News

Botnets, networks of infected zombie computers that operate at the whim of their controller, are arguably one of the nastiest scourges of the Internet.

But security researchers believe they’ve found a way to filter bot traffic from the real thing for good.

Last October, the well-known security researcher Dan Kaminsky, Michael J. J. Tiffany, Ash Kalb and Tamer Hassan took their small security start-up, White Ops, out of stealth, publicly claiming they had developed technology that could differentiate between so-called “bots” and real people.

Eight months later, they’ve secured the confidence of new investors at Paladin Capital Group and Grotech Ventures, who together invested $7 million in their antifraud start-up.

If all goes according to plan, White Ops has a huge market opportunity.

While hard losses are difficult to track down, as much as 29 percent of display advertising traffic worldwide is driven by zombie computers, according to an estimate from Solve Media, a security firm that estimates that botnets cost advertisers $10 billion last year.

In some cases, operators set up websites, pay botnets to flood them with traffic, then trumpet their viewership to legitimate advertisers like Target, or Amazon, and begin collecting checks as zombies flood the ads with fraudulent clicks. In other cases, legitimate websites find they can significantly boost their advertising revenue by paying bots to help them boost their click quotas.

“We’ve seen entire ad campaigns that have been completely and utterly overrun by bots,” Mr. Kaminksy said. “You see a site, at the end of the month, that is 500,000 clicks short, and then 500,000 clicks magically appear.”

White Ops’ technology differentiates between a person using a web browser on their own computer, and a bot controller directing the web browser on a malware-infested computer from 3,000 miles away using Javascript and Flash, two tools that allow for the development and control of computer interfaces.

“Our discovery is that both Javascript and Flash will also tell you if there’s a real user behind that inferface,” Mr. Kaminsky said.

White Ops sells customers one line of code that allows them to differentiate between bot traffic and the real thing. They compare it to Google’s analytics service, and White Ops tells website operators how much of their traffic is coming from humans and how much of it is coming from bots. The start-up bases its charges on website volume: a site that typically generates one billion clicks a month will pay more than a site that generates 1,000 clicks.

“In the beginning, advertisers were saying, ‘We’re afraid to do something,’ because fraud was generating so much revenue for the display ad industry,” Mr. Kaminsky said. “Now the fraud is large enough that they’re saying, ‘We’re afraid not to do something.’ ”

On Tuesday, White Ops will also begin selling its expertise to businesses beyond advertisers, who have fallen victim to bots in ways other than ad fraud. Businesses, WhiteOps said, increasingly suffer from similar fraud, such as automated attacks on their websites, or criminals who use bots to charge purchases from stolen credit cards across thousands of sites.