Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method includes: obtaining a stream of data including a record of software installations on a plurality of client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that a client device was previously associated with fraudulent software installation activity; aggregating the stream of data to generate a batch record of software installations for each publisher from a plurality of content publishers; processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.

Abstract: Detecting and managing fraud in an online system is described. An example computer-implemented method can include obtaining a plurality of signals. Each of the signals may be purported to have been generated by a different client device. The method also includes calculating a summary value for the obtained signals that indicates a measure of similarity between the obtained signals and an expected distribution of signals. The method also includes determining that the summary value represents a statistically significant deviation of the obtained signals from the expected distribution of signals. The method also includes labeling the obtained signals as fraudulently generated based on the statistically significant deviation.

Abstract: A method, a system, and an article are provided for detecting and managing anomalies associated with content presentations. An example computer-implemented method includes: obtaining a stream of data including a record of software installations on a plurality of client devices; processing the stream of data using a real-time anomaly detector to detect a first anomaly indicating that a client device was previously associated with fraudulent software installation activity; aggregating the stream of data to generate a batch record of software installations for each publisher from a plurality of content publishers; processing each batch record of software installations using a batch anomaly detector to detect a second anomaly indicating that at least one of the publishers is associated with fraudulent software installation activity; and facilitating an adjustment of content presentations on the client devices, based on at least one of the detected first anomaly and the detected second anomaly.