# Glossary > Key terms used throughout the Ad Protect documentation. --- # A ## Ad Fraud Ad fraud is activity designed to generate invalid advertising interactions or manipulate advertising systems. Examples include: * fraudulent clicks, * automated traffic, * coordinated interaction patterns, * artificial conversion activity. Ad fraud detection combines multiple signals to determine whether traffic represents genuine user interest. --- ## Ad Verification Tool A service used to verify advertising placement, quality, compliance, or delivery. Ad verification tools are recognized separately from fraudulent automation because they serve a legitimate purpose in the advertising ecosystem. --- ## AdvancedRequestBot An advanced request-based automation system designed to imitate browser-like traffic without operating a complete browser. Characteristics may include: * advanced HTTP clients, * TLS impersonation, * browser-like request generation, * cookie-solving workflows. AdvancedRequestBots require deeper protocol and environment analysis than simple request bots. --- ## AdvancedStealthBrowser A sophisticated browser automation environment designed to reduce traditional automation indicators. Characteristics may include: * customized browser environments, * reduced automation fingerprints, * deeper browser modifications, * realistic browser behaviour. Detection typically requires combining browser, protocol, network, and behavioural signals. --- # B ## Behavioural Intelligence One of the four detection layers. Behavioural Intelligence analyzes how traffic interacts with a site. Examples include: * click patterns, * clustered activity, * session consistency, * conversion behaviour. Behavioural analysis is particularly important for detecting activity that may come from real devices but represents invalid behaviour. --- ## Browser Fingerprinting A Browser Intelligence technique used to understand the characteristics of a browser and execution environment. The primary purpose is environmental consistency validation. Examples of fingerprint signals include: * browser properties, * device characteristics, * operating system indicators, * runtime behaviour, * rendering characteristics. A fingerprint is most valuable when determining whether an environment is internally consistent. --- ## Browser Intelligence One of the four detection layers. Browser Intelligence analyzes the client-side environment. Examples include: * JavaScript execution, * browser fingerprinting, * device consistency, * rendering signals. Browser Intelligence provides the primary understanding of the client environment. --- # C ## Canvas Fingerprinting A browser intelligence technique based on analyzing rendering output from browser graphics operations. Canvas signals can provide information about: * rendering behaviour, * graphics environment, * browser consistency. A strong implementation uses dynamic challenges rather than static fingerprints to reduce spoofing and replay risk. --- ## Click Clustering The analysis of groups of clicks that share suspicious characteristics. Examples include: * unusually concentrated clicks, * coordinated activity, * repeated interaction patterns. Click clustering is a behavioural signal used to identify potentially fraudulent activity. --- ## Click Quality A measure of how valuable and trustworthy clicks are. Click quality considers factors such as: * source quality, * interaction behaviour, * conversion outcomes, * traffic classification. High click volume does not necessarily indicate high-quality traffic. --- ## Click-to-Conversion Analysis Analysis connecting clicks to downstream conversion outcomes. This helps determine whether traffic creates meaningful business value. --- # D ## Definitely Bot A confirmed automated classification. Typically represents a browser-capable client where strong automation indicators have been identified. Examples include: * browser automation, * headless environments, * invalid browser configurations, * strong automation signals. --- ## Dynamic Challenge A client-side challenge that changes over time instead of relying on a fixed response pattern. Dynamic challenges reduce the usefulness of: * pre-computed responses, * static spoofing, * replay attacks. --- ## Dynamic Fingerprinting A fingerprinting approach where the signals or challenges vary rather than remaining static. The goal is making environmental analysis more resistant to reproduction and replay. --- # I ## Invalid Traffic Traffic that should not be treated as trusted user activity for a specific purpose. Invalid traffic can include: * automated abuse, * fraudulent interactions, * suspicious traffic sources. The correct classification depends on context. --- ## IP Rotation Invalidation A behavioural and identity consistency mechanism that considers whether traffic changes network identity in suspicious ways. Rapid changes in IP origin may indicate attempts to distribute activity across multiple sources. --- # L ## Likely Real Visitor A classification where traffic appears legitimate, but there is not enough evidence for a stronger determination. This reflects a conservative approach: > Avoid blocking traffic when confidence is insufficient. --- # N ## Network Intelligence One of the four detection layers. Network Intelligence analyzes traffic origin and infrastructure characteristics. Examples include: * IP reputation, * ASN information, * proxy indicators, * hosting infrastructure. Network signals provide important context but are not treated as identity alone. --- # P ## PaidUser A planned future access model. The concept enables organizations to potentially monetize controlled access from automated systems consuming publicly available content. --- ## Pending Classification A temporary classification state. Usually indicates that the classification process has received only partial information and requires additional signals before determining what is accessing the site. --- ## Protocol Intelligence One of the four detection layers. Protocol Intelligence analyzes how clients communicate. Examples include: * HTTP characteristics, * TLS fingerprints, * request consistency, * connection behaviour. --- # R ## Real Visitor A confirmed genuine user interaction. Signals may include: * consistent browser environment, * expected protocol behaviour, * normal interaction patterns. --- ## Replay Attack An attack where a previously valid response, token, cookie, or client-generated signal is reused outside its original context. Replay resistance requires connecting trusted signals to the environment that produced them. --- ## Request Bot A simple HTTP-based automation client that does not execute JavaScript like a normal browser. Examples: * curl-based tools, * requests libraries, * simple scripted clients. --- # S ## SEO Crawler An automated system used to discover and index website content. SEO crawlers are recognized separately from malicious automation and are allowed by default. --- ## Session Consistency The evaluation of whether activity remains consistent throughout an interaction. Examples include: * identity continuity, * browser consistency, * network changes. --- # T ## Traffic Classification The process of determining what is accessing a site and how that traffic should be treated. Classification considers: * traffic source, * automation level, * trust level, * intended purpose. --- ## Two-Ping Classification A classification approach where multiple interactions are used to improve confidence. A first signal may provide partial information, while additional interaction data allows stronger classification. --- # U ## Untrusted IP A classification indicating traffic originates from infrastructure with elevated risk characteristics. Examples: * known proxies, * datacenter networks, * suspicious infrastructure. An Untrusted IP is a signal and not automatically proof of malicious activity. --- ## Unscrupulous AI Crawler An AI crawler that accesses content without an approved purpose or relationship. These crawlers differ from helpful indexing systems because their behaviour may create unwanted load or content usage concerns. --- # Four Detection Layers ## Layer 1: Network Intelligence Where traffic originates. --- ## Layer 2: Protocol Intelligence How traffic communicates. --- ## Layer 3: Browser Intelligence What environment is executing. --- ## Layer 4: Behavioural Intelligence What activity patterns occur. --- # Custom Dynamically Compiled VM A protected JavaScript execution approach used to make client-side analysis and replay more difficult. A dynamically compiled VM helps increase resistance against: * extraction, * static analysis, * automated reproduction, * replay attacks. --- # Key Takeaways * Traffic classification depends on multiple layers of evidence. * Automation is not automatically malicious. * Browser environments must be evaluated for consistency. * Behavioural signals are essential for identifying fraudulent activity from real devices. * Dynamic approaches improve resistance against replay and spoofing. * Analytics connects classification results to business outcomes.