December 23, 2016

Bringing Context to This Week’s Methbot News

Timur Yarnall Timur Yarnall
SVP of Corporate Development

Fighting botnets in a cross-platform world

As part of comScore’s commitment to bringing quality measurement to the cross-platform world, we are working hard to help clients and the industry bridge the gaps that divide digital and TV. One such gap lies in digital ad verification – knowing that issues of viewability and fraud, which are foreign to the TV landscape, can at times plague digital advertisers. As we strive to shape a future where ad measurement is comparable across platforms, it is important that we stay ahead of the issues that occur in digital, but it is equally important to properly contextualize these issues as we evaluate them. This week’s news of the Methbot scheme is a prime example of a digital threat that must be taken seriously, but must also come with proper background. This is what compelled me to write this post.

When news about Methbot broke this week, it understandably sent waves of concern and confusion through the industry. However, while headlines suggest this is a major new phenomenon that has gone unnoticed by third-party measurement providers, that is not the case. To help contextualize this news, I offer three points to keep in mind when thinking about Methbot:

  1. Methbot is neither new nor entirely unique, and schemes such as this can (and should) be caught and filtered in audience and advertising measurement with proper sophisticated invalid traffic (SIVT) filtration methods.  In fact, this Methbot botnet leverages a flavor of domain laundering – an advanced form of IVT that comScore and other verification providers first identified as a threat to the industry in 2014 and has been a leader in detecting ever since. At a thousand machines, Methbot is orders of magnitude smaller than many of the other botnets we have our eye on and filter as part of our MRC-accredited SIVT filtration practices, and we’ve long been aware that certain botnets leverage datacenters to impersonate user traffic instead of using malware-infected personal computers. At comScore, our technology was designed to leverage a variety of unique data assets and detection techniques, including our human panel and comprehensive census network, for early identification of a wide variety of invalid activity from both human and mechanical sources, including domain laundering. Through these advanced filters, clients can rest assured they are protected from the impacts that Methbot and other, bigger threats can have on their performance – and their bottom lines.
  2. To that end, comScore has been aware of and filtering IVT driven by this Methbot ad fraud scheme since October 2015. Through our SIVT detection filters, leveraged in our Media Metrix® and validated Campaign Essentials™ (vCE®) products, we have been automatically identifying and removing Methbot activity from audience and campaign measurement as standard practice for over a year. If you are working with comScore, your validated audience numbers have already filtered Methbot and other sophisticated invalid traffic, giving you a clean view of your impact on consumers.
  3. When new IVT threats are detected, it is important that they are dealt with delicately to ensure minimal disruption to the industry – and most importantly to avoid tipping off bad actors. Understanding that publicly sharing information about botnet fuels the generation of new, more cunning IVT in the industry, comScore does not proactively promote these discoveries to the world at large. When comScore identifies significant new forms of invalid traffic, we provide information through established protocols of MRC and TAG, and we work with those impacted to ensure the issue is resolved before making public announcements.

At the end of the day, the attention that Methbot has generated reinforces that SIVT filtration is critical in digital audience and campaign measurement – and equally important as the industry moves toward making cross-platform measurement the new standard. As media buyers and sellers evaluate critical KPIs such as reach, UVs, GRPs and TRPs, these measures must reflect the true impact on human consumers before TV and digital can speak the same language. Luckily, with advanced techniques in measuring and combatting SIVT, we are keeping ahead of the new schemes that emerge and reporting clean metrics today – not only for digital, but for audiences across platforms.

Learn more about

Invalid Traffic

comScore provides sophisticated detection of non-human traffic that goes beyond the standard filtration required for industry accreditation. The recent acquisition of MdotLabs...
Learn More