Naked Security Naked Security

Google’s charging for YouTube ads it knows are from bots, researchers say

Google charges advertisers for YouTube ad views in spite of correctly spotting them as being fake views generated by bots - no human eyeballs involved - a group of European researchers have claimed.

shutterstock_293731811

Google charges advertisers for YouTube ad views in spite of correctly spotting them as being fake views generated by bots – no human eyeballs involved – a group of European researchers have claimed.

The researchers behind the study came to the conclusion that Google does a good job at weeding out bogus YouTube video views and removing them from the public view counter, but it still monetizes nearly all of them, leaving advertisers stuck paying inflated bills for views they never really got.

They ran an experiment in which they uploaded videos to five major online video portals, including YouTube, whose detection system “significantly outperformed” the other portals, the researchers said.

Then they purchased adverts targeting the videos. Next, they created their own bots to automatically “view” the videos and try to run up the ad view totals.

The researchers – from NEC Labs Europe, Charles III University of Madrid, the IMDEA Networks Institute and the Polytechnic University of Turin – found that YouTube monetizes “(almost) all the fake views we generated.”

We find that the monetized view counter’s detection mechanism penalizes a negligible portion of [bot-generated, fake] views in all the considered configurations… while the public view counter’s detection mechanism penalizes most of the fake views.

These results confirm [our] preliminary observation… that YouTube applies different penalization schemes to the fake views in the monetized and public view counter, with the former being much more permissive than the latter.

The researchers described how their bots “viewed” two particular videos 150 times.

YouTube’s public view-counter system listed only 25 of those bogus views, discounting the remaining 125 views after correctly interpreting them as fake.

But they noted that Google’s Adwords ad platform billed them for 91 of the bot visits.

Thus, Google’s advertising engine billed the researchers for the bot visits that had been correctly identified as fake by YouTube’s fraud-detection systems.

The researchers’ tools were not, mind you, souped-up, hard-to-detect bots, according to lead researcher Rubén Cuevas, an assistant professor at Universidad Carlos III de Madrid:

It's not like we found a weird corner-case vulnerability. Anyone with a little knowledge of coding could do this kind of thing.

Getting accurate counts on page views is an important goal in the big-bucks business of online advertising, which, the International Advertisement Bureau has reported, generated $49 billion (about £32 billion) in 2014.

YouTube accounts for a big chunk of that: surveys have found that 93% of online marketers are using video to advertise their products, and 65% used YouTube specifically.

The researchers note that with those kind of numbers, it’s hardly surprising that online advertising attracts fraud, citing current estimates indicating that up to a third of ad impressions are fraudulent – a level that leads to billions of dollars worth of losses to advertisers.

Google told Financial Times that it would contact the researchers to discuss their experiment and its findings.

The company said it takes falsified traffic “very seriously”:

We take invalid traffic very seriously and have invested significantly in the technology and team that keep this out of our systems. The vast majority of invalid traffic is filtered from our systems before advertisers are ever charged.

Image of YouTube logo courtesy of Alexey Boldin / Shutterstock.com