Cheating Monitoring User Guide

Cheating Monitoring User Guide #

Cheating Monitoring: Real-time monitoring of app promotion traffic using big data and specific algorithms. It combines user-defined rule strategies to identify cheating IP addresses and devices, record cheating traffic sources, and pinpoint channels at risk of fraudulent activities.

Rule Configuration #

Users can configure cheating monitoring rules in "Cheating Monitoring" – "Rule Configuration" based on their own business needs.

• Monitoring Status: Global switch for cheating monitoring feature, enabling or disabling real-time monitoring.
• Click IP Anomaly Threshold: Clicks from a single IP exceeding this threshold within a day will be marked as abnormal IP clicks and the IP will be recorded in the "Cheating Monitoring" – "Exception Statistics" as an abnormal IP. This applies only to clicks on landing pages.
• Installation IP Anomaly Threshold: Installations from a single IP exceeding this threshold within a day will be marked as abnormal IP installations, and the IP will be recorded in the "Cheating Monitoring" – "Exception Statistics" as an abnormal IP.
• Installation Device Anomaly Threshold: Installations from a single device exceeding this threshold within a day will be marked as abnormal device installations, and the device will be recorded in the "Cheating Monitoring" – "Exception Statistics" as an abnormal device.
• Click Hijacking Window Period: Determines the time window for judging whether an installation is hijacked. Installations where the time from click to activation is less than this window period will be marked as click hijacking installations and displayed in "Cheating Monitoring" – "Data Report".

Note: The above configurations will take effect within 5 minutes at the latest after saving them.

Exception Statistics #

Exception IP List and Exception Device List respectively record the IP addresses and devices that trigger the thresholds in "Rule Configuration", and provide access to view their source records.

Exception IP List #

• IP: The IP address that triggered the threshold.
• Last Triggered Time: The most recent time when the click IP anomaly threshold or installation IP anomaly threshold was triggered.
• Days of Threshold Triggering: The number of days within the query time range when the click IP anomaly threshold or installation IP anomaly threshold was triggered.
• Source Channels: The number of source channels for clicks and installations within the query time range (after deduplication).
• Clicks: Total clicks from the IP within the query time range.
• Installations: Total installations from the IP within the query time range.

Exception IP Source List:

• Date: Date (e.g., "2020-01-20")
• Source Channel: Displays the channel ID + channel name. "-" indicates non-channel, i.e., from landing pages without the channelCode parameter.
• Channel Type: "H5" indicates an H5 channel; "-" indicates non-channel.
• Click Threshold Trigger Time: Time when click threshold was triggered (e.g., "2020-01-20 19:39:01"). "Not triggered" indicates that the threshold was not exceeded.
• Installation Threshold Trigger Time: Time when installation threshold was triggered (e.g., "2020-01-20 19:39:01"). "Not triggered" indicates that the threshold was not exceeded.
• Clicks: Total clicks per day.
• Installations: Total installations per day.

Exception Device List #

• Device Identifier: Internal device identifier used by OpenInstall.
• System Type: "iOS" for Apple devices, "Android" for Android devices.
• Brand: Brand + model identifier (e.g., "Apple iPhone_XR").
• Last Triggered Time: The most recent time when the installation device anomaly threshold was triggered.
• Days of Threshold Triggering: The number of days within the query time range when the installation device anomaly threshold was triggered.
• Source Channels: The number of source channels for clicks and installations within the query time range (after deduplication).
• Total installations from the device within the query time range.

Exception Device Source List:

• Date: Date (e.g., "2020-01-20")
• Source Channel: Displays the channel ID + channel name. "-" indicates non-channel, i.e., from landing pages without the channelCode parameter.
• Channel Type: "H5" indicates an H5 channel; "-" indicates non-channel.
• Installation Threshold Trigger Time: Time when installation threshold was triggered (e.g., "2020-01-20 19:39:01"). "Not triggered" indicates that the threshold was not exceeded.
• Installations: Total installations per day.

Data Report #

The data report displays cheating volume for each channel, including H5 channels.

• Clicks: Total clicks for the channel.
• Abnormal IP Clicks: Clicks exceeding the click IP anomaly threshold configured in "Cheating Monitoring" – "Rule Configuration".
• Installations: Total installations for the channel.
• Abnormal IP Installations: Installations exceeding the installation IP anomaly threshold configured in "Cheating Monitoring" – "Rule Configuration".
• Abnormal Device Installations: Installations exceeding the installation device anomaly threshold configured in "Cheating Monitoring" – "Rule Configuration".
• Click Hijacking Installations: Installations where the time from click to installation is less than the click hijacking window period configured in "Cheating Monitoring" – "Rule Configuration".

Chart Analysis #

MTTI (Mean Time to Install) represents the average time of installation.

Overall MTTI Distribution #

The distribution of time from click to installation is presented in 5 dimensions and 22 time intervals for the overall MTTI distribution. Users can combine their own business characteristics and MTTI distribution to assess whether there is a risk of click hijacking in app promotion.

Statistical Dimensions：

• H5 Channel Landing Page: Installations from H5 landing pages with the channelCode parameter.
• H5 Landing Page: Installations from all H5 landing pages, including those with and without the channelCode parameter.
• App: Total installations from all sources mentioned above.

Channel MTTI Distribution #

Display the MTTI distribution for each channel to assess the risk of click hijacking. Support selecting up to 5 channels for comparison of MTTI distribution proportions. For detailed explanation of the charts, refer to the "Overall MTTI Distribution".

Click Hijacking Analysis #

Display the proportion of non-click hijacking installations and click hijacking installations for each channel. Combine this with the MTTI distribution chart for each channel to assess the risk of click hijacking behavior in each channel.