You are correct in your hypotheses about botnets. In fact, there is a considerable amount of information available on the botnet mailing list and from Gadi Evron at SecureiTeam.

Among other things, what puzzled me is how AdWords and AdSense were ever released without considerations as to the degree of click fraud possible. It seemed obvious to me that charging per click (or impression, for that matter) with minimal (if any) checks would make click fraud trivially easy. Others in the Internet technical community have made similar comments, such as Bruce Schneier and Lauren Weinstein.

[comment edited by Jeremy Chatfield to embed the links]

My degree is in Cybernetics Science and I’ve fiddled with my own web crawlers over the years, as well as worrying about the Turing Test… I’m pretty sure that I can’t detect a sufficiently well crafted bot. I don’t want to detail all the things that I’d think about, in a public article, though I suspect that anyone well versed in web analytics would have the knowledge to emulate a real human’s behaviour.

If click fraud is fairly balanced - that is, it doesn’t selectively click on one advertiser, it isn’t really a problem for advertisers. It is a social, legal and criminal or even terrorist problem, but it is not an advertising problem. At least, not for rational advertisers.

Imagine that someone turned on a promiscuous high volume robot network tomorrow, that doubles click volume and impression volume. By Tuesday or maybe even Monday, our clients’ bids would have halved, because the conversion metrics would be half what they were today. Eventually, in the steady state, the budget would be the same, and the Average CPC will be half what it is now. The difference would be that a big chunk of money would be in the hands of fraudsters.

The way that you’d tell is using signal analysis. The number of data points you need depends on assumptions about the number of bots in the net and the number of impressions and clicks that you can gather. More particularly, it depends on identifying the clickers that have an unusually low purchase rate… And that means access to advertisers sales data. Something that suspicion of Google’s motives is unlikely to lead to. So raising suspicion of Google actually increases the chances of successful fraud… maybe. I’ll have to think about that a bit more.

Right now, I have to leave for a Christmas concert… More later. Thanks for the response!

Thanks for taking such a close look at my click fraud article. The focus of the article was to show some circumstantial evidence for the existence of a zombie click fraud network and Google knowing about it. Even you point out some areas where Google is less than honest about the AdWords program. The real agruement hear lies in ROI. I agree that if a customer is getting a decent ROI, you don’t need to worry about how many of the unconverted clicks are fraud. In the case of a zombie networks, you can not tell if a human or a zombie is the unconverted click. This type of fraud potentially has hundreds of thousands of slaves doing the work. As you point out, you would need affect close to $200 million per year to see fraud without Google’s assistance. I could live with unconverted human views since it has everything to do with me and the site. The zombie clicks however are outright theft.

When you can spread out the fraud over 1,000’s of machines and over multiple fraudulent AdSense accounts it makes it extremely hard to detect. My orginal zombie network article outlines how to make a semi-legit business to hide a functioning zombie network.

Since you are so involved with AdWords, can you tell me of the largest AdSense account that Google has suspended? In my research, I have only found very small time accounts that have got banned. You would think that the large ones would have more to complain about if banned.

Jeremy, do you think a zombie network exists or can be created? You mentioned how much you examine web server log files. Can you tell me when you consider a click through legit? Is it viewing multiple pages on the AdWord customer account? The length of time spent viewing?? These things are easily programmed. My own spider takes a web page, takes out the links, parses the text, waits an acceptable period of time and does it again by following another link. What makes that any different than what a human does?? By setting the zombie to view x number of pages on a site, leaving a random amount of time between clicks, could you tell that it was fraudulent? Would it even raise a flag? With the number of people trying to game Google on a semi-legit biases, why would a click fraud network not be created? We have already seen multilple accounts of human click fraud networks and these are no different. Only instead of a couple hundred workers, you now have thousands working without paying them. What a bonus.

I feel people should remember that Google is not the first to try this type of advertising. Others who were successful for a short period of time ended up losing advertiser confidence. Google is close to a tipping point. As the amount of circumstantial evidence grows, Google’s goose might just start lying ordinary eggs instead of the current gold.