Fraud Methodology
Praevis Defender is our multi-layer invalid traffic detection system. It operates on every auction request with <0.5ms overhead and maintains a platform-wide fraud rate below 2% — compared to an industry average of 8–14%.
What counts as invalid traffic
Following IAB Tech Lab definitions:
| Type | Definition | Examples |
|---|---|---|
| GIVT (General IVT) | Non-human traffic detectable by standard means | Known bots, data centre IPs, crawlers |
| SIVT (Sophisticated IVT) | Requires advanced analysis; may use human-operated or emulated browsers | Ad stacking, pixel stuffing, domain spoofing |
Defender targets both. GIVT is caught deterministically (hard reject). SIVT is scored probabilistically (flagged, investigated).
Detection layers
Defender applies five layers to every incoming request:
Layer 1: IP rate limiting
Requests exceeding N per second from a single IP are flagged as bot traffic. Threshold is configurable per pool. Legitimate viewers don’t generate multiple ad requests per second.
Layer 2: Known bot IP database
A continuously updated database of:
- Data centre IP ranges (AWS, GCP, Azure, DigitalOcean, Hetzner)
- Known crawler user agents and IP ranges
- Residential proxy and VPN exit node ranges
Updated every 6 hours from multiple threat intelligence feeds.
Layer 3: User agent analysis
- Empty or missing user agent → reject
- Known bot/crawler signatures → reject (Googlebot, Bingbot, scraper patterns)
- Malformed user agents → score and flag
- Device/IP mismatch (e.g., “Smart TV” UA from AWS IP) → flag for geo check
Layer 4: Geographic anomaly detection
- IP-declared geo vs
device.geomismatch beyond acceptable range → flag - Impossible velocity (same device ID, two distant locations within 60s) → reject
- CTV device type from data centre IP → reject
Layer 5: Behavioural signals
- Exact duplicate auction request within 5 seconds → reject
- Inhuman request frequency (same supply source + device > 100 req/hour) → flag
- Impression tracking fired with 0ms duration → reject
- Impression URL called without prior auction record → reject
Performance
| Metric | Value |
|---|---|
| Detection latency | <0.5ms per request |
| False positive rate | <0.1% (legitimate traffic incorrectly blocked) |
| Platform fraud rate | <2% of impressions |
| Database update frequency | Every 6 hours |
| External API calls | None — all detection is local/in-memory |
Standards alignment
Defender is built on IAB Tech Lab GIVT/SIVT definitions and works toward the following standards:
| Standard | Status |
|---|---|
| IAB Tech Lab IVT Detection Guidelines | Aligned |
| TAG Brand Safety Certified | In progress |
| MRC IVT Accreditation | Evaluating |
Enterprise buyers requiring third-party IVT measurement (IAS, DoubleVerify, MOAT) should contact [email protected] to discuss integration options.
Fraud reporting
Per supply source: Dashboard → Supply → supply source → Fraud Stats
- GIVT rejected (count + %)
- SIVT flagged (count + %)
- Breakdown by detection layer
- Top flagged IP ranges (anonymised)
Via API:
GET /api/metrics/publisher/{id}?include=fraud&period=7dSupply source fraud alerts: When a supply source’s fraud rate exceeds 10% over 5 minutes, Praevis automatically notifies the partner and reduces bid requests to that supply source until reviewed.
Reporting fraud to us
Found a supply source you suspect is sending fraudulent traffic?
Email [email protected] with:
- Supply Source ID
- Auction IDs of suspected fraudulent impressions
- Description of the anomaly (e.g., “all impressions from single IP”, “impossible geo velocity”)
We investigate all reports within 5 business days.