Abstract:
The present invention provides improved techniques for identifying online advertisement laundering and online advertisement injection that may occur during the serving of advertisements to browsers. For example, in one embodiment, a method of identifying fraudulent advertising activities may comprise obtaining information identifying a computer system of every party involved in supplying an advertisement to an end user device, determining whether a computer system of a first party and a computer system of a second party provide websites and are not intermediary computer systems, determining whether the computer system of the first party provides a website of a type undesirable to advertisers, determining whether the computer system of the second party has usage and traffic characteristics indicative of not being an intermediary computer system, and determining a frequency of recurrence of the determined conditions.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention relates to identifying online advertisement laundering and online advertisement injection that may occur during the serving of advertisements to browsers. 
         [0003]    2. Description of the Related Art 
         [0004]    Web pages contain many different content elements that may be displayed in the browser, such as advertisements. When an advertisement is delivered to the browser, there are usually one or more parties involved in the serving process. For example, frequently 3-4 parties or even 5-10 different parties may be involved in the serving of a single advertisement. This is typically referred to as the advertisement serving “daisy chain”. The advertisement is handed off from one advertisement party to the next in the serving process. The first party in the chain is the website that provides the web page, and the second party in the chain is typically an ad server operated by the website. Many times, the last party in the chain is the ad server or a measurement technology operated by the advertiser that owns the ad that will actually be delivered to the browser. Typically, there are also multiple ad servers in between that belong to various advertising intermediary organizations. There are thousands of different intermediary organizations and millions of different websites that can potentially be involved in a transaction. 
         [0005]    The multiple levels of intermediaries and websites in the ad serving process creates opaqueness and confusion which is many times exploited by fraudulent websites and fraudulent intermediaries to game the advertising system for financial profit. A need arises for a technique by which such online advertisement laundering and online advertisement injection can be identified so that these activities can be blocked and prevented. 
       SUMMARY OF THE INVENTION 
       [0006]    The present invention provides improved techniques for identifying online advertisement laundering and online advertisement injection that may occur during the serving of advertisements to browsers. 
         [0007]    For example, in one embodiment, a method of identifying online advertisement laundering may comprise obtaining information identifying a computer system of every party involved in supplying an advertisement to an end user device, determining whether a computer system of a first party and a computer system of a second party provide websites and are not intermediary computer systems, determining whether the computer system of the first party provides a website of a type undesirable to advertisers, determining whether the computer system of the second party has usage and traffic characteristics indicative of not being an intermediary computer system, and determining a frequency of recurrence of the determined conditions. 
         [0008]    The information identifying a computer system of every party involved in supplying an advertisement to an end user device may be obtained using a crawler that renders a web page including the advertisement, by extracting the information from the browser through a plugin or clickstream data, by extracting through html code embedded in the information or the web page being displayed, receiving it through web server or ad server log files, or provided by another party. Whether a computer system of a first party and a computer system of a second party provide websites and are not intermediary computer systems may be determined using a list of intermediaries. Whether the computer system of the first party provides a website of a type undesirable to advertisers may be determined using a list of websites. Whether the computer system of the second party has usage and traffic characteristics indicative of a content site and not of an intermediary is determined based on, for example, a sudden increase in traffic or based on a high level of traffic but low activity in social media. A relatively high frequency of recurrence of the determined conditions may indicate an increased likelihood that advertisement laundering is occurring. 
         [0009]    For example, in one embodiment, a method of identifying online advertisement injection may comprise obtaining information identifying a computer system of every party involved in supplying an advertisement to an end user device, determining whether a website provided by a computer system of a first party is known not to carry advertising, identifying intermediary computer systems among the computer systems of every party involved in supplying an advertisement to an end user device, and determining a frequency of occurrence of each intermediary computer system. 
         [0010]    The information identifying a computer system of every party involved in supplying an advertisement to an end user device may be obtained using a crawler that renders a web page including the advertisement, by extracting the information from the browser through a plugin or clickstream data, by extracting through html code embedded in the information or the web page being displayed, by using a crawler that renders the web page being displayed, or by using information provided by another party. Whether a website provided by a computer system of a first party is known not to carry advertising may be determined using a list of websites. When a frequency of occurrence of a particular intermediary computer system is above-average in frequency or when a frequency of occurrence of a particular intermediary computer system is less than a frequency of occurrence of other intermediary computer systems in scenarios that are known to not involve ad injection, there may be a greater likelihood that the intermediary is engaging in advertisement injection. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  is an exemplary block diagram of an embodiment of a system in which online advertising laundering may occur and in which online advertising laundering may be detected. 
           [0012]      FIG. 2  is an exemplary flow diagram of an embodiment of a process for identifying laundered advertisements. 
           [0013]      FIG. 3  is an exemplary block diagram of an embodiment of a system in which online advertising injection may occur and in which online advertising injection may be detected. 
           [0014]      FIG. 4  is an exemplary flow diagram of an embodiment of a process for identifying injected advertisements. 
           [0015]      FIG. 5  is an exemplary block diagram of an embodiment of a system for detecting fraudulent advertising activities. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0016]    The present invention provides improved techniques for identifying online advertisement laundering and online advertisement injection that may occur during the serving of advertisements to browsers. 
         [0017]    Ad laundering occurs when a website delivering advertisements is concealing its true identity when soliciting advertisements from advertisers and presents itself as a different website. This may occur directly, with the website directly misrepresenting itself, or this may occur through intermediaries. For example, the hypothetical website pirated-content.com knows they cannot get advertisements, so they partner with the hypothetical shady-intermediary-ad-server.com and call their tag. The shady advertisement server then calls a page on the hypothetical website seemingly-legitimate-front-site.com where advertisements are subsequently displayed as if the impression originated on that site. This is a case where the website is not laundering directly but instead is laundering by-proxy using other parties. This is usually done by websites with a good amount of real traffic but unsavory content that advertisers would reject in the advertising exchange environment. For example, websites with pirated content are generally not favored by advertisers. 
         [0018]    In the advertising marketplace environment, advertising space is purchased at an auction by machines on behalf of the advertiser, based on rules prescribed by the advertiser or its agent. During the auction process, the unsavory website hands off the advertisement impression to one or more different websites. The advertisement impression is ultimately handed to a “front site” that passes itself off as a legitimate website, but the advertisement impression may be passed through one or more intermediaries first. The advertiser believes that the ad is going to be delivered on the front site and purchases it based on that belief. In practice, the front site is typically setup only for the purpose of deception. The ad serving setup is implemented in such a way that the rogue website makes a call to the front site or to an intermediary site, which in turn makes a call to the ad serving chain to start delivering the ad. Monitoring services such as standard ad verification services used by the advertiser may also be fooled into thinking the ad was delivered on the front site, while in practice it is delivered on the rogue website through the front site because of the special ad serving implementation. 
         [0019]    Injected ads are ads “injected” into the page by a party other than the website or a party acting on its behalf. Sometimes, ads may be injected on top of or instead of the original ad delivered by the website, or sometimes ads may be injected in addition to ads delivered by the website or even injected on a website that doesn&#39;t contain any advertisements. Ad injection can be harmful to both the website and the advertiser as it can block the original ad from view or clutter up the page and reduce the value of the original advertiser ad. Examples of ways in which ad injection may be achieved include: 
         [0020]    a. Software, such as toolbars/plugins, adware, and or malware—some of the toolbars or browser extensions/plugins installed by the user inject ads onto web pages as a monetization technique. Likewise, adware or malware may be installed in the browser or elsewhere on the user&#39;s computer system, with or without the user&#39;s knowledge, and may inject ads onto web pages as a monetization technique. 
         [0021]    b. Internet service providers/proxies—some ISPs or proxies that users use to access the internet inject ads onto web pages as a monetization technique. 
         [0022]    An exemplary system in which online advertisement laundering may occur may be detected is shown in  FIG. 1 . The system of  FIG. 1  may include, but is not limited to, end user device  102 , which includes browser program  104 , which is displaying web page  106 , which includes advertisement  108 , and advertisement serving chains  110 A-E and  112 A-E. The end user device  102  may include devices such as personal computers, workstations, tablet computers, smartphones, etc., that implement one or more browsing platforms. Browser  104  is an example of any of one or more browsing platforms, such as standard browser software, such as INTERNET EXPLORER®, CHROME®, FIREFOX®, SAFARI®, etc., or apps that are capable of limited or unlimited browsing. Web page  106  may be a web document that is suitable for the World Wide Web and the web browser, and which is being displayed by browser  104 . Advertisement  108  may be an advertisement that is displayed within web page  106 , and which may be obtained from advertisement daisy chain  110 A-E or  112 A-E. 
         [0023]    Advertisement daisy chain  110 A-E is an example of a typical “legitimate” daisy chain. Advertisement daisy chain  110 A-E typically may include website  110 A, which typically may include a web server for serving the content, such as web page  106 , which is provided by website  110 A. Advertisement server  110 B typically may be an advertisement server operated by website  110 A in order to fetch advertisements to be displayed in web pages served by website  110 A. Advertiser  110 E is the ultimate source of an advertisement, such as advertisement  108 , and typically may include an advertisement server for serving the advertisements. Advertisement servers  1010 C and  1010 D typically may be an intermediate advertisement servers operated by various advertising intermediary organizations. 
         [0024]    Advertisement daisy chain  112 A-E is an example of a typical “laundered” daisy chain. Advertisement daisy chain  112 A-E typically may include website  112 A, which typically may include a web server for serving the content, such as web page  106 , which is provided by website  112 A. Front site  112 B typically may be a server operated by website  112 A in order to hide the true identity of website  112 A. Advertiser  112 E is the ultimate source of an advertisement, such as advertisement  108 , and typically may include an advertisement server for serving the advertisements. Advertisement servers  112 C and  112 D typically may be an intermediate advertisement servers operated by various advertising intermediary organizations. Advertiser  112 E believes that the advertisement is going to be delivered on the front site  112 B and purchases the advertisement based on that belief. In practice the owner of the website  112 A typically also owns the front site  112 B, which is set up only for the purpose of deception. The advertisement serving setup is implemented in such a way that the website  112 A makes a call to the front site  112 B, which in turn makes a call to the advertisement serving chain  112 C- 112 E to start delivering the ad. 
         [0025]    An example of a process  200  for identifying laundered advertisements is shown in  FIG. 2 . It is best viewed in conjunction with  FIG. 1 . Process  200  begins with step  202 , in which the complete advertisement serving chain, such as advertisement serving chain  112 A- 112 E, is obtained. The complete advertisement serving chain may be obtained in a number of ways. For example, a crawler that renders the page may be used. Likewise, the complete advertisement serving chain may be extracted from the browser through a plugin or clickstream data. Further, the complete advertisement serving chain may be extracted through html code embedded in the advertisement serving chain or the web page being displayed. 
         [0026]    In step  204 , the advertisement serving chain is analyzed. A number of analyses are performed, then the results of these analyses are compared to determine the likelihood that advertisement laundering is occurring. In step  206 , it is determined whether more than one party in the advertisement serving chain are websites. For example, as shown in  FIG. 2 , both the first and second parties in the ad serving chain are websites, such as is the case with website  112 A and front site  112 B. This is a distinction from a legitimate advertisement serving chain, in which only one party is a website. In this example, typically, the first party is a website  110 A and the second party is an ad server  110 B. The determination that more than one party in the advertisement serving chain are websites creates a high level of suspicion that advertisement laundering is occurring. Further, if both or more parties are not intermediaries, they can all be assumed to be websites. This may be determined using one or more directories with lists of sites and intermediaries. 
         [0027]    In step  208 , it is determined whether the first party is a website that is of a type that is unsavory to advertisers (such as a site with adult content or copyright infringement content). If the first party is such a website, that makes it more likely to be a case of advertisement laundering, as this provides a “motive” for such laundering. This may be determined using one or more directories with lists of websites. 
         [0028]    In step  210 , it is determined whether the second party website shows other irregular characteristics, which are associated with the second party website not being an intermediary computer system. If so, this increases the likelihood that advertisement laundering is occurring. Examples of irregular characteristics may include, but are not limited to, a sudden increase in traffic as reported by third party measurement services such as Alexa or comScore and a high level of traffic but low activity in social media. These irregular characteristics are not associated with legitimate user activity and imply that the system is not an intermediary computer system. This suggests that the site is a front site setup only as a decoy to conceal the identity of the original site. 
         [0029]    In step  210 , it is determined whether the determinations of steps  206 ,  208 , and  210  recur. When advertisement laundering, typically multiple recurring observations of the characteristics determined in steps  206 ,  208 , and  210  occur at a relatively high frequency within the overall number of advertisements that are measured that are delivered to the first party. For example, if the majority of the times that an advertisement is delivered to the first party, the advertisement includes the same or similar website as the second party, this indicates an increased likelihood that advertisement laundering is occurring. Observation of this recurring pattern increases the likelihood that advertisement laundering is occurring. 
         [0030]    An exemplary system in which online advertisement injection may occur and may be detected is shown in  FIG. 3 . The system of  FIG. 3  may include, but is not limited to, end user device  302 , which includes browser program  304 , which is displaying web page  306 , which includes advertisement  308 , and advertisement daisy chains  310 A-E and  312 A-E. The end user device  302  may include devices such as personal computers, workstations, tablet computers, smartphones, etc., that implement one or more browsing platforms. Browser  304  is an example of any of one or more browsing platforms, such as standard browser software, such as INTERNET EXPLORER®, CHROME®, FIREFOX®, SAFARI®, etc., or apps that are capable of limited or unlimited browsing. Web page  306  may be a web document that is suitable for the World Wide Web and the web browser, and which is being displayed by browser  304 . Advertisement  308  may be an advertisement that is displayed within web page  306 , and which may be obtained from advertisement daisy chain  310 A-D, which is typically a “legitimate” daisy chain. 
         [0031]    Also shown in  FIG. 3  are injecting toolbar  320 , injecting software  321 , and ISP  322 . Injecting toolbar  320  may be an actual toolbar, or it may be a browser extension or plugin that inject advertisements onto web pages as a monetization technique. Likewise, injecting software  321  may be adware or malware installed in the browser or elsewhere on the user&#39;s computer system, with or without the user&#39;s knowledge, and may inject ads onto web pages as a monetization technique. Injecting toolbar  320  and/or injecting software  321  may obtain advertisements to be injected directly from advertiser servers, such as advertiser  324 , or injecting toolbar  320  and/or injecting software  321  may obtain advertisements to be injected from an advertisement server in a legitimate, or other, advertisement serving chain, such as advertisement server  310 B. Likewise, ISP  322 , which may be an Internet Service Provider, or a proxy, that users use to access the Internet may inject advertisements onto web pages as a monetization technique. ISP  322  may obtain advertisements to be injected directly from advertiser servers, such as advertiser  324 , or ISP  322  may obtain advertisements to be injected from an advertisement server in a legitimate, or other, advertisement daisy chain, such as advertisement server  310 B. 
         [0032]    An example of a process  400  for identifying injected advertisements is shown in  FIG. 4 . It is best viewed in conjunction with  FIG. 3 . Process  400  begins with step  402 , in which the complete advertisement serving chain, such as advertisement serving chain  310 A-D, is obtained. The complete advertisement serving chain may be obtained in a number of ways. For example, a crawler that renders the page may be used. Likewise, the complete advertisement serving chain may be extracted from the browser through a plugin or clickstream data. Further, the complete advertisement serving chain may be extracted through html code embedded in the advertisement serving chain or the web page being displayed, or by using information provided by another party. 
         [0033]    In step  404 , the first party in the advertisement serving chain, the website  310 A is identified and it is determined whether this is a website that does not carry any advertising. This may be determined using one or more directories with lists of sites that don&#39;t carry advertisements. If the first party in the advertisement serving chain is a site known to not carry any advertisements (such as Wikipedia, Craigslist, etc.), then there is a high likelihood that this is an advertisement injection is occurring. There are various existing directories listing sites that don&#39;t carry advertisements. In step  406 , all the intermediaries in the advertisement serving chain are identified and the occurrence of each individual intermediary is recorded. In step  408 , the frequency of occurrence of each intermediary is determined. If a particular intermediary shows up with above-average frequency, there is a greater likelihood that the intermediary is engaging in advertisement injection. Furthermore, if this intermediary shows up less frequently than others in scenarios that are known to not involve ad injection, there is a greater likelihood that the intermediary is engaging in advertisement injection. Once the intermediary has been identified in this way, the intermediary may then be identified as an injector across any site where advertisements are injected by detecting the domain used by the injector, then using that domain to detect advertisement injection in real-time across all users. 
         [0034]    An exemplary block diagram of a computer system  500 , in which the processes shown above may be implemented, is shown in  FIG. 5 . Computer system  500  is typically a programmed general-purpose computer system, such as a personal computer, workstation, server system, and minicomputer or mainframe computer. Computer system  500  includes one or more processors (CPUs)  502 A- 502 N, input/output circuitry  504 , network adapter  506 , and memory  508 . CPUs  502 A- 502 N execute program instructions in order to carry out the functions of the present invention. Typically, CPUs  502 A- 502 N are one or more microprocessors, such as an INTEL PENTIUM® processor.  FIG. 5  illustrates an embodiment in which computer system  500  is implemented as a single multi-processor computer system, in which multiple processors  502 A- 502 N share system resources, such as memory  508 , input/output circuitry  504 , and network adapter  506 . However, the present invention also contemplates embodiments in which computer system  500  is implemented as a plurality of networked computer systems, which may be single-processor computer systems, multi-processor computer systems, or a mix thereof. 
         [0035]    Input/output circuitry  504  provides the capability to input data to, or output data from, computer system  500 . For example, input/output circuitry may include input devices, such as keyboards, mice, touchpads, trackballs, scanners, etc., output devices, such as video adapters, monitors, printers, etc., and input/output devices, such as, modems, etc. Network adapter  506  interfaces device  500  with a network  510 . Network  510  may be any public or proprietary LAN or WAN, including, but not limited to the Internet. 
         [0036]    Memory  508  stores program instructions that are executed by, and data that are used and processed by, CPU  502  to perform the functions of computer system  500 . Memory  508  may include, for example, electronic memory devices, such as random-access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc., and electro-mechanical memory, such as magnetic disk drives, tape drives, optical disk drives, etc., which may use an integrated drive electronics (IDE) interface, or a variation or enhancement thereof, such as enhanced IDE (EIDE) or ultra-direct memory access (UDMA), or a small computer system interface (SCSI) based interface, or a variation or enhancement thereof, such as fast-SCSI, wide-SCSI, fast and wide-SCSI, etc., or Serial Advanced Technology Attachment (SATA), or a variation or enhancement thereof, or a fiber channel-arbitrated loop (FC-AL) interface. 
         [0037]    The contents of memory  508  varies depending upon the function that computer system  500  is programmed to perform. In the example shown in  FIG. 5 , memory contents that may be included in a system in which online advertisement injection and/or online advertisement laundering detection is implemented are shown. However, one of skill in the art would recognize that these functions, along with the memory contents related to those functions, may be included on one system, or may be distributed among a plurality of systems, based on well-known engineering considerations. The present invention contemplates any and all such arrangements. 
         [0038]    In the example shown in  FIG. 5 , memory  508  may include advertisement serving chain routines  512 , advertisement laundering detection routines  514 , advertisement injection detection routines  516 , and operating system  518 . Advertisement serving chain routines  512  may include routines for obtaining and analyzing advertisement serving chains, including complete advertisement serving chains. Advertisement laundering detection routines  514  may detect advertisement laundering. Advertisement injection detection routines  516  may detect advertisement injection. Operating system  526  provides overall system functionality. 
         [0039]    As shown in  FIG. 5 , the present invention contemplates implementation on a system or systems that provide multi-processor, multi-tasking, multi-process, and/or multi-thread computing, as well as implementation on systems that provide only single processor, single thread computing. Multi-processor computing involves performing computing using more than one processor. Multi-tasking computing involves performing computing using more than one operating system task. A task is an operating system concept that refers to the combination of a program being executed and bookkeeping information used by the operating system. Whenever a program is executed, the operating system creates a new task for it. The task is like an envelope for the program in that it identifies the program with a task number and attaches other bookkeeping information to it. Many operating systems, including Linux, UNIX-, OS/2®, and Windows®, are capable of running many tasks at the same time and are called multitasking operating systems. Multi-tasking is the ability of an operating system to execute more than one executable at the same time. Each executable is running in its own address space, meaning that the executables have no way to share any of their memory. This has advantages, because it is impossible for any program to damage the execution of any of the other programs running on the system. However, the programs have no way to exchange any information except through the operating system (or by reading files stored on the file system). Multi-process computing is similar to multi-tasking computing, as the terms task and process are often used interchangeably, although some operating systems make a distinction between the two. 
         [0040]    It is important to note that while aspects of the present invention may be implemented in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer program product including a computer readable medium of instructions. Examples of non-transitory computer readable media include storage media, examples of which include, but are not limited to, floppy disks, hard disk drives, CD-ROMs, DVD-ROMs. RAM, and, flash memory. 
         [0041]    Although specific embodiments of the present invention have been described, it will be understood by those of skill in the art that there are other embodiments that are equivalent to the described embodiments. Accordingly, it is to be understood that the invention is not to be limited by the specific illustrated embodiments, but only by the scope of the appended claims.