Google Takes New Measures Against 3 Giant Botnets

In the ongoing battle against scammers that unleash malware on unwitting users through ads, Google announced Tuesday that it has added a new feature to automatically filter traffic from three of the biggest ad fraud botnets.

Vast networks of malware-infected computers, known as botnets, generate vast sums of revenue for perpetrators while depleting advertiser budgets on fake traffic by mimicking ad traffic patterns that look nearly identical to usual user behavior.

Google says the trio of ad malware targeted in this latest filter action — Bedep, Beetal and Changthangi — have infected more than 500,000 machines, including desktops, tablets and smartphones.

Keeping ahead of the scammers has been one of ad tech’s biggest challenges. Google says its new filter is different in that it won’t be fooled by changes to the malware traffic from these three botnets.

“One of the key benefits of this new feature is that it is resilient to possible changes to the malware that generates this botnet traffic,” wrote Andres Ferrate, chief advocate for Google ad traffic quality, in the announcement. “Our move to consistently and confidently cut out the traffic from these botnets, despite any changes in the malware on which they’re based, represents a significant milestone in the defense of our advertising ecosystem.”

Below is a chart graphing the size of the Bedep botnet over 60 days. The traffic dips occurred on weekends when many work-related machines are powered off. Bedep affects users worldwide.

Ferrate says the filter has already been applied for advertisers running campaigns through the Google Display Network and DoubleClick Bid Manager.

“Our team has expanded its expertise by working to gain a deep understanding of the Bedep, Beetal, and Changthangi malware families. Subsequently, we have expanded the capability to significantly protect our systems against traffic generated by this malware through an automated, scalable, and seamless filter. This filter is already available to all marketers on DoubleClick Bid Manager and Google Display Network (GDN).”