Ad Fraud Detection and Risk Control Practices at Alibaba Mama

1. Advertising Risk‑Control Process

Alibaba Mama, the digital marketing platform of Alibaba Group, processes billions of yuan in ad spend each year. About 8.6% of the 2020 Chinese internet ad market was identified as abnormal traffic, which attracts malicious actors. The risk‑control team’s core task is to identify and filter cheating or low‑quality traffic to protect advertisers and the platform.

2. Invalid Traffic

The anti‑fraud system focuses on cleaning and filtering invalid traffic, which is not identical to cheating traffic. Invalid traffic is divided into two layers:

Low‑quality traffic : repeated‑click billing, frequency‑control, volatile‑traffic strategies, etc.

Cheating traffic : traffic with a conversion‑probability of zero (e.g., bot clicks).

Cheating traffic always has zero conversion probability, but zero frequency does not necessarily mean cheating. Common invalid‑traffic scenarios include:

Consuming competitors’ budgets.

Boosting one’s own ad ranking through black‑market click farms.

Accidental damage to ads caused by “natural” product‑order brushing.

Non‑malicious invalid traffic such as pre‑loading links or crawler‑generated clicks.

2.5 Taobao Affiliate (Taoke) Transaction Fraud

Two main fraud patterns are identified under CPA billing:

Traffic hijacking : altering the source of traffic or modifying user‑jump links to steal conversions.

Black‑gray‑market affiliate acquisition : creating fake delivery addresses to earn commission on low‑cost orders.

3. Algorithmic Practice

3.1 Perception

The previous case‑driven system was reactive. A proactive perception layer now captures data that deviate from normal distributions, generating an anomaly list. Perception aims to recall all “abnormal” traffic, not only known cheats, e.g., a sudden surge in helmet‑shop clicks caused by policy changes.

3.2 Insight

After perception, analysts perform insight analysis to separate genuine risk from benign anomalies. Traditional insight relied on manual feature selection; the new approach uses high‑dimensional visual analytics, sub‑space projection, and temporal distribution comparison to discover unknown fraud patterns.

3.3 Disposition

Disposition applies different mitigation actions based on risk type. For traffic fraud, a dual‑layer filtering system is deployed:

Real‑time streaming filter : combines unsupervised, semi‑supervised feature engineering with supervised ensemble anomaly detectors.

Hourly batch filter : uses richer features and more complex models to refine the real‑time results.

Affiliate fraud is handled by freezing commissions, collecting evidence, and applying tiered penalties based on estimated commission and abnormal features.

3.4 Evaluation

The system is evaluated on four metrics: online supervised precision and recall, offline unsupervised precision and recall. Because ground truth is scarce, an offline unsupervised sample pool is built to serve as a proxy for supervised evaluation. Metrics such as AUC, KS, and MAX‑F1 are reported, with special attention to distinguishing simple from advanced cheats.

4. Summary

High‑dimensional anomaly detection, large‑scale graph learning, model interpretability, and data visualization are key research directions. Advertising risk control demands the highest standards of algorithm robustness, precision, scalability, and timeliness, turning cutting‑edge AI research into industrial‑grade solutions.