Defender — Invalid Traffic Detection

Invalid traffic (IVT) is any ad request that isn’t generated by a real human viewing real content — bots, scrapers, data centre traffic, and behavioural fraud. Defender detects and rejects these requests before they reach the auction engine, protecting demand source (DSP) budgets and supply source (Publisher) revenue integrity.

Platform-wide fraud rate: <2%

Detection layers

Defender applies five detection layers in sequence. Any layer that triggers causes the request to be rejected immediately.

Layer 1: IP rate limiting

A single IP address generating more than N requests per second is flagged as a bot or crawler.

Threshold: configurable per pool (default: 50 req/s per IP)
Action: requests from that IP are rate-limited for 60 seconds
False positive rate: near zero (no legitimate viewer generates 50+ ad requests/second)

Layer 2: Known bot IP database

Defender maintains a continuously updated database of:

Data centre IP ranges (AWS, GCP, Azure, DigitalOcean, Hetzner, etc.)
Known crawler user agents and IP ranges
Residential proxy networks
VPN exit nodes (where declared)

Requests from these IP ranges are rejected before any DSP processing.

The database is updated every 6 hours from multiple threat intelligence feeds.

Layer 3: User agent analysis

Empty UA         → reject
Known bot UA     → reject (Googlebot, Bingbot, scraper patterns)
Malformed UA     → flag for behavioral analysis
CTV UA on web IP → flag for geo check

User agents are matched against a curated blocklist and also scored for anomalies (e.g., a “smart TV” user agent originating from an AWS IP).

Layer 4: Geographic anomaly detection

IP geo vs declared geo mismatch: Bid request claims geo=Dubai but IP resolves to Frankfurt → flag
Impossible velocity: Same user ID seen in London and New York within 60 seconds → flag
CTV from data centre: Device type 3 (CTV) with an IP in an AWS/Azure range → reject

Geographic mismatch doesn’t always indicate fraud — VPNs are common for legitimate users. Defender scores mismatches rather than hard-rejecting them unless combined with other signals.

Layer 5: Behavioural signals

Patterns that indicate non-human traffic:

Signal	Threshold	Action
Identical bid request replayed	Exact duplicate within 5s	Reject
Inhuman request frequency	Same publisher + same device ID > 100 req/hour	Flag
Zero-duration impression	Impression fired with 0ms duration	Reject
Impression without auction	Impression tracking URL called without prior auction	Reject

GIVT vs SIVT

Type	Definition	Defender handling
GIVT (General IVT)	Bots, crawlers, data centre traffic — clearly non-human	Hard reject
SIVT (Sophisticated IVT)	Human-operated fraud, ad stacking, pixel stuffing	Scored, flagged, reported

GIVT is caught by layers 1–3 (deterministic). SIVT requires layers 4–5 (probabilistic scoring). SIVT is flagged in reports but some edge cases reach the auction — this is an industry-wide challenge.

Performance

Detection latency: <0.5ms overhead per request (all checks run in-memory)
No external API calls: All detection is local — no third-party latency
Platform fraud rate: <2% of impressions (industry average: 8–14%)

Circuit breaker integration

When Defender detects sustained invalid traffic from a supply source’s inventory, it can trigger a circuit-breaker-style cooldown:

Supply source’s fraud rate exceeds 10% over a 5-minute window
Defender flags the supply source and notifies the partner
Demand sources are automatically protected — they stop receiving requests from that supply source
Partner reviews and resolves the issue
Supply source is manually re-enabled after verification

Reporting

Fraud metrics are visible per supply source in the dashboard under Supply → supply source → Fraud Stats:

GIVT rejected (count + %)
SIVT flagged (count + %)
IVT breakdown by detection layer
Top flagged IPs (anonymised)

Demand sources can also see aggregate fraud rates via the metrics API:

GET /api/metrics/publisher/{publisher_id}?include=fraud

For enterprise buyers

Defender is aligned with IAB Tech Lab GIVT/SIVT definitions and works toward TAG Brand Safety Certified compliance. For enterprise procurement requiring third-party IVT measurement, contact [email protected] to discuss third-party verification integration (IAS, DoubleVerify, MOAT).

Pathfinder — Smart Routing Guide — Budget Autopilot