Fraudulent traffic detection and estimation

A system for fraudulent traffic detection and estimation, the system comprising at least one processor connected to at least one storage device, the system being configured to:

• receive, for each of a plurality of different types of web traffic features, an empirical distribution of a first plurality of datapoints, wherein the first pluralities of datapoints are related to a first plurality of web traffic;
• receive, for each of the plurality of different types of web traffic features, a model distribution of a second plurality of datapoints, wherein the second pluralities of datapoints are related to a plurality of reliable web traffic;
• determine a minimum amount of datapoints to remove from each of the first pluralities of datapoints to create modified empirical distributions each corresponding to the model distribution within a first confidence level, wherein the system is configured to determine the minimum amount of datapoints to remove from each of the first pluralities of datapoints to create the modified empirical distributions by:
• removing a first amount of first datapoints from each of the first pluralities of datapoints to generate first distributions,
• removing a first amount of second datapoints from each of the first pluralities of datapoints to generate second distributions, the second datapoints being different from the first datapoints,
• determining a first divergence between each of the first distributions and the model distribution,
• determining a second divergence between each of the second distributions and the model distribution,
• comparing the first divergence with the second divergence,
• determining, in response to the comparison of the first divergence with the second divergence, that the first divergence is a first minimum divergence,
• determining that the first minimum divergence is greater than the first confidence level, and
• determining, in response to the determination that the first minimum divergence is greater than the first confidence level, that the first distribution does not correspond to the model distribution within the first confidence level;
• and
• determine that at least one of the removed minimum amount of datapoints is greater than a first threshold, wherein the first threshold comprises at least one of an absolute number of datapoints, a rate of datapoints, or a fraction of total datapoints;
• and
• generate an alert that the first plurality of web traffic includes at least one fraudulent instance of web traffic in response to the determination that the at least one of the removed minimum amount of datapoints is greater than the first threshold.

A non-transitory machine-readable medium having instructions encoded thereon for causing a processor to:

• receive, for each of a plurality of different types of web traffic features, an empirical distribution of a first plurality of datapoints, wherein the first pluralities of datapoints are related to a first plurality of web traffic;
• receive, for each of the plurality of different types of web traffic features, a model distribution of a second plurality of datapoints, wherein the second pluralities of datapoints are related to a plurality of reliable web traffic;
• determine a minimum amount of datapoints to remove from each of the first pluralities of datapoints to create modified empirical distributions each corresponding to the model distribution within a first confidence level, wherein the processor is caused to determine the minimum amount of datapoints to remove from each of the first pluralities of datapoints to create the modified empirical distributions by:
• removing a first amount of first datapoints from each of the first pluralities of datapoints to generate first distributions,
• removing a first amount of second datapoints from each of the first pluralities of datapoints to generate second distributions, the second datapoints being different from the first datapoints,
• determining a first divergence between each of the first distributions and the model distribution,
• determining a second divergence between each of the second distributions and the model distribution,
• comparing the first divergence with the second divergence,
• determining, in response to the comparison of the first divergence with the second divergence, that the first divergence is a first minimum divergence,
• determining that the first minimum divergence is greater than the first confidence level, and
• determining, in response to the determination that the first minimum divergence is greater than the first confidence level, that the first distribution does not correspond to the model distribution within the first confidence level;
• and
• determine that at least one of the removed minimum amount of datapoints is greater than a first threshold, wherein the first threshold comprises at least one of an absolute number of datapoints, a rate of datapoints, or a fraction of total datapoints;
• and
• generate an alert that the first plurality of web traffic includes at least one fraudulent instance of web traffic in response to the determination that the at least one of the removed minimum amount of datapoints is greater than the first threshold.