Duplicate detection in pay-per-click streams using temporal stateful Bloom filters

The rapid advancement of the digital economy has significantly increased the use of online advertising while concurrently giving rise to critical challenges, particularly in the form of click fraud”a manipulative act that harms advertisers by generating fraudulent clicks on digital advertisements. As click fraud attack patterns grow increasingly complex, machine learning (ML)-based research has emerged as a principal approach for detecting and mitigating these threats. This study aims to map the research landscape of ML-based click fraud detection through a bibliometric analysis to identify publication trends, patterns of international and institutional collaboration, and key thematic domains within this field. Employing a bibliometric methodology, the study analyzed 61 publications retrieved from Dimensions.ai spanning the years 2015–2024. The data were collected, refined using OpenRefine, and visualized with VOSviewer to examine keyword co-occurrences and research trends. The findings reveal a marked increase in publication volume since 2019, with dominant contributions from India, China, Saudi Arabia, and the United States. Furthermore, four principal research clusters were identified: cybersecurity, the relationship between click fraud and the digital advertising industry, dataset processing and evaluation techniques, and the development of ML-based detection systems. Each cluster offers practical contributions in areas such as system protection strategies, ad budget optimization, improved detection accuracy, and the development of scalable, real-time detection solutions. Recent trends highlight growing scholarly interest in model performance evaluation and the challenges posed by class imbalance (class skewness). This study concludes that more effective data management and the development of adaptive ML models capable of addressing evolving attack patterns are pivotal for future research. By providing a clearer mapping of current trends, this study aims to support the scientific community in developing more accurate and efficient click fraud detection strategies, thereby strengthening the integrity of the global digital advertising ecosystem.

In computing, duplicate data detection refers to identifying duplicate copies of repeating data. Identifying duplicate data items in streamed data and eliminating them before storing, is a complex job. This paper proposes a novel data structure for duplicate detection using a variant of stable Bloom filter named as FingerPrint Stable Bloom Filter (FP-SBF). The proposed approach uses counting Bloom filter with fingerprint bits along with an optimization mechanism for duplicate detection. FP-SBF uses d-left hashing which reduces the computational time and decreases the false positives as well as false negatives. FP-SBF can process unbounded data in single pass, using k hash functions, and successfully differentiate between duplicate and distinct elements in O(k+1) time, independent of the size of incoming data. The performance of FP-SBF has been compared with various Bloom Filters used for stream data duplication detection and it has been theoretically and experimentally proved that the proposed approach efficiently detects the duplicates in streaming data with less memory requirements.

Around 30% revenue has been wasted due to different types of advertising fraud. In view of the continuous emergence of fraud and the improvement of fraudulent means, a click fraud detection of cost-sensitive convolutional neural network (CSCNN) based on feature matrix is proposed. In order to capture the pattern of click fraud, priori probability is introduced and a new feature set is derived from the knowledge of entropy. Then, using cost-based sampling method and threshold-moving cost sensitive learning algorithm to solve unbalanced data training problems. Features are transformed into feature matrix by different time windows to fit the input of a convolutional neural network. Finally, considering the convolution kernel size, the number of convolution kernels and the pooling size of different network structures in this work, effective CSCNN structure was chosen. Experiments on real-word data show that this method can complete click fraud detection effectively, and can complete multi classification without increasing the complexity of the model. A new effective method was provided on click fraud detection in mobile advertisement.

The Counting Bloom Filter (CBF) is a kind of space-efficient data structure that extends a Bloom filter so as to allow approximate multiplicity queries on a dynamic multi-set. This paper evaluates the performance of multiplicity queries of three simple CBF schemes-the Naive Counting Bloom Filter (NCBF), the Space-Code Bloom Filter (SCBF) and the d-left Counting Bloom Filter (dlCBF)—using metrics of space complexity and counting error under both uniform and zipfian multiplicity distributions. We compare their counting error under same space complexity, and their space complexity when similar counting errors are achieved respectively. Our results show that dlCBF is the best while SCBF is the worst in terms of both space-efficiency and accuracy. Furthermore, the performance gap between dlCBF and the others has a trend of being enlarged with the increment of space occupation or counting accuracy.

Bloom filters are widely used in many network applications but the high computation cost limits the system performance. In this paper, we introduce a new variation of Bloom filter named One-Hashing Bloom Filter (OHBF) to solve the problem. OHBF requires only one base hash function plus a few simple operations to implement a Bloom filter. While keeping nearly the same theoretical false positive ratio as an ideal Bloom filter, OHBF significantly reduces the hash computation overhead. We show that the false positive performance of a standard Bloom filter implementation strongly relies on the selection of hash functions, even if these hash functions are considered good. In contrast, OHBF presents consistently better performance with a proven mathematical foundation. OHBF is ideal for high throughput and low latency applications. As OHBF is a fundamental technique in Bloom filter theory, it can be applied to many other Bloom filter variations, such as Counting Bloom Filter and Space-Code Bloom Filter.

As a key component in implementing Named Data Networking (NDN), Pending Interest Table (PIT) requires an efficient exact-matching algorithm for a scalable and fast PIT lookup. A Bloom filter (BF) is a memory-efficient data structure for performing exact matching operations. In this paper, three different BF-based PIT architectures are proposed: PIT using functional Bloom filters (FBF-PIT), PIT using counting Bloom filters with return values (rCBF-PIT), and a refined rCBF-PIT with signatures (R-rCBF-PIT). The proposed BF-based PITs incrementally allocate a new BF for storing multiple incoming faces of Interest packets with the same content name. For a Data packet lookup, the proposed PIT architectures simultaneously access every BF structure to find matching faces and delete the faces (i.e., matching Interest packet information). The functional Bloom filter (FBF) used in an FBF-PIT is a key-value data structure that stores values only without keys. However, because the number of non-reusable conflict cells in the FBF increases as the number of stored packets increases in the FBF-PIT, the indeterminable rate increases. To decrease the indeterminable rate, we propose the rCBF-PIT, which uses counting Bloom filters with return values (rCBFs), allowing reusable conflict cells. False positives for Interest packets lead to incorrect deletions that can cause false negatives for incoming Data packets. Because most of the false positives occur in the first BF structure, we finally propose the R-rCBF-PIT, in which the first rCBF is replaced with an rCBF with a signature field. The proposed PITs also provide an aging mechanism using a valid bit and a hit bit for entry expiration. Simulation results show that rCBF-PIT and R-rCBF-PIT both reduce the indeterminable rate by more than 81% compared with FBF-PIT. The results also show that R-rCBF-PIT resolves false negatives caused by incorrect deletions by including the signature fields in the first rCBF.

Bloom filters are probabilistic data structures that are popular in networking for set representation; however, they show an inherent inaccuracy due to false positives. One of the potential attacks on Bloom filters is to pollute them with elements that cause the filter to have a larger false positive probability than under normal operation; Pollution is simple when an attacker knows the details of the filter implementation. Recent research has shown that also black-box adversaries can pollute a counting Bloom filter (a common variant of the filter that also supports removals) with no knowledge of its implementation. As over time, many variants and improvements of Bloom filters have been proposed, it is of interest to study whether they can also be polluted and if so also the increase in their false positive probability. This paper first proposes and then evaluates pollution attacks for some of the most common variants including the Block Bloom filters (BBFs), the Variable Increment and Fingerprint Counting Bloom filters (VI-CBFs and FP-CBFs). The results show that with or without knowledge of the implementation, these variants of the Bloom filter are significantly more vulnerable to pollution attacks than the traditional Bloom filter. In particular, BBFs are extremely vulnerable, so providing an insight on their impact and use in practical systems when the number of memory accesses per lookup must be reduced.

One of the most common threats to internet security is the Denial of Service attack. There are numerous methods and protocol changes in an effort to detect them. The most common DoS attack detection method relies on the number of the TCP control packet in the network flow. The Bloom filter represents a space efficient data structure that is commonly utilized to detect matching pairs. There are multiple algorithms for the DoS attack detection based on the Bloom filter. The SACK <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> algorithm uses the SYN/ACK - ACK matching pair detection with the Bloom filter data structure. The false positive error introduced by the Bloom filter influences on the matching pair detection in the algorithm. The improved SACK <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> algorithm significantly reduces the false positive error by replacing the Counting Bloom Filter (CBF) data structure with the Dual Counting Bloom Filter (DCBF) data structure. This improvement significantly improves the matching pair detection. It is expected that the false positive error should influence on the detection of the DoS attack. In this paper, the experimental study is performed to analyse this influence. This study confirms the correlation between the false positive error and the DoS attack detection.

Click fraud (CF) has become a serious problem in the online advertising, making the anti-CF issue quite important. In this paper, we analyze the effects of the price determination model on the CF situations in online advertising. Our theoretical results show that the flat-rate model can induce more click frauds than the real-time-bidding model. Our finding is validated with a real advertising dataset.

Bloom filters are widely used in networking and computing to accelerate membership checking. In many applications filters store sensitive data, so their privacy is of primary concern. At first glance, it seems that extracting the set of elements inserted from the filter would not be possible, because in Bloom filters elements are mapped to positions using hash functions. However, previous works have shown that for the Bloom filter, it may be possible to identify few of the elements inserted in the filter. In this work, we consider the case of counting Bloom filters (CBFs) and show that in some cases, the entire set of elements used to create the filter can be extracted from the filter. This poses serious privacy and security concerns when an attacker can get access to the filter contents. In this article, an algorithm to extract the elements inserted from the filter is presented and analyzed theoretically; then, the feasibility of the CBF inversion is shown by simulation. A case study is presented in detail to illustrate that in practical applications, these conditions can be met by using additional restrictions that are implicit in the nature of the application itself.

Click fraud endangers the advertising effectiveness of search engine advertising and thus imperils the business model of many search engine providers. Search engine providers need to address click fraud and attest the reliability and accuracy of the pay-per-click accounting system. Advertisers have to factor click fraud in the decision process concerning a search engine advertising campaign. To detect fraudulent clicks, the usage of log file data and different levels of a click fraud detection system are presented. Additionally, the influence of fraudulent click behavior on performance measures is analyzed to qualify the evaluation of advertising effectiveness based on these measures.

Mobile ads are plagued with fraudulent clicks which is a major challenge for the advertising community. Although popular ad networks use many techniques to detect click fraud, they do not protect the client from possible collusion between publishers and ad networks. In addition, ad networks are not able to monitor the user’s activity for click fraud detection once they are redirected to the advertising site after clicking the ad. We propose a new crowdsource-based system called Click Fraud Crowdsourcing (CFC) that collaborates with both advertisers and ad networks in order to protect both parties from any possible click fraudulent acts. The system benefits from both a global view, where it gathers multiple ad requests corresponding to different ad network-publisher-advertiser combinations, and a local view, where it is able to track the users’ engagement in each advertising website. The results demonstrated that our approach offers a lower false positive rate (0.1) when detecting click fraud as opposed to proposed solutions in the literature, while maintaining a high true positive rate (0.9). Furthermore, we propose a new mobile ad charging model that benefits from our system to charge advertisers based on the duration spent in the advertiser’s website.

With the wide spread of Cloud service, users are outsourcing their data to the third party servers. When we delegate our data to the cloud servers, there is such a potential risk that the data stored in the servers is stolen. If the data are stored in the encrypted form, the damage caused by data theft is low because the data will not leak to other parties. However, a new problem arises, that is, users are not able to operate encrypted data, which loses the merit of cloud computing. To solve such a problem, searchable symmetric encryption(SSE) is proposed. SSE is a cryptographic protocol that can execute keyword search over encrypted documents without decrypting them. Secure Indexes is one of realizations of SSE that provides constant time keyword search per document with the help of pseudo-random function and Bloom filters. However, Secure Indexes dose not support addition and deletion of documents. Tekin and Sahin proposed an improved Secure Indexes scheme that supports addition and deletion by employing Bloom filter and counting Bloom filter. The drawback of their scheme is that these operations are implemented in user side, which is not desired in the cloud computing since the aim of cloud computing is to delegate as many operations as possible. This paper proposes new SSE scheme. The proposed scheme also employ counting Bloom filter, but provide more fine-grained operations compared to the scheme by Tekin and Sahin in the sense that the proposed scheme provides not only search documents but add and delete the elements of document. Moreover, these operations are executed in the server side. The performance of the proposed SSE is comparable to the existing scheme which provides constant time for search, add and delete per document. We also implemented this SSE scheme, and verified that the scheme performed well not only theoretically but also in practice.

An increasing number of architectural techniques have relied on hardware counting bloom filters (CBFs) to improve upon the energy, delay, and complexity of various processor structures. CBFs improve the energy and speed of membership tests by maintaining an imprecise and compact representation of a large set to be searched. This paper studies the energy, delay, and area characteristics of two implementations for CBFs using full custom layouts in a commercial 0.13-mum fabrication technology. One implementation, S-CBF, uses an SRAM array of counts and a shared up/down counter. Our proposed implementation, L-CBF, utilizes an array of up/down linear feedback shift registers and local zero detectors. Circuit simulations show that for a 1 K-entry CBF with a 15-bit count per entry, L-CBF compared to S-CBF is 3.7times or 1.6times faster and requires 2.3times or 1.4times less energy depending on the operation. Additionally, this paper presents analytical energy and delay models for L-CBF. These models can estimate energy and delay of various CBF organizations during architectural level explorations when a physical level implementation is not available. Our results demonstrate that for a variety of L-CBF organizations, the estimations by analytical models are within 5% and 10% of Spectre simulation results for delay and energy, respectively.

Dynamic adaptive data structures for monitoring data streams