《程序化广告中的IP欺诈检测：ADX系统反作弊实战指南》

媒体请求 → ADX接收 → 记录请求日志 → 返回广告 → 
媒体展示 → 事件上报 → 关联原始请求 → IP比对 → 
异常检测 → 结果存储 → 分析报表

// 请求记录实体
public class AdRequest {
    private String requestId;
    private String mediaId;
    private String clientIp; // 实际客户端IP
    private String xForwardedFor; // 代理链IP
    private String deviceId;
    private String userAgent;
    private String adUnitId;
    private Instant requestTime;
    // getters & setters
}

// 上报事件实体
public class TrackingEvent {
    private String eventId;
    private String requestId; // 关联原始请求
    private EventType eventType; // IMP, CLICK等
    private String reportedIp;
    private Instant eventTime;
    // getters & setters
}

// IP不一致记录
public class IpInconsistency {
    private String requestId;
    private String originalIp;
    private String reportedIp;
    private long timeDiffSeconds;
    private boolean suspicious;
    private String mediaId;
    // getters & setters
}

public class IpUtils {
    private static final String[] IP_HEADERS = {
        "X-Forwarded-For",
        "Proxy-Client-IP",
        "WL-Proxy-Client-IP",
        "HTTP_CLIENT_IP",
        "HTTP_X_FORWARDED_FOR"
    };

    public static String getClientIp(HttpServletRequest request) {
        // 检查代理头
        for (String header : IP_HEADERS) {
            String ipList = request.getHeader(header);
            if (ipList != null && !ipList.isEmpty()) {
                return ipList.split(",")[0].trim();
            }
        }
        return request.getRemoteAddr();
    }
    
    public static boolean isSameNetwork(String ip1, String ip2) {
        // 实现IP段比对逻辑
        // 可考虑使用第三方库如IPAddress
    }
}

@Aspect
@Component
public class RequestLoggingAspect {
    @Autowired
    private RequestLogRepository logRepo;

    @Around("execution(* com.your.adx.controller.AdController.getAd(..))")
    public Object logRequest(ProceedingJoinPoint pjp) throws Throwable {
        HttpServletRequest request = 
            ((ServletRequestAttributes)RequestContextHolder.getRequestAttributes()).getRequest();
        
        AdRequest logEntry = new AdRequest();
        logEntry.setRequestId(UUID.randomUUID().toString());
        logEntry.setClientIp(IpUtils.getClientIp(request));
        // 设置其他字段...
        
        logRepo.save(logEntry);
        
        // 将requestId放入响应中供媒体使用
        Object result = pjp.proceed();
        if (result instanceof ResponseEntity) {
            ((ResponseEntity)result).getHeaders().add("X-Request-ID", logEntry.getRequestId());
        }
        return result;
    }
}

@RestController
@RequestMapping("/track")
public class TrackingController {
    @Autowired
    private RequestLogRepository requestRepo;
    @Autowired
    private InconsistencyService inconsistencyService;

    @GetMapping("/imp")
    public ResponseEntity trackImp(
            @RequestParam String requestId,
            HttpServletRequest trackingRequest) {
        
        Optional<AdRequest> originalRequest = requestRepo.findById(requestId);
        if (!originalRequest.isPresent()) {
            return ResponseEntity.badRequest().build();
        }

        String reportedIp = IpUtils.getClientIp(trackingRequest);
        IpInconsistency record = new IpInconsistency();
        record.setRequestId(requestId);
        record.setOriginalIp(originalRequest.get().getClientIp());
        record.setReportedIp(reportedIp);
        record.setTimeDiffSeconds(ChronoUnit.SECONDS.between(
            originalRequest.get().getRequestTime(),
            Instant.now()
        ));
        
        // 高级检测逻辑
        record.setSuspicious(isSuspiciousInconsistency(record));
        
        inconsistencyService.saveRecord(record);
        return ResponseEntity.ok().build();
    }

    private boolean isSuspiciousInconsistency(IpInconsistency record) {
        // 规则1: IP段完全不同且时间差短
        if (!IpUtils.isSameNetwork(record.getOriginalIp(), record.getReportedIp()) 
            && record.getTimeDiffSeconds() < 5) {
            return true;
        }
        
        // 规则2: 上报IP是已知数据中心IP
        if (IpUtils.isDatacenterIp(record.getReportedIp())) {
            return true;
        }
        
        // 其他自定义规则...
        return false;
    }
}

public class GeoAnalysis {
    public static boolean isUnrealisticTravel(String ip1, String ip2, long seconds) {
        Location loc1 = geoService.lookup(ip1);
        Location loc2 = geoService.lookup(ip2);
        
        double distance = calculateDistance(loc1, loc2);
        // 人类不可能在短时间内长距离移动
        return distance > (seconds * 100 / 3600); // 假设100km/h为上限
    }
}

public class FraudPredictor {
    public double predictFraudProbability(IpInconsistency record) {
        FeatureVector vector = new FeatureVector();
        vector.addFeature("ip_distance", 
            IpUtils.networkDistance(record.getOriginalIp(), record.getReportedIp()));
        vector.addFeature("time_diff", record.getTimeDiffSeconds());
        vector.addFeature("geo_speed", 
            GeoAnalysis.movementSpeed(record.getOriginalIp(), 
                                    record.getReportedIp(),
                                    record.getTimeDiffSeconds()));
        
        return model.predict(vector);
    }
}

@Cacheable(value = "ipGeoCache", key = "#ip")
public Location getIpLocation(String ip) {
    // 调用第三方地理定位服务
}

public class WhitelistService {
    @Cacheable("ipWhitelist")
    public boolean isWhitelisted(String ipPattern) {
        // 检查已知合法的IP模式
    }
}