Mobile click fraud prevention

Abstract

A system is disclosed for detecting and handling click fraud in a mobile environment. The system may identify a source of a request. The request may be handled differently based on whether the source of the request originated from mobile traffic or web traffic. The source of the request may be used to determine whether a request is valid or invalid. The request may be flagged if the request is invalid.

1 . A system comprising:
 a communication circuit operative to receive from a source over a network a request for information, the request including source identification information identifying the source;   a source identification circuit in data communication with the communication circuit and operative to identify the source as being a mobile network based on the source identification information;   a mobile traffic handling circuit in data communication with the source identification circuit and operative to handle the request for information as mobile traffic when the source is identified by the source identification circuit as being a mobile network; and   a web traffic handling circuit in data communication with the source identification circuit and operative to handle the request as web traffic when the source is not identified as being a mobile network.   
     
     
         2 . The system of  claim 1  further comprising:
 a click fraud detection handling circuit in data communication with the mobile traffic handling circuit or the web traffic handling circuit or both, the click fraud detection handling circuit operative to receive information about a click received by the communication circuit and determine validity of the received click. 
 
     
     
         3 . The system of  claim 2  wherein the click fraud detection circuit comprises one or more filters operative to filter the received click and determine the validity of the received click based on established criteria. 
     
     
         4 . The system of  claim 3  wherein each respective filter of the one or more filters is operative to produce a respective filter score indicative of likelihood of validity of the received click based on a respective filtered characteristic, and further comprising click score logic operative to calculate a click score based on the respective filter scores, the click score indicative of a conclusion of validity or invalidity of the received click. 
     
     
         5 . The system of  claim 4  wherein the click score logic is operative to apply respective filter weights to the respective filter scores to produce weighted filter scores and to aggregate the weighted filter scores to produce the click score. 
     
     
         6 . The system of  claim 2  wherein the click fraud detection circuit comprises automated script filtering logic operative to produce an indication of invalidity when the received click originates from a known automated script. 
     
     
         7 . The system of  claim 2  wherein the click fraud detection circuit comprises IP address filtering logic operative to produce an indication of invalidity when the received click originates from a network address, identified network or identified carrier associated with the received click that suggests the received click is invalid. 
     
     
         8 . The system of  claim 7  wherein the IP address filtering logic is operative to determine identity of the network address, the identified network or the identified carrier associated with the received click and compare the determined identity with a set of blacklisted identifiers designated as sources of invalid clicks. 
     
     
         9 . The system of  claim 7  wherein the IP address filtering logic is operative to produce a numerical score indicative of confidence with which the received click can be deemed valid or invalid. 
     
     
         10 . The system of  claim 2  wherein the click fraud detection circuit comprises geographic filtering logic operative to determine a geographic origin of the received click and to produce an indication of invalidity of the received click based on the determined geographic origin. 
     
     
         11 . The system of  claim 10  wherein the geographic filtering logic is operative to access stored statistical data associated with the determined geographic location indicative of the likelihood of validity or invalidity of the received click to produce the indication of invalidity. 
     
     
         12 . A method comprising:
 at a computer system of an internet service provider,
 receiving over a network data defining a request for information; 
 determining, in the data defining the request, request source information about a source of the request; 
 using the information about the source of the request, identifying the request as mobile traffic or web traffic; 
 handling a request identified as mobile traffic by
 determining a network address in the request source information; 
 comparing the network address with valid network addresses; 
 in the case of a match between the network address and a valid network address, providing data defining result information responsive to the request over the network to the source of the request; and 
 in the absence of a match between the network address and a valid network address, flagging the request as fraudulent. 
 
   
     
     
         13 . The method of  claim 12  wherein receiving the data defining a request comprises receiving data defining a keyword search request or receiving data defining a click request. 
     
     
         14 . The method of  claim 12  further comprising:
 determining whether the a network address in the request source information is forged or fraudulent. 
 
     
     
         15 . The method of  claim 14  wherein determining whether the a network address in the request source information is forged or fraudulent comprises:
 correlating information within or accompanying the request with other verified information of the computer system of an internet service provider. 
 
     
     
         16 . The method of  claim 15  wherein correlating information comprises:
 determining in the data defining the request one or more hidden variables identifying a source mobile network from which the request originated; 
 correlating the one or more hidden variables with stored mobile network data of the computer system of the internet service provider. 
 
     
     
         17 . The method of  claim 15  wherein correlating information comprises:
 determining in the data defining the request one or more sequence numbers established between the internet service provider and a source mobile network from which the request originated; 
 correlating the one or more sequence numbers with stored mobile network data of the computer system of the internet service provider. 
 
     
     
         18 . The method of  claim 12  further comprising:
 based on the network address in the request source information, identifying a mobile network from which the data defining the request originated; 
 identifying associated content for the identified mobile network; 
 providing data defining the associated content with the data defining result information responsive to the request over the network to the source of the request. 
 
     
     
         19 . A method for click fraud detection in an internet server system, the method comprising:
 at a computer system,   receiving network traffic over a network from an origin device;   obtaining user click data associated with the network traffic;   filtering the user click data in filter logic of the computer system to produce a plurality of filter scores indicative of confidence in the validity or invalidity of the network traffic;   combining the plurality of filter scores to produce a click score indicative of validity or invalidity of the network traffic; and   if the click score indicates invalidity of the network traffic, processing the network traffic as invalid network traffic.   
     
     
         20 . The method of  claim 19  further comprising:
 determining a source of the network traffic from network information included in the network traffic; 
 determining a source of the network traffic as a web source or a mobile source; 
 if the source of the network traffic is a mobile source, identifying a mobile network associated with the mobile source using information included in the network traffic; 
 identifying a mobile device within the mobile network as the mobile source; and 
 based on the identification of the mobile device; processing the network traffic as invalid network traffic.