DE102011009358A1 - A method for detecting improper ad redirection on the Internet - Google Patents

Abstract

The invention relates to a method for recognizing the authenticity of an original advertisement (1) in a result list of an Internet search engine. For this purpose, the URL (11; 11T) of an original advertisement (1) is provided with a forgery-proof parameter (111), preferably a digital signature. This URL (11T) provided with the parameter (111) is compared with the URL (12; 12T) of an advertisement (2) in a result list, controlled by a program, either individually or at intervals by querying a search term. If the parameter (111) is missing in the URL (12; 12T), the ad (2) is assigned to an ad hijacker (AH) and its URL (12; 12T) is stored in a memory location of a hijacking protocol (HP).

Description

The invention relates to a method for detecting ad-hijacking on the Internet according to the preamble of patent claim 1 and to a digital computer configured to carry out this method.

When an Internet user, as a potential customer for a specific product, enters a search term or familiar name for a product in the search window of a search engine and activates the search, the search engine will display ads for its search term ("AdWord") were, these ads. The advertisements of the various advertising entrepreneurs are delivered to the top positions of the result list, usually at the top and / or the right edge of the screen. In order to generate as much coverage as possible, many advertising companies assign "sub-licenses" to so-called "affiliates". An affiliate is a sales agent who acts between the end user looking for the product and the advertising company of the product being sought. The affiliate, as well as the advertising entrepreneur, secures the desired top position in the result list when calling up a certain search term ("keyword") by means of his advertisement paid to the search engine operator. The principle is that the position of the highest paying is the best. The legally acting affiliate receives at the conclusion of a purchase contract concluded on his advertising page from the provider of the product sought a not inconsiderable commission.

Many companies that offer affiliate programs underestimate the risk of ad hijacking. By "ad hijacking", a professional understands hijacking and redirects AdWords ads to a URL of an illegally acting affiliate. In ad-hijacking, an illegally acting affiliate - the ad hijacker - copies the advertisement of the advertising entrepreneur or a legally acting affiliate and outperforms the offered click price, thereby exchanging the original advertisement. For this it is sufficient if he offers the search engine operator even one cent more than the operator of the original ad. Since all these processes are handled automatically by computers, so far there is hardly any possibility of control for the search engine operator.

If an internet user now clicks on the abducted ad, he will be redirected via a microsite to the original landing page of the trademark owner or product provider (hereinafter referred to as "the original company"). This process takes only fractions of a second, so that the user ultimately does not notice. On the microsite, the illegally acting affiliate places one or more cookies on the user. For the sales that arise in the future about this user, the illegally acting affiliate collects a commission. To stay undetected, the illegally acting affiliate often only serves the ads at times when he assumes that no one notices the theft, eg. At night. Often, ads will only appear in certain regions that are outside the headquarters of the stolen original company. The above problem is, for example, in the Internet article http://www.stateofsearch.com/brand-bidding-ad-hijacking-part-1/ described by Evert Veldhuijsen.

In addition to high financial costs and Internet traffic losses, ad hijacking can also lead to irreparable image losses should the user be led over dubious or disreputable sites.

The estimated levels of financial losses are those at the Internet address http://www.sem-scout.de/adhijacking_studie.php published study.

The fraudulent hijacking of AdWords ads is no longer a marginal phenomenon in search engine marketing but is operated by resourceful affiliates in a big way.

The invention has for its object to provide a computer-aided method by means of the ad-hijacking attacks can be detected easily and reliably.

This object is solved by the features of patent claim 1. Advantageous embodiments of the invention are specified in the dependent claims.

The method according to the invention with the abbreviated designation "ADIFF" = "Ad Detection and Identification of Friend and Foe" enables automated recognition and identification of illegally copied and provided with a URL leading to an illegal affiliate URL. This allows a quick recognition of "friend and foe" among the advertisements on a search engine on the Internet.

ADIFF provides digital signatures for paid search advertising to uniquely identify the publisher's authenticity (advertiser). Thus, fraud cases ("ad hijacking") by illegally acting affiliates ("ad hijackers") can be reliably identified and documented.

By adding a digitally encrypted signature or hash code to the tracking URL of the original display, the URL of the original display becomes clearly recognizable and can be distinguished from the tracking URL of a copied page by an automated, program-controlled comparison. The program also allows documentation of the abuse by collecting and storing the redirect information (redirect chain) of an identified illegally copied and redirected ad and making it available to the operator of the legal ad site for immediate prosecution.

The encryption method used is preferably one of the customary methods, in particular an AES, a DSA, a 3DES or an RSA encryption or a hash generated by means of the MD5 method or the SHA1, the SHA32 or the RIPE MD-160 method. Code of the original display selected. In this case, however, any prior art encryption or hash code method or even a self-created signature method may be used.

The invention will be explained in more detail with reference to an embodiment with reference to the drawings. It shows:

1 a schematic representation of a normal order history based on a partial screen view of a search engine;

2 a schematic representation of an order history with an illegal ad redirection based on a partial screen view of a search engine;

3 a schematic representation of a supplemented by a signature tracking URL according to the ADIFF method according to the invention;

4 a schematic representation of an illegal ad redirection based on a partial screen view of a search engine with an analysis of the redirecting path;

5 a schematic representation of the adjustment according to the invention in an original display based on a screen view of the test program ADIFF;

6 a schematic representation of the adjustment according to the invention in an illegally copied display based on a screen view of the test program ADIFF; and

7 a flowchart to illustrate the essential steps of the method ADIFF according to the invention.

In 1 is the normal booking history of a purchase on the Internet shown. The consumer goes via an Internet browser on the side of an Internet search engine, in this case on the side of Google ^® , and there in the search window a brand term or search term.

The Internet search engine, which is usually free for the consumer, has advertisers of all kinds as customers. These are either the original companies that own the trademark in question, which usually advertise their core areas and the common search terms used for their branded products, or by themselves the original companies for certain margins of the possible search term spectrum contractually legitimated affiliates. The original companies use the affiliates to generate as much coverage as possible. Affiliates are thus sales agents who are self-employed to place ads themselves on the search engine, offering the products or services of the original company, and then redirecting potential customers to the original advertising company. The sales agents operate rather outlandish keywords or "tapped", and forward inquiries under these terms also to the original company, so that it also benefits from the edge segments. The original companies and the affiliates use a bidding process to display ads for individual search terms at the search engine operator, whereby the highest bid always places the relevant advertisement in the most prominent position of the generated result list.

An original company and an affiliate pay the Internet search engine operator a certain amount of money to display the highlighted space when they call a specific keyword ("keyword"), usually at the top or in a separate right-hand column - receives the result list output based on the search term.

An affiliate, in turn, has a direct or indirect distribution agreement with the advertiser's original company. Direct contracts are concluded between the affiliate and the original company directly, indirect contracts require a contract on a third party, eg. Via an affiliate network. An affiliate network acts as a concentrator (multiplier) and bundles a large number of affiliates. In this case, the original company only has the affiliate network as contact person. The original company is manufacturer or distributor of the sought after Product or service (in 1 Called "entrepreneur"). When the term "product" is used in a simplified manner, it should also include services.

The Distribution Agreement authorizes the Affiliate, as an Authorized Distributor, to promote its products using or excluding the original brand (s). For all consumer orders received through the intermediary of the affiliate to the original company, the affiliate receives a sales commission from the manufacturer or distributor of the product, which, depending on the product, accounts for a not inconsiderable portion of the sale price, which can go up to approximately 30%. To identify the affiliate, and to document the sales claim, a "cookie" is created on the side of the affiliate. With the help of this cookie, it is possible for the original company to clearly identify the respective affiliate and to guarantee the commission claim.

In 2 is now the now quite common case of ad hijacking, the illegal copying of Internet ads and the redirection of incoming via these ads consumer requests through an address of the ad hijacker (AH) to the original company of the product sought. The Ad Hijacker (AH) illegally makes a 1: 1 copy of the original ad for this purpose 1 an original company or a legally operating affiliate 1 The Internet search engine operator pays only 1 cent more than the owner of the original ad for a given search term ("keyword") 1 and thereby sets this copied display 2 instead of the original display in the result list. According to a ruling by the European Court of Justice, the operator of the Internet search engine is not obliged to identify or prevent such abuse on its own initiative, even if brand names are used by unauthorized persons or companies.

The ad hijacker (AH) now redirects with a different URL 12 an access to the fake ad 2 via a separate microsite on the landing page of the original company. The illegal ad hijacker (AH) sets one or more cookies on the user. For the completed sales contracts that are now created via this Internet user as a consumer, the illegally acting ad hijacker (AH) collects the commission of the original company, which delivers the product to the consumer. The original company switching the original ad makes the sale, but has to pay a commission that would not have been due if its ad had not been abducted. Since brand clauses (brand terms) have a CTR of between 50% and 70% (compared to 3% -10% for generic terms), ad hijackers (AH) focus mainly on these terms.

In 3 is the difference between the display URL perceived by the internet user 11 and the tracking URL behind it 11T as well as the nomenclature of an exemplary signature 111 the tracking URL 11T represented with their significant start markers and end markers. The signature consisting of the twelve characters "5481142d7a82" in the example 111 the tracking URL 11T is initiated by the start marker "& adiff = ate" and completed by the end marker "am". Instead of a start marker, any unique separator can be used.

In 4 is shown as in the case of ad hijacking by a redirect chain ("redirect chain") a copied display 12 redirected by the ad hijacker to the original company's landing page via a different path.

In 5 is the application of the ADIFF method according to the invention as a screen for checking an original display 1 shown. In the upper part of the 5 is the display URL 11 the original ad 1 shown. The display URL 11 an original display to be monitored 1 shall be included in a list L111 of the service provider offering the ADIFF procedure or the original enterprise applying the ADIFF procedure. The tracking URL URL 11T this display URL 11 will in the next step by means of a signature 111 (according to any signature method) encrypted and sent to the tracking URL 11T the original ad 1 attached. The result, the new overall URL (URL 11T + Signature 111 ) of the original ad 1 is in the middle part of the 4 shown.

For checking the authenticity of an (AdWord) ad displayed on an Internet search engine 2 will now be their tracking URL 12T with the result (URL 11T + Signature 111 ) compared. It is in the in 5 in the lower part case an identity between the URL 12T and the result (URL 11T + Signature 111 ) detected. As a result, it can be clearly established that the reviewed display 2 around the original ad 1 is.

In 6 is analogous to 5 the other case shown, in which by means of the ADIFF method according to the invention a hijacked display 2 is identified. The tracking URL 11T in the upper part of the 6 displayed URL 11 the original ad 1 will - as already related to 5 explained - with the to the tracking URL 11T attached signature 111 Mistake. The result is in the middle part of the 6 shown. In the Checking an ad 2 will now be validated by their tracking URL 12T found a deviation. This clearly states that it is the reviewed ad 2 not the original 1 but that is the ad 1 copied and abducted here by an ad hijacker (AH).

In this case, the abuse of ad hijacking is fully documented by the ADIFF procedure. This will be the tracking URL 12T the kidnapped ad 2 stored in a hijacking protocol (HP). Also saved is the redirect path. In addition, the inputted search words and the displayed result list are stored in a data storage area D1, the latter preferably as a copy of the accessed pages or as a "screenshot". The URL 12 is called in a further method step and the displayed screen pages are stored in a data storage area D2. All stored data and documents will be stamped with a unique date and time stamp and sent to the owner of the original advertisement as a report or made available for collection in a retrievable area.

The automatically tracked by means of the ADIFF method according to the invention, stored in the hijacking protocol (HP) and the operator of the original display optionally automatically sent as report abuse cases can now be tracked immediately by its legal department.

The sequence of the ADIFF method according to the invention, which automatically runs on a digital computer (not shown), is shown in the flow diagram 7 represented in its essential process steps. After starting the ADIFF program on a digital computer, the latter first reads the display URL in a first method step S1 11 an original display to be checked 1 from list L111.

In a second method step S2 now becomes a digital signature 111 the tracking URL 11T the original display to be checked 1 generated. The digital signature 111 is in the third step S3 to the tracking URL 11T attached, creating one for the original ad 1 original, counterfeit-proof overall URL 11T + 111 arises. As a method for generating the unique forgery-proof signature 111 In the second method step S2, any commercially available signature method is suitable, for example an AES, a DSA, a 3DES or an RSA encryption or a method defined by the MD5 method or the SHA1, the SHA32 or the RIPE-MD-160. Method generated hash code or a self-developed signature method. The signature 111 is generated once for each customer (original company), stored in a memory and is generated every time the counterfeit-proof overall URL is created 11T + 111 for the original ads 1 used by this customer.

In a fourth method step S4, a search term is then selected by means of the ADIFF program from a list of search terms stored in the digital computer, which usually lead a customer to the original display, and entered into a search window of an Internet search engine, such as ^Google® . From the output result list now in the fifth step S5 the paid advertisements 2 checked by their display URL 12 and their tracking URL 12T in a sixth method step S6 are first read by the digital computer using the ADIFF program.

In a seventh method step S7, the ADIFF program now checks whether the display URL 12 the advertisement to be tested 2 as a subset in the overall URL 11T + 111 the original ad 1 is included. If this is not the case, then the path optionally goes through a in a right part of the 7 arranged time loop after passing through a certain time interval I in the method steps S15 and S16 back before the fourth method step S4 for selecting and entering the same or another search term. The verified advertisement 2 In this case obviously has nothing at all with the original advertisement 1 to do. In this case, the ADIFF program may be the next one of the displays displayed in the result list 2 to undergo the same test.

The time interval I or several possible time intervals I ₁ -I _n can be arbitrarily increased or reduced by varying a variable in the ADIFF program period .DELTA.t in step S16. In this case, a random number generator may preferably be used in order to prevent an ad hijacker being able to adjust to certain checking intervals. Likewise, the start time and the termination of the ADIFF method may preferably be stored as parameters in the program or selected on the basis of an evaluation of the determined times for established ad hijacking according to statistical methods and also modified according to a changed ad hijacking behavior.

In the seventh method step S7, it is determined that the display URL 12 as a subset in the overall URL 11T + 111 the original ad 1 is included, it is clear that it is either the original display 1 yourself or a hijacked copy of the same.

In the following eighth step S8 is now checked, whether the tracking URL 12T contains a signature. This can be done, for example An examination will be made as to whether or not the tracking URL 12T as partial string the start mark and the end mark of the signature 111 are included. If this is not the case, it is already clear that the display 2 is a kidnapped ad, so it's a case of ad hijacking. The corresponding path in the flowchart therefore bypasses the following query diamond on the left, starting from the second diamond, and proceeds to step S10 to log the ad hijacking incident. Instead of the start and end mark can also be another unique delimiter as significant for the presence of one in the tracking URL 12T existing signature 112 be used in the test in step S8.

If the presence of a signature is determined in the eighth method step S8, it is checked in the following ninth method step S9 whether the signature contained between the start marker and the end marker 112 the checked advertisement 2 the signature 111 the original ad 1 equivalent. If so, it is the original display 1 , In this case, the program branches again optionally via the time loop (S15 / S16) or directly back to the search word query before the fourth method step S4 or alternatively to check the next displayed paid display in the result list already generated.

Is found in the ninth step S9 that the signature 112 the URL 12T the checked advertisement 2 not the signature 111 the original ad 1 corresponds, it is clear that the display 2 is a hijacked ad. In this case, their URL 12 respectively. 12T stored in a memory area of the digital computer in method step S10 in a hijacking protocol (HP). Furthermore, in the method step S11, the result list is stored-for example as a screenshot-in a data memory D1 of the digital computer.

In a next method step S12, the URL 12T the kidnapped ad 2 called and the pages displayed here are stored in step S13 in a data memory D2 of the digital computer.

The search terms used, the saved result list, the URL 12 and the pages behind it are provided with a unique date and time stamp of the time of the check, and the entire data packet is automatically sent to the holder of the original legal abuse notice in step S14, or at certain intervals, as a report or for retrieval thereof provided in a storage area.

The inspection process according to the in 7 only in the essential steps schematically illustrated ADIFF process according to the invention has in the 7 an end mark. Immediately above it is indicated by a dashed path, which leads back into the sequence before the fourth step, that it is a continuous test process. After detecting and logging a hijacking incident, the program is not terminated, but of course continued to identify and capture further hijacking incidents for the same or other original ads. For the original company, a largely complete record of the hijacking incidents is thus created so that the total amount of damage incurred can be reliably determined from the sum of all individual cases or at least statistically extrapolated.

All process steps of the ADIFF process are automatically executed by a program on a digital computer. If the above is simply spoken by a digital computer and its memory areas, it is understood by those skilled in the art that the individual steps are also executable on different networked computers and that the memory areas are also formed by external, outside the digital computer or the digital computer arranged storage media can. The memory areas used for logging an ad hijacking could, for example, also lie directly on a computer of the operator of the original display. The ADIFF procedure can be used by itself or by a specialized service provider such as Xamine GmbH in Munich.

LIST OF REFERENCE NUMBERS

1

Original display

11

(Display) URL (from 1 )

11T

(Tracking) URL (from 1 )

111

Signature (from 11T )

2

(to be tested) display

12

URL (from 2 )

12T

(Tracking) URL (from 2 )

112

Signature (from 12T )

S1-S16

steps

HP

Storage space for hijacking protocol

D1

first documentation memory

D2

second documentation memory

I ₁ -I _n

polling intervals

.delta.t

(variable) time interval for polling intervals

AH

Ad hijacker (initiator of 2 and 12 )

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• http://www.stateofsearch.com/brand-bidding-ad-hijacking-part-1/ [0004]
• http://www.sem-scout.de/adhijacking_studie.php [0006]

Claims (11)

Method for automatically detecting the authenticity of an original display ( 1 ) in a result list of an Internet search engine using at least one digital computer, characterized in that the URL ( 11 ; 11T ) of the original display ( 1 ) is stored in a list (L111) that the URL ( 11 ; 11T ) of the original display ( 1 ) with a forgery-proof parameter ( 111 ) that the digital computer is controlled by a program once or repeatedly using at least one time interval (I; I ₁ , I ₂ , I ₃ , I _n ) by an automated query of at least one search term (brand name or adword) on the Search page of an Internet search engine generates a result list that the digital computer controlled by the program URL ( 12 ; 12T ) at least one display in the result list and to check its authenticity ( 2 ) reads that the program by comparing the URL ( 12 ; 12T ) of the advertisement to be checked ( 2 ) with the counterfeit-proof parameter ( 111 ) supplemented URL ( 11T ) of the original display ( 1 ) determines if the URL ( 11 ) of the original display ( 1 ) in the URL ( 12 ) of the advertisement under review (CONDITION 1 ) and if the URL ( 12T ) of the advertisement to be checked, the counterfeit-proof parameter ( 111 ) (CONDITION 2 ), whereby upon fulfillment of the CONDITION 1 AND ABSENCE OF CONDITION 2 the URL ( 12 ; 12T ) of the ad ( 2 ) is assigned to an ad hijacker (AH) and stored in a storage space of a hijacking protocol (HP). Method according to claim 1, characterized in that a tracking URL ( 11T ) of the original display ( 1 ) with the forgery-proof parameter ( 111 ). Method according to claim 2, characterized in that the forgery-proof parameter ( 111 ) of an encrypted signature ( 111 ) the tracking URL ( 11T ) of the original display ( 1 ) is formed. Method according to claim 3, characterized in that the signature ( 111 ) according to an encryption method, such as the AES, DSA or RSA method or other methods according to the prior art. Method according to claim 3, characterized in that the signature ( 111 ) according to a hash code method such as the MD5 or SHA32 method or other prior art hash code methods. Method according to at least one of the preceding claims, characterized in that the displayed result list is stored in a first documentation memory (D1) of the digital computer. Method according to at least one of the preceding claims, characterized in that, upon detection of an ad hijacking incident, the tracking URL ( 12T ) of the advertisement to be checked ( 2 ) is called by the program and the displayed pages are stored in another documentation memory (D2) of the digital computer. Method according to at least one of the preceding claims, characterized in that the hijacking protocol (HP) and / or the documentation memory (D1, D2) are provided with a date and time code. Method according to one of the preceding claims, characterized in that the at least one interval (I) for the automated retrieval of the at least one search term can be input by an operator of the digital computer and modifiable by modifying a value (Δt) and / or as one of a plurality of intervals (I ₁ , I ₂ , I ₃ , I _n ) is selected by the digital computer according to the specifications of a program. Method according to claim 9, characterized in that the at least one interval (I) is selected by means of a random generator among the intervals (I ₁ , I ₂ , I ₃ , I _n ) or by means of a program controlled modification of a value (Δt) by means of a random number generator is changed. Digital computer, which is set up by means of a program for executing a method according to at least one of the preceding claims.

Images