Characterizing Large-Scale Click Fraud in ZeroAccess

Abstract

Click fraud is a scam that hits a criminal sweet spot by both tapping into the vast wealth of online advertising and exploiting that ecosystem's complex structure to obfuscate the flow of money to its perpetrators. In this work, we illuminate the intricate nature of this activity through the lens of ZeroAccess-one of the largest click fraud botnets in operation. Using a broad range of data sources, including peer-to-peer measurements, command-and-control teleme-try, and contemporaneous click data from one of the top ad networks , we construct a view into the scale and complexity of modern click fraud operations. By leveraging the dynamics associated with Microsoft's attempted takedown of ZeroAccess in December 2013, we employ this coordinated view to identify "ad units" whose traffic (and hence revenue) primarily derived from ZeroAccess. While it proves highly challenging to extrapolate from our direct observations to a truly global view, by anchoring our analysis in the data for these ad units we estimate that the botnet's fraudulent activities plausibly induced advertising losses on the order of $100,000 per day.

Ad Injection at Scale: Assessing Deceptive Advertisement Modifications

“…In particular, research has focused on the evolution of botnets towards ad related clickfraud monetization [1], [25] and the impact of botnet interventions on abusive ad traffic [6], [26]. Other forms of abuse include the failures of current ad exchanges to detect distributed clickfraud [33], the ability for compromised routers and opportunistic ISPs to inject ads into users' traffic [29], [34], and the market for impression fraud via ads hidden underneath other content or served in invisible windows [32].…”

“…Popular examples include public WiFi portals that tamper with in-transit HTTP content to inject ads [7], [22]; and the Yontoo browser plugin which modified 4.5 million users' private Facebook sessions to include ads that earned Yontoo $8 million [21], [30]. These scenarios highlight that ad injectors skirt the line demarcating legitimately acquired traffic versus synthetic traffic generated via automated click fraud [8], click hijacking [1], [26], and impression fraud [32]. This distinction is critical-most ad injectors are potentially unwanted programs, not malware.…”

AdAttester

“…Daswani [17] gives an overview on techniques of web ad frauds; Miller et al [31] summarize techniques and innovations of today's clickbots. Prior work on detecting bot-driven click frauds mainly analyzes query logs [44] in search engine to aggregate ad traffic across IP addresses [30], or through complex analysis from peer-to-peer measurements and command-and-control telemetry [33]. NAB [23] uses TPM to attest user actions by analyzing mouse and keyboard activity to identify and certify human-generated activity, thus filter out bot-driven clicks and spam.…”

“…1 billion dollars in 2013 due to these frauds and around one third of mobile ad clicks may constitute click-spam [18]. The most recent research study [33] shows that, one of the largest click fraud botnets, called ZeroAccess, induces advertising losses on the order of $100,000 per day. Ad frauds can typically be characterized into two types [26]: (1) Bot-driven frauds employ bot networks to initiate forged ad impressions and clicks; (2) Interaction frauds manipulate visual layouts of ads to trigger ad impressions and unaware clicks from the end users.…”

“…Specifically, they trigger the execution of mobile apps in a controlled environment to observe deviated behavior to detect ad frauds. However, such approaches are limited to interaction frauds whose behavior can be triggered by automatic testing; it is hard for them to detect bot-driven frauds because botnets are compromised bots (thus real devices) that have been installed with the ad fraudulent applications, which could be instructed to make arbitrary network requests stealthily to users (such as ZeroAccess [33]). Further, such approaches suffer from both relatively high false positives and false negatives because the lack of reliable proofs to ad providers for attestation.…”