# Behavioural Verification: Preventing Report Fraud in Decentralized Advert Distribution Systems
## 5 Detailed System Analysis
### Information Components
#### 5.1.1 Ad-Reports  
The marketing industry generates profit from online advertising based mainly on three supported revenue models. The first and most popular is called **Cost-Per-Click (CPC)** advertising or Pay-Per-Click (PPC) and is founded on the principle that a reward is attributed when a user clicks on an advert that is displayed on the Publisher's domain. The second most prominent model is referred as **Cost-Per-Impression (CPM)** advertising or Pay-Per-Impression (PPM) and awards money when a user simply views a displayed advert. The third revenue model is known as **Cost-Per-Action (CPA)** or Pay-Per-Action (PPA) where money is awarded when users perform a specific action which is most typically the purchase of a product [18]. The preferences of Advertisers may not be limited to just a single pricing model and for this reason our system can support all of them at the same time by offering three different types of Ad-Reports as listed below. * **RoV:** Report of View
* **RoC:** Report of Click
* **RoA:** Report of Action  
As depicted in Figure 3, all supported Ad-Report types incorporate a sequence number \(N\) which indicates the order in which the reports were created. The _Advert Code_ is a unique reference number that is sent to the user alongside each advert and can be used for identification. The \(D_{ID}\) and \(P_{ID}\) respectively accommodate the identities of the Ad-Dealer who distributed the advert and the Publisher who featured it to the user while the _Date_ field holds the date and time of the publication. The _C-Token_ (or Click-Token), which can be found in the _RoC_ and _RoA_, is a sequence of data which can be obtained by the user when the advert is clicked. The _A-Token_ (or Action-Token) which is present in the _RoA_, follows a very similar format as the _C-Token_ with the main difference being that it is disclosed to the user only after a specific condition has been met (e.g., the user made a purchase or created an account). Each Advertiser periodically generates his own _C-Token_ and _A-Token_ which are uploaded within his domain. The function which is used for this operation as well as the frequency upon which the two tokens are updated fall udder the responsibility of the respective Advertisers. Ideally, the _C-Token_ and _A-Token_ should be generated by a cryptographically secure random number generator and as often as practically possible. The rate at which the _C-Token_ and _A-Token_ are updated influences the system's accuracy of verifying the time that the Ad-Reports were created. More specifically, if the Tokens are updated once every \(T\) time units, then the system can verify the time of a user's report with granularity \(T\). It is assumed that the random number generator is secure and that the only feasible way to obtain the _C-Token_ and _A-Token_ is by downloading them from the locations in which they were uploaded by the particular Advertiser. More specifically, the _C-Token_ is uploaded in the same cuber-space where the user is linked to when clicking on the advert while the _A-Token_ is placed in the location to which the user is diverted to when he or she performs a specific action such as making a purchase. Much like the way that web  
Figure 3: Supported types of Ad-Reports and their contents. cookies work, the mobile client obtains the _C-Token_ and _A-Token_ from the Advertiser's website and places them within the Ad-Report as the user is browsing. This enables the Advertisers to verify that a user accessed their website or performed a specific action before creating a _RoC_ or _RoA_. Having to obtain the tokens before creating a new Ad-Report, makes the forging of _RoCs_ and _RoA_ more difficult. To forge a _RoC_, the dishonest user needs to visit an advertiser's web site and to forge a _RoA_ requires him to perform an action. More importantly, tokens prevent dishonest users from creating fictitious reports ahead of time as a _RoC_ which contains a token \(C_{n}\) could not have been created before the token was made available online.