Low Session Time Anomaly
What it detects
Bot traffic and automated click injection produce conversions with near-zero session times — the gap between click and conversion is too short to represent a real user completing an action. The Low Session Time Anomaly filter monitors traffic distributions and blocks sources where short-session conversions exceed a statistically normal threshold.
How it works
Unlike the Session Time Filter which applies a fixed cutoff to every conversion, this filter uses dynamic thresholds based on observed traffic patterns. It analyzes the distribution of session times per sub ID and flags sources where the proportion of abnormally short sessions is a statistical outlier compared to your baseline traffic.
The system handles threshold calculation automatically. You enable the filter — no manual tuning is required.
Key behaviors:
- Evaluates at sub ID granularity for precision
- Adapts as traffic patterns change over time
- Does not block sources based on a single short session — requires a pattern
Configuration
Navigate to Fraud Prevention > Traffic Quality > Low Session Time Anomaly to configure.
| Parameter | Default | Options | Description |
|---|---|---|---|
enabled | false | true, false | Enable or disable the filter |
block_mode | Block | Block, Flag | Action when anomaly pattern is detected |
What happens when triggered
When a sub ID’s session time distribution crosses the anomaly threshold:
- Block mode: Conversions from that sub ID are rejected with
fraud_reason: low_session_anomaly. - Flag mode: Conversions are recorded but tagged for audit.
The filter auto-recovers: when the sub ID’s session time distribution returns to normal bounds, blocking stops automatically.
Use Flag mode initially to observe which sub IDs are flagged before enabling blocking. This helps verify the filter is targeting genuine fraud, not publishers with fast-converting offer types.
Related filters
- Session Time Filter — applies a fixed minimum/maximum session time to all conversions
- Click Spam — detects background click generation patterns including short-session signals