🖱️ Детектор шахрайських кліків у рекламі — закон Бенфорда наживо

Benford's Law states that for many naturally occurring, multi-scale numerical datasets, the first (leading) digit d is not uniformly distributed across 1–9 but instead follows P(d) = log₁₀(1 + 1/d) — so about 30.1% of values start with 1, 17.6% with 2, down to only 4.6% starting with 9. It emerges whenever the underlying quantity spans several orders of magnitude and its logarithm is roughly uniformly distributed, which is exactly what happens with organic ad-click counts aggregated across campaigns of wildly different sizes, budgets and reach. Fabricated data — generated by picking numbers in a narrow range to look plausible — does not have this multi-scale structure, so it fails to reproduce the log-uniform property and its leading digits deviate from Benford's expected curve.

For each traffic source we tabulate how many of its N click-count values have each leading digit 1 through 9, giving observed counts O(d). We compute the expected count under Benford's Law as E(d) = N × log₁₀(1 + 1/d). The chi-squared statistic is χ² = Σ (O(d) − E(d))² / E(d), computed live from the actual simulated data on every regeneration — nothing is hardcoded. With 9 digit categories there are 8 degrees of freedom, and the standard critical value for a 5% significance level is 15.507; sources whose chi-squared statistic exceeds that threshold are flagged as statistically inconsistent with genuine, naturally-scaled traffic.

Genuine sources draw click counts from a log-uniform multiplicative process: the base scale is 10 raised to a uniformly random exponent between 1 and about 5.2 (so magnitudes range from tens to hundreds of thousands), multiplied by lognormal noise representing day-to-day campaign variation. Because the exponent is uniform, the resulting leading digits closely follow Benford's Law, mirroring how real aggregated web traffic behaves. Fraudulent sources instead draw counts uniformly from a narrow numeric band, such as 500 to 900 clicks — a pattern typical of click farms or bots trying to look like a steady, plausible volume, which mathematically cannot reproduce a logarithmic leading-digit distribution.

Chi-squared is sensitive to sample size N — with enough data, even tiny, practically unimportant deviations become statistically significant. The mean absolute deviation, MAD = (1/9) × Σ |observed fraction(d) − P(d)|, measures the average size of the deviation itself, independent of N. Digit-analysis practitioners (following Nigrini's forensic-accounting conventions) treat MAD below about 0.006 as close conformity, 0.006–0.012 as acceptable, 0.012–0.015 as marginal, and above 0.015 as nonconformity. Reporting both statistics together — chi-squared for statistical significance and MAD for effect size — gives a more complete picture than either alone.

No — Benford's Law is a screening heuristic, not proof. Some genuine datasets fail to conform because they are constrained to a narrow range for legitimate reasons (for example, a small fixed-budget campaign that always buys close to the same number of clicks), and some fabricated data can be built to mimic a logarithmic distribution deliberately. In real ad-fraud detection, a significant chi-squared result on click counts is one signal among many — alongside click-timing patterns, device fingerprints, IP reputation and conversion-rate anomalies — that analysts use to prioritise which traffic sources deserve deeper investigation.

The observed bars animate smoothly toward their new target height any time the underlying data changes — for example when you toggle a source between genuine and fraudulent, change the sample size, or click Resample. This is purely a visual easing effect for readability; the chi-squared statistic and p-value shown in the side panel are always computed directly from the final, settled data, not from the in-between animated frame.