's credentials, all the advertisements posted by owner also stored in database using MySQL. The clicks done by the user also stored in the database and analysed whether they are fraud clicks or non-fraud clicks based on user id that is stored the database. If the user is not genuine the click done by the user is noted as fraud click with the advertisement id that was clicked by the user. The total details are store in the clicks table with user id, add id, user name, clicks for every add id. So, in the fraud clicks page admin can view the total click analysis as fraud clicks or non-fraud clicks.
ARCHITECTURE
A System architecture or systems architecture is the conceptual model that defines the structure, behavior, and more views of a system. An architecture description is a formal description and representation of a system, organized in a way that supports reasoning about the structures and behaviors of the system.
| # | Name | Date |
|---|---|---|
| 1 | 202241009874-Abstract_As Filed_24-02-2022.pdf | 2022-02-24 |
| 1 | 202241009874-Small Entity_Form-28_24-02-2022.pdf | 2022-02-24 |
| 2 | 202241009874-Form9_Early Publication_24-02-2022.pdf | 2022-02-24 |
| 3 | 202241009874-Form-1_As Filed_24-02-2022.pdf | 2022-02-24 |
| 4 | 202241009874-Form 2(Title Page)Complete_24-02-2022.pdf | 2022-02-24 |
| 5 | 202241009874-Educational Institution Eligibility Document_24-02-2022.pdf | 2022-02-24 |
| 6 | 202241009874-Drawing_As Filed_24-02-2022.pdf | 2022-02-24 |
| 7 | 202241009874-Description Complete_As Filed_24-02-2022.pdf | 2022-02-24 |
| 8 | 202241009874-Correspondence_As Filed_24-02-2022.pdf | 2022-02-24 |
| 9 | 202241009874-Claims_As Filed_24-02-2022.pdf | 2022-02-24 |
| 10 | 202241009874-Abstract_As Filed_24-02-2022.pdf | 2022-02-24 |