Search

In recent years, the security threats from Internet are spreading at a fast rate. These threats are coming from different fraudulent email, websites and malicious software which are working independently. All these threats are of different categories (virus, malware, trojan etc). Every threat has a different techniques of spreading the malicious code and we also need different categories for detecting all these threats. At the focal point of a considerable lot of these assaults are accumulations of traded off PCs, or on the other hand Botnets, remotely constrained by the aggressors, and whose individuals are situated in homes, schools, businesses and government around the globe. Botnets have been a serious threat in present day and attacking lot of organization and performing cyber-crimes. Botnet have been working on the method of carry and spread. In this way it transfers malicious codes or software to different computers. Spam, denial of service attack and click fraud are some of the methods through which Botnet are attacking the system. Detection of Botnet is a typical task which can be carried out in an efficient way by using Machine Learning. This paper’s focus is on different Machine Learning algorithm and their analysis method for detection of Botnet. Different Machine Learning algorithm are implemented and their ability to detect botnet has been found out. All the algorithms are implemented on an existing dataset and therefore the results shows the ability of algorithm in detecting botnet.

Although the use of pay-per-click mechanisms stimulates the prosperity of the mobile advertisement network, fraudulent ad clicks result in huge financial losses for advertisers. Extensive studies identify click fraud according to click/traffic patterns based on dynamic analysis. However, in this study, we identify a novel click fraud, named humanoid attack, which can circumvent existing detection schemes by generating fraudulent clicks with similar patterns to normal clicks. We implement the first tool ClickScanner to detect humanoid attacks on Android apps based on static analysis and variational AutoEncoder (VAE) with limited knowledge of fraudulent examples. We define novel features to characterize the patterns of humanoid attacks in the apps' bytecode level. ClickScanner builds a data dependency graph (DDG) based on static analysis to extract these key features and form a feature vector. We then propose a classification model only trained on benign datasets to overcome the limited knowledge of humanoid attacks. We leverage ClickScanner to conduct the first large-scale measurement on app markets (i.e.,120,000 apps from Google Play and Huawei AppGallery) and reveal several unprecedented phenomena. First, even for the top-rated 20,000 apps, ClickScanner still identifies 157 apps as fraudulent, which shows the prevalence of humanoid attacks. Second, it is observed that the ad SDK-based attack (i.e., the fraudulent codes are in the third-party ad SDKs) is now a dominant attack approach. Third, the manner of attack is notably different across apps of various categories and popularities. Finally, we notice there are several existing variants of the humanoid attack. Additionally, our measurements demonstrate the proposed ClickScanner is accurate and time-efficient (i.e., the detection overhead is only 15.35% of those of existing schemes)., Comment: Accepted to ACM CCS 2021

A number of apps are available in app stores for different types of online services and are growing with the use of mobile devices in the public. Advertisements on mobile through apps become a popular trend in online businesses. Ad frauds is a major concern for the advertising industry, and the most affected ones are the advertisers. The advertiser pays revenue to the ad network for each click on his ad. If ghost clicks are not captured as fraud or invalid clicks, then the advertiser has to pay to the ad network for ghost clicks also. Hence, return on investment (ROI) of the advertiser becomes very low and not achieving the goal as expected. Detecting fraud clicks on ads is very important to achieve the expected goal of the advertiser. The proposed methodology follows a heuristic approach to detect mobile ad-click frauds. A click fraud detection algorithm has been developed and implemented on the cloud server. The algorithm is triggered for each entry of the ad click to detect the click belongs to fraud or not fraud. The obtained results have been verified by popular machine learning (ML) algorithms namely as support vector machine (SVM), random forest, and k-nearest neighbors (k-NN) with the accuracies of 91%, 84% and 85%, respectively.

Most Internet users are used to paying attention to a few websites with the top ranking of search engines. According to statistics, 95% of users are only interested in the search results of the first five pages, and a large number of websites with the lower ranking are selectively ignored by users. The purpose of this paper is to make use of the discrimination results of multiple classifiers, and build an effective combination classifier for spam web page recognition from several aspects such as feature selection, feature segmentation and classifier difference measurement. The new two-view features are combined in different ways to generate single-view data, and this set of data is used as training data to construct classification algorithm. Experimental results show that the proposed method can effectively identify illegal publishers who commit fraudulent clicks, and meet the requirements of click fraud detection in online advertising.

The growth of the online advertising industry has created new business opportunities on the Internet. Companies and advertisers are turning to digital ad platforms like never before to compete for the attention of their audience. In this environment, actions such as clicking an ad result in financial transactions among advertisers, advertising networks and publishers. Since these new opportunities have financial impact, fraudsters have been trying to gain illegal advantages and profit through them. Mitigating the negative effects of illegal traffic is extremely important to the success of any marketing endeavor. Today, false clicks that waste budgets and don’t generate any meaningful value or revenue are costing advertisers billions of dollars. These are the biggest challenge PPC (Pay Per Click) marketers face, although there are efforts made by the advertisers to block fake traffic, they still try to find leading security strategy to identify click fraud. This paper analyzes the click fraud mechanism, focusing on its detection and methods of solution used in recent cases, we try and explain various fundamentals related to online advertising. The objective of this research is to propose solution for click ad fraud present in online advertising using the XGBoost Gradient Boosting algorithm and this model provides the accuracy of 96% with a set of hyperparameters along with features that can be implemented on datasets related to click frauds.

Publicizing extortion, especially click misrepresentation, is a developing worry for the Web-based promoting industries. The utilization of snapbots, malware that naturally taps on advertisements to create fake traffic, has relentlessly expanded in the course of the most recent years. While the security business has concentrated on distinguishing and evacuating noxious doubles related with click bots, a superior comprehension of how fraudsters work inside the promotion biological system is should have been ready to disturb it productively. The demonstration of tapping on an advertisement, not due to enthusiasm for this advertisement, but instead as an approach to produce unlawful incomes for the application distributor.

In the environment of electronic commerce, enterprises can accurately identify the target consumer groups and use the advertising platform to deliver targeted advertisements. The advertising platform makes false clicks to obtain higher returns. False click will bring negative effects to consumers and enterprises using the platform to advertise, reduce consumer trust and purchase intention, and affect the advertising decision of enterprises. This paper uses two-stage game to analyze the advertising strategy of enterprises and platforms and the pricing strategy of enterprises. It is found that the platform will not carry out unlimited click fraud, and the consumption conversion rate of advertising and the conversion rate of consumer loss caused by click fraud will have a nonlinear effect on the range of advertising delivery.

Among the different types of malware, botnets are rising as the most genuine risk against cybersecurity as they give a stage to criminal operations (e.g., Distributed Denial of Service (DDOS) attacks, malware dispersal, phishing, and click fraud and identity theft). Existing botnet detection techniques work only on specific botnet Command and Control (C&C) protocols and lack in providing early-stage botnet detection. In this paper, we propose an approach for early-stage botnet detection. The proposed approach first selects the optimal features using feature selection techniques. Next, it feeds these features to machine learning classifiers to evaluate the performance of the botnet detection. Experiments reveals that the proposed approach efficiently classifies normal and malicious traffic at an early stage. The proposed approach achieves the accuracy of 99%, True Positive Rate (TPR) of 0.99 %, and False Positive Rate (FPR) of 0.007 % and provide an efficient detection rate in comparison with the existing approach.

Advertising income depends on the amount of clicks by users of websites and mobile applications. However, the emergence of click fraud greatly reduces the real benefits of the advertisement. Most existing researches focus on detecting click fraud by analyzing properties and patterns of click data streams, but attackers can construct data that looks legitimate by replaying former data streams. In this paper, we propose a novel system called ClickGuard to detect click fraud attacks. ClickGuard takes advantage of motion sensor signals from mobile devices, since the pattern of motion signals is completely different under real click events and fraud events. To prevent attackers from bypassing the system by faking the time-domain statistical characteristics of original signals, we introduce the MFCC algorithm in feature extraction phase. MFCC algorithm can extract frequency-domain features of original signals in specific frequency bands which are hardly constructed out of thin air. Classifiers are finally constructed using these features and several machine learning algorithms. Experiments show that ClickGuard can achieve the accuracy of 96.71% in general environment and 84.16% when attackers modify the time-domain statistical characteristics of raw data.

The proliferation of sophisticated e-commerce platforms coupled with mobile applications has ignited growth in business-to-consumer (B2C) commerce, reshaped organizational structures, and revamped value creation processes. Simultaneously, new technologies have altered the dynamics of brand marketing, enabling a broader reach and more personalized targeting aimed at increasing brand trust and enhancing customer loyalty. Today, the Internet allows marketers to penetrate deeper into their existing markets, create new online marketplaces and to generate new demand. This dynamic market engagement uses new technologies to target consumers more effectively. In this conceptual paper, we discuss how blockchain technology can potentially impact a firm's marketing activities. More specifically, we illustrate how blockchain technology acts as incremental innovation, empowering the consumer-centric paradigm. Moreover, blockchain technology fosters disintermediation, aids in combatting click fraud, reinforces trust and transparency, enables enhanced privacy protection, empowers security, and enables creative loyalty programs. We present six propositions that will guide future blockchain-related research in the area of marketing.

The use of bot malware and botnets as a tool to facilitate other malicious cyber activities (e.g. distributed denial of service attacks, dissemination of malware and spam, and click fraud). However, detection of botnets, particularly peer-to-peer (P2P) botnets, is challenging. Hence, in this paper we propose a sophisticated traffic reduction mechanism, integrated with a reinforcement learning technique. We then evaluate the proposed approach using real-world network traffic, and achieve a detection rate of 98.3%. The approach also achieves a relatively low false positive rate (i.e. 0.012%).

In affiliate marketing, an affiliate offers to handle the marketing effort selling products of other companies. Click-fraud is damaging to affiliate marketers as they increase the cost of internet traffic. There is a need for a solution that has an economic incentive to protect marketers while providing them with data they need to reason about the traffic quality. In our solution, we propose a set of interpretable flags explainable ones to describe the traffic. Given the different needs of marketers, differences in traffic quality across campaigns and the noisy nature of internet traffic, we propose the use of equality testing of two proportions to highlight flags which are important in certain situations. We present measurements of real-world traffic using these flags.

Around 30% revenue has been wasted due to different types of advertising fraud. In view of the continuous emergence of fraud and the improvement of fraudulent means, a click fraud detection of cost-sensitive convolutional neural network (CSCNN) based on feature matrix is proposed. In order to capture the pattern of click fraud, priori probability is introduced and a new feature set is derived from the knowledge of entropy. Then, using cost-based sampling method and threshold-moving cost sensitive learning algorithm to solve unbalanced data training problems. Features are transformed into feature matrix by different time windows to fit the input of a convolutional neural network. Finally, considering the convolution kernel size, the number of convolution kernels and the pooling size of different network structures in this work, effective CSCNN structure was chosen. Experiments on real-word data show that this method can complete click fraud detection effectively, and can complete multi classification without increasing the complexity of the model. A new effective method was provided on click fraud detection in mobile advertisement.

Nowadays malwares such as Botnets, Rootkit, and Trojan are the most serious threats for computers. Here we focus on botnet detection. A botnet is a network of malwares connected to a bot master. Botnets can do actions, including data theft, DDoS attacks, click fraud, and bitcoin mining.

Online advertising has become the backbone of the Internet economy by revolutionizing business marketing. It provides a simple and efficient way for advertisers to display their advertisements to specific individual users, and over the last couple of years has contributed to an explosion in the income stream for several web-based businesses. For example, Google's income from advertising grew 51.6% between 2016 and 2018, to $136.8 billion. This exponential growth in advertising revenue has motivated fraudsters to exploit the weaknesses of the online advertising model to make money, and researchers to discover new security vulnerabilities in the model, to propose countermeasures and to forecast future trends in research. Motivated by these considerations, this paper presents a comprehensive review of the security threats to online advertising systems. We begin by introducing the motivation for online advertising system, explain how it differs from traditional advertising networks, introduce terminology, and define the current online advertising architecture. We then devise a comprehensive taxonomy of attacks on online advertising to raise awareness among researchers about the vulnerabilities of online advertising ecosystem. We discuss the limitations and effectiveness of the countermeasures that have been developed to secure entities in the advertising ecosystem against these attacks. To complete our work, we identify some open issues and outline some possible directions for future research towards improving security methods for online advertising systems., Comment: 31 pages, 13 figures, 4 tables, IEEE Communications Surveys & Tutorials

Social media has become a targeted place for hackers and intruders. The problem is that the detection mechanism which we use is not capable of detecting all the click frauds and has not raised the bar to commit click fraud but is very much effective in the long run. Today’s web browsers support a rich variety of web standards in which a click-bot must be implemented to evade the detection mechanism. A click-bot of heavy size will risk itself of being easily detected by the host. This paper will show a brief review of how this system of detecting fraud-ad works and how we can prevent it from happening with us. This paper reviews what different existing techniques can be used in a more effective way and how they function in a given situation and the ways by which we can keep our data safe from these fraudsters.

Mobile PR is an important component of the mobile app ecosystem. A major threat to this ecosystem’s long-term health is click fraud, which involves clicking on ads while infected with malware or using an automated bot to do it for you. The methods used to identify click fraud now focus on looking at server requests. Although these methods have the potential to produce huge numbers of false negatives, they may easily be avoided if clicks are hidden behind proxies or distributed globally. AdSherlock is a customer-side (inside the app) efficient and deployable click fraud detection system for mobile applications that we provide in this work. AdSherlock separates the computationally expensive click request identification procedures into an offline and online approach. AdSherlock uses URL (Uniform Resource Locator) tokenization in the Offline phase to create accurate and probabilistic patterns. These models are used to identify click requests online, and an ad request tree model is used to detect click fraud after that. In order to develop and evaluate the AdSherlock prototype, we utilise actual applications. It injects the online detector directly into an executable software package using binary instrumentation technology (BIT). The findings show that AdSherlock outperforms current state-of-the-art methods for detecting click fraud with little false positives. Advertisement requests identification, mobile advertising fraud detection are some of the keywords used in this article.

In the present scenario online web advertising is premier source of revenue for many internet web applications. Phishing is an activity of misleading web users to fraudulent web sites which can be used to steal the sensitive information from internet. In this article, we introduce a new architecture for web fraud detection using Apriori algorithm for association rule mining and phish tank database in web advertising network. Extensive experiments are done on the proposed architecture with web access log and results obtained by proposed architecture in terms of accuracy, error rate, memory used and search time are encouraging.

Click fraud refers to the practice of generating random clicks on a link in order to extract illegitimate revenue from the advertisers. We present a generalized model for modeling temporal click fraud data in the form of probability or learning based anomaly detection and time series modeling with time scales like minutes and hours. The proposed approach consists of seven stages: Pre-processing, data smoothing, fraudulent pattern identification, homogenizing variance, normalizing auto-correlation, developing the AR and MA models and fine tuning along with evaluation of the models. The objective of the proposed work is to first, model multi-time-scale time series data on AR/MA by relying only on time and the label without the need of too many attributes and secondly, to model different time scales separately on Auto-regression (AR) and Moving Average (MA) models. Then, we evaluate the models by tuning forecasting errors and also by minimizing Akaike Information Criteria (AIC) and Bayesian Information Criteria (BIC) to obtain a best fit model for all time scale data. Through our experiments we also demonstrated that the Probability based model approach is better as compared to the Learning based probabilistic estimator model.

Ad Tech is a growing business, that has already taken over the traditional way of showing ads. It has made the ad-industry better with better reach to audience where the impact of the ads can be measured and acted upon to optimize the performance of the ads. But exposure to internet comes with its own pros and cons. Out of the three ways of paying out money, RPC payout method leads to click-fraud (spam-clicks or clicks with less intent), to increase the count of clicks (eg. Bot clicks) of generate more revenue, eventually affecting the quality of traffic. The paper discusses various ways being used to detect how ad-serving works, ways of detecting spam clicks and monitoring activity of users, and a proposed method. In this proposed method, visitors on the website and their identification details are analysed and each parameter is assigned a weight according to significance. Then each click is assigned a rank which is compared to a threshold value to determine whether the click is suspicious or not. The future scope of this method along with optimisation techniques is also discussed in this paper.

The botnet attack method comprises a network of devices infected by malwares. After the infection, they start to be controlled by a botmaster to perform malicious operations. Because the high traffic of packets, it is challenging for network administrators to monitor the logs to detect those attacks. Therefore, this work proposes a semi-supervised machine learning model intending to identify anomalies on network traffic to detect potential attacks in an automated way. The proposed technique is named RPCA-MD, which applies Robust Principal Component Analysis (RPCA) and Mahalanobis Distance.

With the rapid development of e-commerce services and online transactions, an increasing number of advanced web robots are utilized by speculators and hackers in underground economy to perform click fraud, register fake accounts and commit other kinds of frauds, seriously harming the profit of businesses and the fairness of online activities. There is solid evidence that the vast majority of such malicious bot traffic comes from data centers. The malicious bot deployed on the hosts of data centers is referred to as a CloudBot. How to detect and block CloudBots effectively has become an urgent problem in practice, while the research on it can be seldom seen in public. To this end, we propose a traffic-based quasi-real-time method for CloudBot detection using machine learning, which exploits a new sample partitioning approach, as well as innovative multi-layer features that reveal the essential difference between CloudBots and human traffic. Our method achieves 93.4% precision in the experiment and performs well on the real-world dataset, which proves to be effective to detect unknown CloudBots and combat the concept drift caused by varying time. Besides, the approach is also privacy-preserving without using any specific application layer information. We believe our work can benefit network economy security and fairness in practice.

Online advertising is one of the primary funding sources for various of content, services, and applications on both web and mobile platforms. Mobile in-app advertising reuses many existing web technologies under the same ad-serving model (i.e., users - publishers - ad networks - advertisers). Nevertheless, mobile in-app advertising is different from the traditional web advertising in many aspects. For example, malicious app developers can generate fraudulent ad clicks in an automated fashion, but malicious web publishers have to launch click fraud with bots. In spite of using the same underlying web infrastructure, advertising threats behave differently on the two platforms. Existing works have studied separately click fraud and malvertising in the mobile setting. However, it is unknown if there exists a relationship between these two dominant threats. In this paper, we present an ad collection framework – MAdLife – on Android to capture all the in-app ad traffic generated during an ad's entire lifespan. MAdLife allows us to revisit both threats in a fine-grained manner and study the relationship between them. It further enables the exploration of other threats related to ad landing pages. We analyzed 5.7K Android apps crawled from the Google Play Store, and collected 83K ads and their landing pages using MAdLife. Similar to traditional web ads, 58K ads landed on web pages. We discovered 37 click-fraud apps, and found that 1.49% of the 58K ads were malicious. We also revealed a strong correlation between fraudulent apps and malicious ads. Specifically, 15.44% of malicious ads originated from the fraudulent apps. Conversely, 18.36% of the ads served in the fraudulent apps were malicious, while only 1.28% were malicious in the rest apps. This suggests that users of fraudulent apps are much more (14x) likely to encounter malicious ads. Additionally, we discovered that 243 popular JavaScript snippets embedded by over 10% of the landing pages were malicious. Finally, we conducted the first analysis on inappropriate mobile in-app ads.

Click fraud is a fast-growing cyber-criminal activity with the aim of deceptively clicking on the advertisements to make the profit to the publisher or cause loss to the advertiser. Due to the popularity of smartphones since the last decade, most of the modern-day advertisement businesses have been shifting their focus toward mobile platforms. Nowadays, in-app advertisement on mobile platforms is the most targeted victim of click fraud. Malicious entities launch attacks by clicking ads to artificially increase the click rates of specific ads without the intention of using them for legitimate purposes. The fraud clicks are supposed to be caught by the ad providers as part of their service to the advertisers; however, there is a lack of research in the current literature for addressing and evaluating different techniques of click fraud detection and prevention. Another challenge toward click fraud detection is that the attack model can itself be an active learning system (smart attacker) with the aim of actively misleading the training process of fraud detection model via polluting the training data. In this paper, we propose a deep-learning based model to address the challenges as mentioned above. The model is a hybrid of artificial neural network (ANN), autoencoder and semi-supervised generative adversarial network (GAN). Our proposed approach triumphs excellent accuracy than other models.

An advertisement (ad) click fraud occurs when a user or a bot clicks on an ad with a malicious intent where advertisers need to pay for those fake clicks. Click-fraud is a serious problem for the online advertising industry. Our study demonstrates a hybrid approach using a two-level fingerprint to detect the illegitimate bots targeting ad click fraud. The approach consists of two detection phases: (1) a rule-based phase and (2) a machine learning-based phase. The first level of the fingerprint is used for rule-based detection phase. It is generated using immutable information about the user and traversing a website’s page. The second level of the fingerprint is generated using ad click behavioral patterns. It is used for machine learning-based detection phase. Different traditional classification algorithms were evaluated to be applied in the machine learning-based detection phase. To test our approach, we used a real commercial website for ads called Waseet where the access log of the website server was utilized as a dataset for our experiments. The results of our experiments show that our proposed hybrid approach entails promising results.

Botnets are rising as a platform for many unlawful cyber activities such as Distributed Denial of Service (DDoS) attacks, malware dissemination, phishing, click fraud, and so on. As of late, detecting botnet has been an intriguing research topic in relation to cybercrime analysis and cyber-threat prevention. This paper is an analysis of publications related to botnet detection techniques. We analyse 194 botnet related papers published between 2009 and 2018 in the ISI Web of Science database. Seven (7) criteria have been used for this analysis to detect highly-cited articles, most impactful journals, current research areas, most active researchers and institutions in the field. It was noted that the average number of publications related to botnet detection have been reduced recently, which could be because of overwhelming existing literature in the field. Asia is the most active and most productive continent in botnet research and computer science is the research area with most publications related to botnet detection as expected.

In this paper we present an algorithm that identifies fraud in online advertising systems such as CPC (Cost Per Click also called PPC Pay-Per-Click). This model used in online advertising is particularly sensitive because it can be exploited by making invalid clicks on an advertisement. This results in additional costs for the advertiser, reduced possibility of reaching the most interested viewers and fraudulent results of an advertising campaign. The dynamically modified BoW (Bag-Of-Words) algorithm presented in the article allows us to identify repetitive clicks made by dishonest publishers or by automatic software, i.e. bots. The algorithm uses data obtained directly on an advertiser’s website. The paper also presents the results of an experimental research confirming effectiveness of the proposed methods.

Botnets currently pose the most serious threat to the digital ecosystem, providing an infrastructure that enables bank fraud, distributed denial of service attacks (DDoS), and click fraud. During the past few years, three main approaches have been used to fight botnets. First, police organizations have periodically arrested prominent hackers and scammers, hoping such high-profile operations would have a deterrent effect. Second, Microsoft has performed a number of takedowns, using an innovative blend of legal and technical means that attempt to disrupt botnet operations and reduce their profitability. Third, some countries – Japan, South Korea, Australia, the Netherlands, and Germany – encourage harm reduction strategies that rely on public-private partnerships involving internet service providers, anti-virus companies, and regulatory authorities. This article describes these three approaches (incapacitation, disruption, and harm reduction), the challenges they face, and their respective effectiveness in protecting the digital ecosystem from large-scale online harm.

In recent years, Botnets have been adopted as a popular method to carry and spread many malicious codes on the Internet. These malicious codes pave the way to execute many fraudulent activities including spam mail, distributed denial-of-service attacks and click fraud. While many Botnets are set up using centralized communication architecture, the peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control data making their detection even more difficult. This work presents a method of P2P Bot detection based on an adaptive multilayer feed-forward neural network in cooperation with decision trees. A classification and regression tree is applied as a feature selection technique to select relevant features. With these features, a multilayer feed-forward neural network training model is created using a resilient back-propagation learning algorithm. A comparison of feature set selection based on the decision tree, principal component analysis and the ReliefF algorithm indicated that the neural network model with features selection based on decision tree has a better identification accuracy along with lower rates of false positives. The usefulness of the proposed approach is demonstrated by conducting experiments on real network traffic datasets. In these experiments, an average detection rate of 99.08 % with false positive rate of 0.75 % was observed.

The rapid growth of residential broadband connections and Internet-enabled home devices have driven the success of many useful applications such as video streaming and remote healthcare. However, poorly managed routers and connected devices in the home are vulnerable under persistent threats and exploitations from cyber attackers across the Internet who continuously identify, compromise, and control devices as part of botnets for launching click fraud, denial of service attacks, spam campaigns. These growing threats and broad damages have made it imperative to understand, characterize, filter, and reduce exploit traffic towards millions of home routers and billions of connected devices in the home. This paper presents a bloom-filter based analytics framework to capture persistent threats towards the same home routers and to identify correlated attacks towards distributed home networks. Our experimental results based on network traffic collected from real homes over 18months have revealed a number of interesting findings on persistent and correlated threats towards home networks, which calls for improved security and management of home networks. To the best of our knowledge, this paper is the first effort to characterize cyber threats towards home networks and to propose a simple and yet effective approach to identify persistent and aggressive attacks towards home networks. Copyright © 2016 John Wiley & Sons, Ltd.

This paper is concerned with the problem of click fraud detection. We assume each visitor of a website carries a latent indicator, which labels him/her as a regular or malicious user. Information such as number of clicks, number of page views (PVs) and time difference between consecutive clicks are cooperated in our newly proposed statistical model. We allow those random variables to share the same distribution but with different parameters according to the visitor's type. An EM algorithm is then suggested to obtain the maximum likelihood estimator. As a result, click fraud detection can be implemented by estimating the posterior malicious probability of each visitor. Simulation studies are conducted to assess the finite sample performance. We also demonstrate the usefulness of the proposed method via an empirical analysis of a real life example on searchengine marketing.

Recently, Botnets have become a common tool for implementing and transferring various malicious codes over the Internet. These codes can be used to execute many malicious activities including DDOS attack, send spam, click fraud, and steal data. Therefore, it is necessary to use Modern technologies to reduce this phenomenon and avoid them in advance in order to differentiate the Botnets traffic from normal network traffic. In this work, ensemble classifier algorithms to identify such damaging botnet traffic. We experimented with different ensemble algorithms to compare and analyze their ability to classify the botnet traffic from the normal traffic by selecting distinguishing features of the network traffic. Botnet Detection offers a reliable and cheap style for ensuring transferring integrity and warning the risks before its occurrence.

Botnet, a group of coordinated bots, is becoming the main platform of malicious Internet activities like DDOS, click fraud, web scraping, spam/rumor distribution, etc. This paper focuses on design and experiment of a new approach for botnet detection from streaming web server logs, motivated by its wide applicability, real-time protection capability, ease of use and better security of sensitive data. Our algorithm is inspired by a Principal Component Analysis (PCA) to capture correlation in data, and we are first to recognize and adapt Lanczos method to improve the time complexity of PCA-based botnet detection from cubic to sub-cubic, which enables us to more accurately and sensitively detect botnets with sliding time windows rather than fixed time windows. We contribute a generalized online correlation matrix update formula, and a new termination condition for Lanczos iteration for our purpose based on error bound and non-decreasing eigenvalues of symmetric matrices. On our dataset of an ecommerce website logs, experiments show the time cost of Lanczos method with different time windows are consistently only 20% to 25% of PCA.

Click fraud happens in cost per click ad networks where publishers charge advertisers for each click. Click fraud is posing the huge loss to the mobile advertising industry. The conventional technologies use ensemble machine learning methods, neglecting the cost of incorrect classification for a fraud publisher is higher than a normal publisher. An effective classification model for variable click fraud is proposed in this paper. Cost-sensitive Back Propagation Neural Network is combined with the novel Artificial Bee Colony algorithm in this research (CSBPNN-ABC). Feature selection is synchronously optimized with BPNN connection weights by ABC to reduce the interaction between features and weights. Cost Parameters are added to BPNN by correcting the error function. Experiments on real world click data in mobile advertising show that its superior classification performance compared with the state-of-the-art technology.