System and method for detecting fraudulent activity on client devices

A system, comprising:

• one or more computer processors programmed to perform operations comprising:
• obtaining a stream of data comprising a record of clicks by users on a plurality of user client devices;
• aggregating the stream of data by user client device to generate a batch click stream for each of the user client devices;
• processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the user client devices was previously associated with fraudulent clicks;
• processing the batch click stream for each user client device using a batch anomaly detector to detect a second anomaly indicating that at least one of the batch click streams comprises fraudulent clicks;
• and
• facilitating an adjustment of content presentations on the user client devices, based on at least one of the detected first anomaly and the detected second anomaly.

An article, comprising:

• a non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the computer processors to perform operations comprising:
• obtaining a stream of data comprising a record of clicks by users on a plurality of user client devices;
• aggregating the stream of data by user client device to generate a batch click stream for each of the user client devices;
• processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the user client devices was previously associated with fraudulent clicks;
• processing the batch click stream for each user client device using a batch anomaly detector to detect a second anomaly indicating that at least one of the batch click streams comprises fraudulent clicks;
• and
• facilitating an adjustment of content presentations on the user client devices, based on at least one of the detected first anomaly and the detected second anomaly.