System and method for detecting fraudulent software installation activity

A system, comprising:

• one or more computer processors programmed to perform operations comprising:
• obtaining a stream of data comprising a record of software installations on a plurality of client devices, at least a portion of the software installations having been derived from user exposure to content provided on the client devices by a plurality of publishers;
• processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the client devices was previously associated with fraudulent software installation activity;
• aggregating the stream of data to generate a batch record of software installations for each publisher in the plurality of publishers;
• processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity;
• and
• facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.

An article, comprising:

• a non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the computer processors to perform operations comprising:
• obtaining a stream of data comprising a record of software installations on a plurality of client devices, at least a portion of the software installations having been derived from user exposure to content provided on the client devices by a plurality of publishers;
• processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the client devices was previously associated with fraudulent software installation activity;
• aggregating the stream of data to generate a batch record of software installations for each publisher in the plurality of publishers;
• processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity;
• and
• facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.