Natural Patterns in Cookie Stuffing Schema

Introduction

As some of you who frequent IRC know, the people who comprise blackhatzen, including myself, are complete and total math nerds. We love metrics, heuristics, statistics, linear algebra, and all things derivative. One of the fields that we study is pattern recognition in information systems. This is where our passion for search engine optimization stems from. Because of that, we like to crunch numbers and think about how we can use those numbers to manipulate the outcomes of algorithms.

One thing that I personally have been spending time thinking about and analyzing is how affiliate networks catch “cheaters.” Now, I’m not making any value judgments here, but you can rest assured that affiliate managers and their managers everywhere are. So, the question arises, how do we cheat the system and not get caught? Many cookie stuffing scripts are designed to limit CTR to a certain percentage in an attempt to not trip any red flags. The problem with this is that it isn’t a set percentage that is causing your affiliate manager to pound out angry emails, it’s a pattern.

The Problem

These companies have very large data sets to create qualitative comparative analysis algorithms from. These algorithms exist to attempt to discern natural and unnatural patterns in CTR. One thing that I have noticed that many cookie stuffing scripts and methods are missing is the ability to adjust CTR over time. To put it simply, a CTR that consistently averages out to 13.8% day after day is going to throw a serious red flag. Why? Because it’s unnatural. Even when you take into consideration the occasional 14.3% or 13.3% CTR when the balance of impressions and clicks can’t equal out to 13.8%, the pattern is still unnatural.

That said, clicks doesn’t necessarily equal conversions, right? Absolutely, but it isn’t necessarily high conversions that are getting you in trouble. Some people are just naturally skilled at targeting the right demographics and the affiliate networks are aware of this. What they’re getting interested in is why you, day-after-day are get, 5-10,000 impressions +/- 50-60 odd hits and why it seems that your actual conversions only seem to come from 10-15% of those 50-60 odd hits and nothing from the other 5-10,000. They’re also interested in why even on slow days, your CTR stays roughly the same.

So, I’d like to propose a few ideas for solutions as well as open the table for everyone’s thoughts on the subject. I’m bound to be missing angles and I think that we may be able to begin to collectively problem solve.

A Solution?

The one solution that I’m currently working on and believe might have some serious potential is a system that adjusts itself as traffic increases and decreases. One way to approach this would be to automatically analyze traffic on an hourly basis via a cron job and adjust the CTR hour-to-hour (potentially less or more) based on traffic. So, if between 9AM and 10AM you got 153 visitors and had your CTR set to 15% (roughly 23 clicks) you could adjust the CTR to 6% from 10AM to 11AM and then back into the 10-15% range between 11AM and 12AM if traffic remained at a consistent or slow rate. It’s very easy for all of us to just look at stats as a daily thing because most often we’re aren’t given the option to look at them in any other way. I believe this is a mistake in our perception and one that was specifically engineered by the affiliate networks. Certainly their analytical tools are elegant enough to display hourly stats and I have not seen many that allow you to view breakdowns like this.

I also think that ensuring that the same IP addresses don’t get stuffed more than once in X number of days is an important way to keep yourself from getting caught.

Conclusion

In summation, I think if we all begin to work together to create systems that can defeat natural pattern recognition algorithms being run by affiliate networks, we might be able to force them to back-off a little or, at the very least, make their jobs much harder. Any thoughts, ideas, complaints, questions, etc are greatly appreciated and can only help our community better understand what we are up against.

Comments

Leave a comment