AI Click Fraud Detection System

Invalid Traffic Filtering for Pay-per-Click Ads

Design the system an ad network uses to find invalid clicks (bots, click farms, spoofed sites, accidental clicks), keep them off advertisers' bills, and credit advertisers for the ones found after billing.

Overview

In pay-per-click advertising the advertiser pays each time someone clicks an ad. That makes a click worth faking: a publisher can inflate its own earnings, a competitor can drain a rival's daily budget, and malware can click ads in the background of infected devices. Google Ads defines invalid clicks as clicks that do not represent genuine interest, and lists accidental clicks, automated traffic, and deliberate manual clicks among them.

The industry standard for sorting this traffic is the Media Rating Council's Invalid Traffic Detection and Filtration Standards Addendum (updated June 2020). It defines two categories: general invalid traffic (GIVT), found by routine filters such as lists and standard parameter checks (known data-center traffic, declared bots and crawlers, non-browser user agents, pre-fetched traffic), and sophisticated invalid traffic (SIVT), which needs advanced analytics, corroboration from several sources or human review (hijacked devices, incentivized humans, forced clicks, spoofed domains and apps, adware). The design follows that split: cheap rules early, expensive analysis later, and money settled in a ledger.

Questions to ask first

What kind of network? — Search and display ads, paid per click
How much traffic? — 5 billion clicks a day, peak 3 times the average
Must the user wait for the check? — No: the click redirects at once; filtering happens before the click is counted
When is money settled? — Invalid clicks are removed before the bill closes; later findings become credits
Do we see conversions? — For advertisers who send them, as a signal
Who can see reasons? — Advertisers see totals and categories, never the detection details

What you will be able to do

Define GIVT and SIVT as the MRC does, and place each detector at the right stage.
Filter clicks in the stream with lists, rate limits and deduplication, without slowing the user.
Catch spoofed sites with ads.txt, and suspicious publishers with the conversion signal.
Keep billing correct: filtered before the bill, credited after, each click settled exactly once.
Explain the feedback loop and why detection details stay private.

Key concepts

Invalid traffic (IVT)
GIVT and SIVT
Click deduplication
Data-center IP lists
ads.txt
Publisher-level analysis
Conversion signal
Billing ledger
Credits
Adversarial feedback

Functional requirements

Log every click and redirect the user immediately
Decide within seconds whether a click counts against the advertiser's budget
Apply GIVT filters: data-center IP lists, known bots and crawlers, non-browser user agents, duplicates, rate limits
Run batch SIVT analysis on clicks, devices and publishers before each billing cycle closes
Issue a credit for each click found invalid after it was billed, once
Check that the seller of each impression is authorized in the site's ads.txt
Report filtered clicks and credits to advertisers; flag publishers for review

Non-functional requirements

No added delay for the user: the redirect never waits for detection
A click counts against a budget only after the stream filter, within about 5 seconds (our target)
Money is settled exactly once per click: no double charge, no double credit
Detection keeps working through a spike of several times normal traffic
Every decision is kept with its reason for audits and advertiser questions

Interview questions

What is the difference between GIVT and SIVT, and where do you catch each?
How do you keep an attacker from draining an advertiser's budget?
How do you catch click farms that use real people on real phones?
How does ads.txt stop domain spoofing?
How do you make sure a click is never billed and credited twice?
Why not block suspicious clicks before redirecting?
How do advertisers see what was filtered?
How do you evaluate a new detector safely?