# Behavioural Verification: Preventing Report Fraud in Decentralized Advert Distribution Systems
## 6 Evaluation
### Fraud Protection of Advertisers  
Financial fraud against the Advertisers is the main shortcoming of the currently enforced model that we address with our work. The main perpetrators of fraud are BotNets (automated clickers) and Click Farms where low-paid workers are hired to click on adverts. Such schemes commit fraud by generating a large bulk of Ad-Report traffic that does not correspond to actual consumer activity. To combat this problem, our model enables the affected stakeholders (Advertisers, Publishers and Broker) to (1) calculate the rate upon which a user creates reports and (2) verify that a user has the same behavioural patterns as a typical consumer. To illustrate the system's protection against fraud, we will examine an attack scenario where a dishonest user \(\widehat{U}\) attempts to commit fraud at a large scale by submitting a set \(\widehat{S}=\{\widehat{ARC}_{1},...,\widehat{ARC}_{\widehat{t}}\}\) of fictitious \(ARCs\). Recall that an \(ARC\) contains the following types of blocks: _RoV_ (Report of View), _RoC_ (Report of Click), _RoA_ (Report of Action), _CB_ (Checkpoint Block) and _AB_ (Affiliation Block). Among all types of reports, the _RoV_ is the easiest to fabricate as it does not contain any verifiable information (_Tokens_). However, \(\widehat{U}\) cannot submit an \(\widehat{ARC}\) which only contains _RoVs_ as this would be immediately rejected by the Broker. The _RoC_ and _RoA_ contain a _C-Token_ (Click-Token) or an _A-Token_ (Action-Token) which can only be obtained by visiting the Advertiser's website within a particular time-frame. This prevents \(\widehat{U}\) from creating _RoCs_ and _RoAs_ ahead of time but \(\widehat{U}\) can still attempt to commit fraud by creating the \(\widehat{ARC}\) over a longer period of time. Although this makes the creation of the \(\widehat{ARC}\) more difficult, it is still possible with the use of an automated process that automatically downloads the _Tokens_ when they become available. Despite this fact, the \(\widehat{ARC}\) would still be rejected by the Broker as it would not contain any _CBs_ or _ABs_. Recall that _CBs_ are distributed by Ad-Dealers and include a _T-Token_ (Time-Token) which is signed and cannot be forged without knowledge of a secret cryptographic key. In order to obtain valid _CBs_, \(\widehat{U}\) would need to repeatedly travel to the physical location of an Ad-Dealer throughout the course of the creation possess of the \(\widehat{ARC}\). Moreover, the fraudster must be cautious not to request multiple _CBs_ (for different \(\widehat{ARCs}\)) at the same time as this would provoke suspicion. Even if \(\widehat{U}\) were to conspire with one of the Ad-Dealers, the \(\widehat{ARC}\) would still be in danger of being exposed due to the disproportionate number of _CBs_ from just one source. For such an attack to be successful, the fraudster would need to conspire with multiple Ad-Dealers and manage the _CBs_ in a way that does not create an observable pattern (e.g., multiple \(\widehat{ARCs}\) containing _CBs_ from the same group of Ad-Dealers). Provided that the Ad-Dealers are carefully selected, such a scenario would be unlike. The _ABs_ are exchanged between users and serve a similar purpose as _CBs_ as they can be used to determine the rate in which the reports were created. In contrast to _CBs_ however, the _T-Token_ which is contained in _ABs_ is not signed by an Ad-Dealer but by another user. This makes _ABs_ vulnerable to forgery as \(\widehat{U}\) can exchange _ABs_ between multiple fake \(\widehat{ARCs}\). However, if the fraudster was to compose a \(\widehat{ARCs}\) in such a manner, suspicions would still be raised by the Broker due to the lack of _CBs_, _RoCs_ and _RoAs_. To conclude, in order for \(\widehat{U}\) to fabricate \(\widehat{ARCs}\) which are realistic enough to fool the Broker, \(\widehat{U}\) would need to use an automated process which downloads _C-Tokens_ and _A-Tokens_ over an extended period of time.