
455Large-Scale Network Trafc Analysis
score, and the quality score with the percentile threshold set by the histogram lter for
this bucket is studied. Moreover, the number of incremental abusive clicks, that is, the
number of abusive clicks detected solely by the IP size histogram lter and not by other
systems, as well as the incremental quality score, that is, the quality score associated
with the incremental abusive clicks, are analyzed. As clear from Figure 14.10, there is a
sweet spot around 0.7 that identies a small fraction of clicks, about 1% of the total num-
ber of clicks in this buckets, which have both high fraud score and low qua ...