## 8 Taxonomy of Ad Fraud Prevention and Detection Methods
### Detection of Digital Advertising Fraud in Academia  
#### 8.2.1 Placement Fraud Detection  
As discussed earlier, placement fraud refers to fraudulent activities intended to manipulate or modify the content of a publisher's web pages in order to increase the number of impressions or clicks, as well as a variety of other actions that range from malvertising, ad injections to domain-name spoofing.  
To combat placement fraud, [PERSON] et al. [2018] have introduced a topology-based detection system called MadTrace, capable of automatically generating detection rules to inspect advertisement delivery processes and discover malvertising activities. MadTracer has two major components. The first component is responsible for identifying malvertising content-delivery paths by analysing a larger set of ad click-paths and their features. The second part is an analyser that monitors the infected publisher pages to study cloaking techniques and expand the detection results. The authors claim that their evaluation has shown that MadTracer works effectively against real-world malvertising activities. In particular, MadTracer has caught 15 times as many malicious domain-paths as Google Safe Browsing and Microsoft Forefront combined, as well as several large-scale malvertising campaigns, including a new type of click-fraud attack.  
[PERSON] et al. [2018] have presented a detailed investigation into the scope and negative impact of ad injections and their supporting ecosystem. They have designed a multi-staged pipeline to detect ad injections and the value chain behind them. The proposed model is a client-side DOM scanner utilized on a subset of Google's websites. This DOM scanner has the ability to detect and report rogue ad elements. Through the scanner's client-side telemetry technique, the authors have discovered that over 5% of unique daily IP addresses accessing the Google websites during the time frame of the research have been impacted by ad injections via several vectors. Moreover, the authors have identified 50,870 Chrome extensions and 34,407 Windows binaries that have acted as unwanted ad injectors of which 38% and 17%, respectively, have been outright malicious.  
To detect fake websites, [PERSON] et al. [2018] have introduced two categories of fake website detection tools: lookup systems and classifier systems. The lookup systems utilize a client-server architecture where the server-side keeps a blacklist of all known fake URLs, while the client-side tool examines the blacklist and alerts if a website poses a threat. In contrast, a classifier system is a client-side tool that applies a rule-based heuristic to a website's content or its DNS registration information. Classifier detection tools are independent of blacklists in detecting fake websites. They can provide better coverage than lookup systems for spoofed websites. Furthermore, in this work, the authors have proposed a support vector machine (SVM) classification model that utilizes a rich feature set to classify concocted and spoofed sites. Although the developed model appears to have outperformed the other comparable models, the findings of this work suggest that neither the proposed classifier nor the lookup system alone are an effective technique in combating various tactics employed by fraudsters. Instead, a hybrid system with regular/periodic updates of the classification model would be the most effective long-term solution.