Patent ID: 8639570

Claim:
A method performed on a computing device, the method for determining click fraud, the method comprising: accessing log data that represents search events and corresponding click events, where the log data is based on a plurality of user devices performing the search events and the corresponding click events, where each of the search events occurs when a corresponding one of the plurality of user devices performs a query via a search internet protocol (“IP”) address, and where each of the corresponding click events occurs when the corresponding one of the plurality of user devices selects, via a click IP address, an advertisement included in a search result provided in response to the performed query, where, for each of the search events, the log data comprises a corresponding search time that indicates a time that the corresponding search result was generated, the corresponding query, and a request globally unique identifier (“RGUID”) that uniquely identifies the corresponding performed query and that is assigned to the corresponding search result provided in response to the corresponding performed query, and where, for each of the click events, the log data further comprises a corresponding click time that indicates a time that the corresponding advertisement was selected; constructing a user linkage representation of the accessed log data based on a set time period that is based on a portion of the search times and the click times, where the set time period covers the portion of the search times and the click times, and where, for each of the search events and the corresponding click events within the set time period, the search IP address is linked to the click IP address in the user linkage representation; mining similar user clusters from the user linkage representation, where the mined similar user clusters share search and click patterns identified in the user linkage representation; and identifying, based on the shared search and click patterns, ones of the plurality of user devices associated with the similar user clusters as candidate devices for committing click fraud.