Invalid Traffic Detection for Video Ads: Finding Bots That Watch Videos
How video ad fraud works — viewability spoofing, SSAI measurement exploitation, playback farms — and the signals that separate human viewers from fake impressions.
Video commands the highest CPMs in digital advertising, which makes video impressions the highest-value fraud target. The schemes have evolved well past simple click bots — modern invalid traffic (IVT) operations simulate entire viewing sessions, complete with mouse movement, scroll depth, and plausible watch durations.
The Fraud Patterns That Matter for Video
| Fraud Pattern | Mechanism | Primary Detection Signal |
|---|---|---|
| Autoplay stuffing | Hidden/muted players rack up impressions | Zero engagement + consistent viewport geometry |
| Playback farms | Real devices on racks looping streams | Clustered device fingerprints + session uniformity |
| SSAI beacon spoofing | Fake ad-quartile beacons fired server-side | Beacon-to-playback timing correlation |
| Viewability laundering | Ads rendered in 1×1px or occluded players | IntersectionObserver geometry + pixel-diff checks |
Why Video Fraud Is Harder to Catch Than Display
A display ad impression is a single request — easy to fingerprint. A video ad impression is a sequence: manifest fetch, segment requests, quartile beacons (start/first-quartile/midpoint/third/complete), all spread over 15–30 seconds. Fraud that replays plausible sequences with correct timing deltas survives naive signature checks.
Detection therefore has to correlate cross-event entropy:
- Segment request cadence: humans buffer ahead in bursts; bots fetch on robotic fixed intervals.
- Quartile beacon jitter: real players fire beacons within ±50ms of true media position; scripted beacons arrive at suspiciously exact intervals.
- Post-ad behavior: humans seek, pause, or continue to content; playback-farm sessions often terminate at the ad boundary or restart identically.
// Heuristic: beacon timing entropy check
function beaconLooksScripted(quartileDeltas: number[]): boolean {
// Human playback has natural variance; scripted replays cluster near-zero stdev
const mean = quartileDeltas.reduce((a, b) => a + b) / quartileDeltas.length;
const variance = quartileDeltas.reduce((a, b) => a + (b - mean) ** 2, 0) / quartileDeltas.length;
return Math.sqrt(variance) < 8; // <8ms jitter across quartiles is non-human
}
“The tell is never any single signal — it’s impossible consistency. Humans are messy; fraud that imitates humans too perfectly gives itself away.”
Defense-in-Depth for Platform Operators
- Measure at the edge: collect playback telemetry server-side, where it can’t be tampered with by the client.
- Rate new traffic sources slowly: a sudden surge of “high-CPM” geos with identical session shapes is a farm, not growth.
- Reconcile measurement: cross-validate your own beacon counts against advertiser-side verification vendors; persistent gaps indicate spoofed quartiles.
Detailed detection schemas and thresholds from production deployments are in our video ad fraud detection field guide.