Click Fraud Detection with Recurrent Neural Networks Optimized by Adapted Crayfish Optimization Algorithm

Online advertising has revolutionized how businesses engage with consumers by providing targeted and quantifiable promotional campaigns. Nevertheless, this digital approach has also given rise to advanced fraudulent activities, including click frauds [1], [2]. Click fraud is a malicious practice based on artificially synthesized fraudulent clicks aiming to affect advertising metrics and deplete advertising budgets. These fraudulent activities can be accomplished by utilizing automated bots, orchestrated click farms or even by competitors deliberately targeting to exhaust a rival’s resources. The consequences of these practices can be devastating: key performance indicators like conversion rates, return on investment (ROI), and cost-per-click (CPC) are distorted, resulting in misinformed business strategies and possible considerable financial losses [3], [4].

The detection of click frauds can be particularly challenging because of the dynamic and evolving nature of fraudulent behavioral patterns. Traditional rule-based methods, which were utilized as a first line of defense through static IP block-lists and heuristic-based anomaly detection, are easily breached by fraudsters who continue to enhance and adapt their techniques to mimic genuine user behavioral patterns. In light of these obstacles, contemporary detection techniques have included application of artificial intelligence and deep learning, offering the capability to learn intricate patterns in immense volumes of data [5], [6].

In this study, a novel click frauds detection framework was proposed, relying on recurrent neural networks (RNNs) [7]. These networks are designated to analyze temporal click data and effectively differentiate among genuine and fraudulent actions by learning the underlying sequential patterns. To further improve the robustness and accuracy of the model, an adapted variant of swarm intelligence metaheuristics, in particular COA [8] was integrated into the suggested framework. This modified COA was tasked to automatically fine-tune the hyperparameters of the RNN, ensuring that the network adapts promptly to emerging fraudulent patterns while maintaining high detection accuracy.

This research was consequently driven by three primary objectives:

• Development of a modified variant of COA algorithm, particularly devised to overcome the constraints of the baseline method and tailored for the click frauds detection challenge.

• Development of an RNN-based framework able to capture the intricate sequential dependencies linked with click frauds, consequently reducing false positives and enhancing the overall model reliability.

• Devised COA variant was integrated to this RNN-based security framework to perform hyperparameter optimization, with a goal to secure optimal performance for the problem in hand.

The rest of this manuscript is structured as follows: Section 2 yields a review of related literature on cybersecurity and click fraud detection. It also discusses hyperparameter optimization and the RNN architecture together with its role in analyzing sequential click data. Section 3 describes the elementary COA algorithm, and proposes an adapted version of this metaheuristics. Next, Section 4 outlines the experimental setup while Section 5 presents the experimental results. Ultimately, Section 6 discusses the implications of the findings and delineates future research directions.

Click frauds detection has been a subject of active research over the years. Early approaches predominantly relied on rule-based systems, making use of static IP block-lists, heuristics, and threshold-based anomaly detection methods for identification of suspicious activities. Paper [9] explored the application of block-list driven firewall implementations to counter large-scale fraudulent activities, while authors [10] investigated IP-based classification mechanisms to filter out malicious traffic. Despite their initial success, these conventional approaches have several inherent constraints. As fraudsters adopted more sophisticated and adaptive techniques, static rules quickly became deprecated. More recent research published [11] have highlighted that these conventional methods frequently fail to scale properly and adapt to the nuanced attacks employed by modern click fraudsters.

The recent advances of deep learning have provided an adaptive alternative to traditional approaches, with RNNs emerging as particularly well-suited for processing sequential data. RNNs are capable of identifying temporal dependencies and modeling dynamic behavior found inside data, making them a natural choice for clickstream data analysis. Moreover, development of attention mechanisms has further refined the capabilities of RNNs by providing the models with capability to focus on the most salient parts of the input sequence [12]. Complementary studies [13] and [14] have demonstrated that deep learning structures can greatly improve the identification of subtle behavioral patterns, consequently enhancing the overall performance of fraud detection systems.

However, the biggest obstacle in deployment of deep learning models in general is the optimization of hyperparameters. The performance of these models is highly sensitive to the configuration of their hyperparameters, which encompass learning rates, weight initialization schemes, and architecture-specific parameters. Manual tuning of these hyperparameters is not practical, and deterministic methods are not feasible since this is widely regarded as NP-hard problem. Metaheuristic approaches have emerged as a powerful solution to this problem. Among these, nature-inspired algorithms like particle swarm optimization (PSO) [15] and genetic algorithm (GA) [16] have been successfully applied to optimize model parameters. More recently, COA has shown promising results in navigating high-dimensional parameter spaces effectively [8], along with several other contemporary methods like red fox optimizer (RFO) [17], elk herd optimizer (EHO) [18] and salp swarm algorithm (SSA) [19].

The notable examples of successful hyperparapeters tuning by metaheuristics algorithms range over different application domains. These algorithms were used in medicine [20], [21], smart power grids [22], software development [23], [24], and sentiment analysis [25], [26], [27]. The field of cybersecurity also utilized this kind of approach, for intrusion detection [28], [29], insider threat detection [30], phishing detection [31], Metaverse and IoT networks in general [32].

In this research, a modified variant of COA was integrated into RNN framework, with a goal to optimize RNNs hyperparameters and enhance the accuracy and adaptability of click fraud detection systems.

Recurrent neural networks (RNNs) are a class of neural networks specifically designed for sequential data analysis. Unlike traditional feedforward networks, RNNs incorporate feedback loops that allow information to persist, thereby enabling the network to capture temporal dependencies. In many applications, such as natural language processing and time-series forecasting, RNNs have demonstrated the ability to learn complex patterns that evolve over time.

In this formulation, the RNN is designed to process clickstream data by maintaining a hidden state that encapsulates information from previous time steps. At each time step $t$, the RNN receives an input $X_t$ and updates its hidden state $h_t$ based on both the current input and the previous hidden state $h_{t-1}$. This update is performed using a nonlinear activation function, which in this case is the hyperbolic tangent function ($\tanh$). The update equation is given by:

where, $W_{xh}$ is the weight matrix associated with the input, $W_{hh}$ is the recurrent weight matrix for the hidden state, and $b_h$ is a bias term. This recurrent formulation allows the network to “remember” previous inputs, which is crucial for detecting patterns in click behavior that may span multiple time steps.

Once the hidden state is updated, the network generates an output $Y_t$ through a linear transformation of the hidden state:

In this equation, $W_{hy}$ is the weight matrix that maps the hidden state to the output space. The simplicity of this architecture ensures that the RNN can be trained efficiently while still capturing the essential temporal features present in the clickstream data. Although attention mechanisms have been introduced in many recent works to further enhance performance, this papers focus in this section is on the fundamental RNN structure that forms the basis of the detection model.

This section first discloses the baseline implementation of COA metaheuristics. Afterwards, it points out the constraints of the original COA, and proposes an adapted variant that was later employed in the experiments which were carried out.

Hyperparameter tuning is critical for the performance of deep learning structures, however, the high dimensionality of the parameter space and the dynamic nature of the problem domain often render traditional deterministics approaches inefficient and error-prone. COA [8] offers a robust, nature-inspired solution to this problem by mimicking the exploratory and social behaviors observed in crayfish.

Fundamental traits of metaheuristics algorithms encompass two primary stages: exploration and exploitation. A bio-inspired algorithm modeled after a tiny freshwater creature crayfish is referred to as COA. This organism is particularly attractive due to its intolerance of heat exceeding 30 degrees Celsius and its instinctive behavior for locating and fighting over shelters. Its competitive tendency become more exposed during the exploitation stage, as once a refuge is identified, that specific location may be claimed or found by another individual in the same time. The crayfish exits the refuge or sanctuary once the ambient temperature falls back below the 30 degrees mark, showcasing its adaptive response to environmental conditions.

While in exploration stage, the shelter is defined by Eq. (3).

where, the $X_G$ depicts the optimal position over iterations, while the ideal position of the present collection of individuals is $X_L$. While the synthesized $rand$ number is lower than 0.5, a crayfish enters the cave without fighting over it as given by Eq. (4).

where, the $t$ signifies the ongoing iteration, $t+1$ depicts the following one, and $C_2$ is computed with Eq. (5).

where, $T$ represents the maximal count of rounds.

In case the rand number is over 0.5 , the Eq. (6) is used to model the competition among individuals.

where, $z$ represents a random crayfish that is given by Eq. (7).

The feeding phase commences when temperature falls below threshold of 30 degrees Celsius. The feeding supply is labeled by $X_{\text {food }}=X_G$, while the foraging behavior is outlined within Eq. (8).

In case the food supply is too big for the individual to eat it, it will break it into smaller pieces. The food size limit can be modeled by $Q \leq \frac{C 3+1}{2}$, while the remainder of this task is provided by Eq. (9).

where, the $Q$ signifies the food size delineated with Eq. (10).

in this equation, the $C_3$ represents the biggest food supply with constant score 3 , fitness${ }_i$ depicts the $i$-th cray fish's fitness score while the fitness$_{\text {food }}$ represents its location.

In case food supply is not too large, crayfish begins consuming it as depicted with Eq. (11).

Notwithstanding that COA is a novel algorithm that exhibited excellent performance in different domains, it still has the potential for improvement. More precisely, both exploration and exploitation stages of the baseline COA are the candidates for further improvement. Therefore, this study proposes an adaptive version of the algorithm that can enhance both aspects of COA.

In the first half of the execution (first $T/2$ iterations), the target is to booster the exploration. The individual having the poorest fitness score (the worst crayfish) is substituted by the fresh individual created as a hybrid between a pair of random crayfish units, by applying uniform crossover procedure inherited from genetic algorithm GA [16].

During latter $T/2$ rounds, the target is drifted toward exploitation. In this stage, the weakest crayfish in population is substituted by a hybrid between the most superior individual and a random crayfish, again by utilizing crossover operation. This adapted variation of COA is labeled adaptive COA (ACOA), while its pseudo-code is outlined by Algorithm 1.

Taking into account that this adaptation does not add any supplementary fitness function evaluations (FFE), that is regarded as the most processing heavy operation during metaheuristics execution, the suggested ACOA complexity is the same as the original COA with respect to FFEs.

This study employs dataset which is publicly available on Kaggle to evaluate introduced click fraud detection framework. Since this dataset is extremely large in the original format (having more than 11GB of samples), it was reduced to approximately 1% of original size to simplify and streamline the train and test tasks. Additionally, as the baseline dataset is highly imbalanced, where just around 1% of samples are linked to the real click fraud activities, models in this study were allocated with a balanced data consisting of 50% normal and 50% malicious samples to execute training procedure. This was achieved by the majority class undersampling strategy. The resulting balanced data was split into 70%/30% portions utilized for train and test activities for the observed models.

The performance of the introduced ACOA metaheuristic algorithm was evaluated by side by side comparisons to a set of powerful modern optimizers, encompassing baseline COA [8], GA [16], particle swarm optimization (PSO) [15], Harris hawks optimization (HHO) algorithm [33], whale optimization algorithm (WOA) [34], reptile search algorithm (RSA) [35] and sinh cosh algorithm (SCHO) [36]. Contending algorithms were developed independently in Python, making use of default configurations of their control parameters as suggested by their respective creators. Every evaluated algorithm was assigned 8 solutions in populace and 8 iterations to execute optimization. Since metaheuristics algorithms inherit randomness factor from their stochastic nature, simulations were run in 30 separate executions. All regarded optimizers were given the task to enhance the models' performance through hyperparameter optimization. Table 1 outlines the collection of adjusted RNN parameters along with their search domains.

Inside the model optimization stage, Matthews correlation coefficient (MCC) [37] was employed as the target optimization function for training the RNN architectures. The resulting structures were assessed utilizing a conventional suite of classifier's performance indicators across the conducted experiments [38]. This set of evaluation criteria included accuracy, precision, recall and the f1-score, as formally specified in Eqs. (12)–(15). Classification error rate was used as indicator through the simulations.

Table 2 outlines the outcomes for the objective function tuning experiments over 30 independent executions, where the finest score in each class is denoted in bold text. The suggested ACOA exhibited superior performance, by attaining the best outcomes for the best run, mean and median values of 0.571087, 0.568229 and 0.569089, respectively. In this scenario, HHO obtained the finest score in the worst execution, while GA exhibited superior stability of the outcomes across independent executions, having the smallest scores for standard deviation and variance among the regarded optimizers.

Figure 1 showcases comparisons of the regarded optimizers' stability across separate executions. Exhibited violin diagram suggests that the suggested ACOA is not the most stable optimizer, as it is clearly surpassed by several other metaheuristics including GA, original COA and SCHO. However, despite these other methods performed more consistently, it did not help them secure the best overall score, which was attained by ACOA, suggesting their tendency to get stuck in local optimums easier than proposed algorithm. On the same Figure 1, the convergence graphs of the objective are also depicted, providing valuable information into the capabilities of regarded algorithms to handle falling into local optimums, and successfully converge to better regions of the search realm. It is obvious that the suggested ACOA established the finest overall solution during the fourth iteration of the best run, outperforming other regarded algorithms that were struggling to overcome local optimum pitfalls.

Table 3 depicts the outcomes of the indicator function (classification error). In this metric, SCHO obtained the finest overall outcome with error rate of 0.217883. Despite error rate was not established as the tuning target, introduced ACOA also attained respectable outcome, having the best score of 0.218978. Additionally, Figure 2 outlines the box plots and convergence graphs of the error rate.

Table 4 provides insight into the extensive comparative evaluation of the metrics for the best produced RNN models by every regarded optimizer. The introduced ACOA generated RNN structure that obtained excellent accuracy of 0.781022, accompanied by good overall values of macro and weighted averages, and balanced per class precision, recall and f1-score. It is also obvious that other optimizers also produced excellent RNN structures, with less than 1% differences in accuracy between the finest produced RNNs by each metaheuristics.

Figure 3 shows supplementary visualizations of the attained outcomes in the form of the best ACOA produced RNN's confusion matrix and ROC diagram. Finally, the hyperparameter selections for the best produced RNNs by every regarded optimizer are summarized within Table 5, to facilitate possible future replications of these simulations and support the consistency of the experimental outcomes. The configurations shown in Table 5 achieved the scores presented in Table 4.

In the domain of digital advertisement business, click frauds persist as a critical obstacle, frequently resulting in significant financial losses for advertisers and compromising the reputation of ad-serving companies. The crucial task of reliable separation of legitimate human interactions from fraudulent click activities requires implementation of sophisticated detection frameworks. This research investigated the efficiency of AI-driven approaches, particularly those utilizing RNN architectures, to identify anomalous click patterns that indicate malicious behavior. To improve the predictive capabilities of RNN models, an adapted version of the COA algorithm was implemented to optimize RNN hyperparameter configuration. This introduced framework was evaluated using real-world data and demonstrated promising results, with the most effective models achieving accuracy rates of up to 78.2%.

Despite promising outcomes, this study was not without several constraints. The large volume of available data imposed limits to the amount of data that could be feasibly employed for model training and testing activities. Consequently, down-sampled dataset was used, that could have marginally affected overall performance results. Additionally, the computational intensity linked to optimization tasks restricted both the population sizes and iterations permitted to the applied optimization algorithms.

Future research will aim to address these constraints by exploring more scalable data handling strategies and improving computational resources efficiency. Supplementary investigations will target broader applications of the suggested ACOA and the integration of hybrid approaches to further advance the accuracy and reliability of click frauds detection systems.