{"id":22128,"date":"2019-06-18T06:30:29","date_gmt":"2019-06-18T13:30:29","guid":{"rendered":"https:\/\/www.kochava.com\/?p=22128"},"modified":"2022-08-18T15:00:25","modified_gmt":"2022-08-18T22:00:25","slug":"click-injection-unmasked-an-impact-assessment-of-googles-install-referrer-api","status":"publish","type":"post","link":"https:\/\/www.kochava.com\/ko\/blog\/click-injection-unmasked-an-impact-assessment-of-googles-install-referrer-api\/","title":{"rendered":"Click Injection Unmasked: An Impact Assessment of Google\u2019s Install Referrer API"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][vc_row_inner column_margin=”default” text_align=”left”][vc_column_inner column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_shadow=”none” column_border_radius=”none” column_link_target=”_self” width=”1\/1″ tablet_width_inherit=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][\/vc_column_inner][\/vc_row_inner][vc_column_text]Over a year and a half has passed since the release of the Google Play Install Referrer API that has given app developers and measurement providers a new level of insight into the exact timing and activity surrounding a user\u2019s install. One data point provided by the API was the Install Begin Timestamp, the exact moment down to the second when the app install begins. <\/span>\r\n\r\nOne of the biggest impacts from this new data was the ability to combat forms of click injection. A fraudulent tactic used to hijack install bounties, click injection occurs when malware on a device detects ad interactions and\/or app store activity and injects fake clicks to steal attribution credit for an install. <\/span>\r\n\r\nLast year, a <\/span>Buzzfeed article using Kochava research <\/span><\/a>exposed several apps as participants in a massive click injection scheme. The article prompted an investigation by Google and the subsequent <\/span>removal of several apps from its Play Store<\/span><\/a>. With the data available from the Install Referrer API, most of the tactics deployed in this scheme were both detectable and preventable. <\/span>\r\n\r\nSo, what have we learned over the past 18 months from the data revealed by the Install Referrer API?<\/span>\r\n\r\nTo begin, let\u2019s recap what changed with its release. <\/span>\r\n

Before Install Referrer<\/b><\/h4>\r\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][image_with_animation image_url=”22208″ alignment=”center” animation=”Fade In” border_radius=”none” box_shadow=”none” max_width=”75%”][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][vc_column_text]Before the Install Referrer API provided the Install Begin Timestamp, Kochava (and other measurement providers) only had visibility into a user\u2019s first launch of an app, which triggered the initialization of our software development kit (SDK). This initialization was our first visibility to the app\u2019s presence on the device and as such, it acted as the \u201cinstall\u201d event. The timestamp of the first open\/launch was used for attributing the install back to a click. \u00a0<\/span>\r\n\r\nBecause users don\u2019t necessarily launch the app directly after completing the install, the first open time was inherently flawed as an indicator of when the install actually occurred. The unknown time gap between click and actual install provided an ideal click injection window for fraudsters to take advantage of. <\/span>\r\n\r\nTo combat click injection, Kochava developed sophisticated time-to-install (TTI) algorithms to identify anomalous patterns between click and first open times and in order to flag suspicious outliers.<\/span>\r\n

After Install Referrer<\/b><\/h4>\r\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][image_with_animation image_url=”22209″ alignment=”center” animation=”Fade In” border_radius=”none” box_shadow=”none” max_width=”75%”][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][vc_column_text]After the Install Referrer API release, Kochava could gather the exact Install Begin Time (the moment the user entered the app store and clicked the \u201cInstall\u201d button). <\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/3″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][image_with_animation image_url=”22212″ alignment=”center” animation=”Fade In” border_radius=”none” box_shadow=”none” max_width=”75%”][\/vc_column][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”2\/3″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][vc_column_text]Kochava created new functionality that allowed marketers to override the use of the first open time and instead use the Install Begin Time. This removed reliance on the timestamp of the first open\/launch event. <\/span>\r\n\r\nAs a result, every click injected after the Install Begin Time could be disqualified from install attribution. <\/span>\r\n\r\nBecause the Install Referrer API is called during initialization at the time of first launch, we still receive and process all of the injected clicks. When the Install Referrer API returns the Install Begin Time, it becomes clear which clicks are injected. <\/span>\r\n

Painting a clearer picture of install attribution fraud<\/b><\/h4>\r\nThe simple availability of the true Install Begin Time has given a fuller view into the prevalence of fraud in the ecosystem. <\/span>\r\n\r\nWhen enabling the Kochava feature to override the first open time with the Install Begin Time, certain customers have experienced up to a 90% drop in attributed installs for their app. This indicates that a great majority of their media mix was perpetrating click injection and\/or click fraud against them. These marketers haven\u2019t lost total installs but rather saw their organics jump significantly. Click injection had been sniping organic installs, and switching to Install Begin Time saved the customers significantly on falsely attributed installs. \u00a0<\/span>\r\n\r\nOther apps have not noticed a large drop in attributed install volume but experienced a shift in which networks are winning the attributions, indicating that click injection tactics of some partners were stealing installs from others.<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” scene_position=”center” text_color=”dark” text_align=”left” overlay_strength=”0.3″ shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_position=”all” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_link_target=”_self” column_shadow=”none” column_border_radius=”none” width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” column_border_width=”none” column_border_style=”solid” bg_image_animation=”none”][vc_column_text]\r\n

A Real-World Example<\/b><\/h4>\r\nLet\u2019s unpack a real-world example from a top Play Store app. In analyzing a specific install we saw:<\/span>\r\n