Among Click Spam just 10% of conversions were marked as Classic Click Spam and 90% conversions were marked as Modified Click Spam. Both Click-Spam fraud types are inherently organic, so all financial indicators, post-install events, other attributes of the device and install are absolutely real. A “long tail” with the TTI of 2,3,4 days was clearly pointing at click-spammers. And they have modified their tactics to “cut off” the long tail, leaving visible one day installs only. Thus, Modified Click Spam becomes more difficult to identify.
As shown above, the biggest part of fraudulent installs (82%) fall into the fraudulent post-install category. A deeper analysis of this category has indicated 63% of conversions as Classic bots (without post-events) and 37% of conversions as Smart bots blended together. The latter kind of fraud is called “smart” because of its ability to fully emulate the user behavior by performing all post-install activities for a long period. From a human perspective, smart bots look almost alike real users by having the personal IP, device ID, etc. Scalarr detects the smart bot fraud and blends or ‘mixes’ of different types of fraud in a number of ways, but its workhorse method uses unsupervised machine-learning (UML), which basically looks for the clusters of abnormalities, and Semi-Supervised models trained on past examples of confirmed good and fraudulent behavior. Because data is extremely unbalanced and highly dimensional, Scalarr uses both approaches to be able to validate and compare the outputs. Thus, the models’ performance is measured at the rate of uncovering fraudulent versus good installs at various data points thresholds looking for strong deviations in the first model. And for the latter, these data points are encoded in its features as a kind of weighted logical disjunction between true-positive and false-negative rates. That gives a lot of opportunities from dramatically increased accuracy in identifying the exact fraudulent patterns to the ability of detecting a totally new unknown and entirely modified ones.