Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method can include: obtaining a stream of data including a record of clicks on a plurality of client devices; aggregating the stream of data to generate a batch click stream for each of the client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the client devices was previously associated with fraudulent clicks; processing each batch click stream using a batch anomaly detector to detect a second anomaly indicating that at least one of the batch click streams includes fraudulent clicks; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.

Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method includes: obtaining a stream of data including a record of software installations on a plurality of client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that a client device was previously associated with fraudulent software installation activity; aggregating the stream of data to generate a batch record of software installations for each publisher from a plurality of content publishers; processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.

Abstract: A method, a system, and an article are provided for managing content presentations on a plurality of client devices. An example computer-implemented method includes: obtaining data including a record of the content presentations; aggregating the data to generate a history of content presentations for each client device; providing the history of content presentations for each client device to a plurality of weighting algorithms configured to calculate weights for the content presentations; combining the weights from each weighting algorithm for each client device; attributing, based on the combined weights for each client device, a user action taken on the client device to at least one of the content presentations; and facilitating an adjustment of future content presentations based on the attribution.

Abstract: A method, a system, and an article are provided for inferring the identifies of publishers of online digital content. An example method can include: obtaining data including a history of content presentations by a plurality of publishers on a plurality of client devices, the data providing an unambiguous identification of each publisher in a first portion of the publishers and an anonymous identification of each publisher in a second portion of the publishers; identifying a pair of publishers including a first publisher from the first portion and a second publisher from the second portion; calculating, based on the data, a similarity metric for the pair of publishers; and based on the calculated similarity metric, facilitating an adjustment of content presentations by the plurality of publishers.

Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method includes: obtaining a stream of data including a record of software installations on a plurality of client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that a client device was previously associated with fraudulent software installation activity; aggregating the stream of data to generate a batch record of software installations for each publisher from a plurality of content publishers; processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.

Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method can include: obtaining data including a history of content presentations by a plurality of publishers on a plurality of client devices; calculating a plurality of performance indicators for each publisher based on the data, the performance indicators providing a measure of user interactions with the content presented by the publisher; generating a time history of each performance indicator for each of a plurality of time periods; selecting, for each time history, at least one anomaly detector from a plurality of anomaly detectors; detecting an anomaly in at least one time history using the selected at least one anomaly detector; and based on the detected anomaly, facilitating an adjustment of content presentations by the plurality of publishers.

Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method can include: obtaining a stream of data including a record of clicks on a plurality of client devices; aggregating the stream of data to generate a batch click stream for each of the client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that at least one of the client devices was previously associated with fraudulent clicks; processing each batch click stream using a batch anomaly detector to detect a second anomaly indicating that at least one of the batch click streams includes fraudulent clicks; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.