This article covers a topic that is somewhat unrelated to computer security. However, Internet advertising does share some similarities with one security issue: phishing. Both cost-per-click (CPC) ads and phishing attacks use social engineering to elicit participation from the user. The main difference between phishing and advertising is that the former aims to deceive and defraud the user, while the latter tries to sell an actual product. This article discusses an approach for effective ad placement on social networks (Facebook, in particular). Some of the same principles could also be applied to deliver better context-aware phishing attacks or spam, which are described in a recent paper from our research group available here.

Before we get into how social networks can improve their advertising, why is this even an issue? It is a topic that has come up in a number of my late-night discussions with fellow computer scientists. Facebook has an enormous number of users. It also knows more about each of its members than they may know about themselves. This leads to one conclusion: Facebook should be able to deliver extremely effective ads to millions, right? Wrong. They have an abysmal click-through rate and are still unable to even turn a profit (see Facebook Finances Leaked). There is absolutely no excuse for Facebook’s poor numbers.

What is the crux of the Facebook advertising problem? There are actually a few issues at play. The first and most obvious difference between search marketing and Facebook is when the user sees ads. On Facebook, people are not searching for anything. They are just trying to pass some time and catch up with friends. With search, the user might be actively looking for something, like a mortgage. This allows the search engine to present an immediately relevant and profitable CPC ad. It would appear that Facebook has an inherent disadvantage. However, Facebook users spend a lot of time just browsing the site. They may not be looking for a mortgage right now, but Facebook has its members’ attention for hours on end. This leads to one conclusion: brand advertising! Facebook should forget about CPC ads and aggressively pursue banner marketing. A few people might click on ads, but not enough for Facebook to be make the billions that it should. Facebook users really just want to see their friends’ relationship status updates and vacation photos.

One might argue that Facebook does not have control over what advertisers want, and therefore cannot be as successful with brand ads. There is also the issue of conversion tracking being difficult with brand advertising. Someone who sees a brand ad might later buy that product at a retail store, which would make attribution nearly impossible. Nevertheless, Facebook should be going after more brand ad deals like those seen on Yahoo’s non-search web applications (finance, mail, games, chat, etc.).

The second flaw with Facebook’s advertising, which they can only blame on themselves, is the complete reliance on advertisers to target their own ads. If you look at Facebook’s ad creation interface, they practically make the advertiser write database queries for ad delivery. This is not wise. As a vast social network with loads of knowledge about every member, Facebook should only ask for information about the content of each ad and figure out how to deliver it themselves. They can utilize complex social interactions to put ads only in front of the right people.

To achieve maximum profit from advertising, social networks need a new approach. The current system involves going through each ad and figuring out where to put it—an ad-centric approach. Instead, social networks should start at the other end with a person-centric approach. First build a personality and experience profile of each person, and then use that profile to make a well-educated guess about that person’s interests and purchasing habits. Finally, go out and grab the advertisements that are best-tailored for the individual. Not only will this directly lead to better advertising, but it will also enhance members’ perception of Facebook and attitude towards ads that are more relevant to their lives. As a side note, the same person-centric approach is also likely to yield better results for spam and phishing. With the wide array of publicly available information about individuals, social engineering attacks that align themselves with a target’s personality profile could be devastatingly effective.

It is easy to discuss a different approach to advertising at an abstract level, but translating a philosophy into concrete methods can be a challenge. The best way to illustrate person-centric advertising is with some examples. Consider Bob, an electrical engineer. Bob graduated from the University of Michigan in 2002 and has been working at Intel since graduation. Given Bob’s education, time since graduation, and employer, Facebook could accurately estimate his salary. Also, on September 10th 2003, Bob’s relationship status changed from engaged to married. Although Facebook does not know his exact wedding date, the chances are that he was married at the beginning of September 2003. When August of 2008 rolls around, Bob’s 5th wedding anniversary should be coming up soon. Silverware is a typical gift for the 5th anniversary, so Facebook can show an advertisement for silverware that is in Bob’s expected price range based on his salary. The ad not only reminds Bob of an important purchase he is already planning to make, but also gives him a great suggestion for what to buy.

For our second example, consider two young men, David and Josh. During the past few years, David has visited New York City, Paris, and London. Facebook knows this because David was tagged in photo albums from those locations. Josh, on the other hand, has traveled to Whistler, British Columbia, Montana, and the Swiss Alps. David is clearly more interested in vacationing to big cities, while Josh enjoys outdoor excursions. When it comes time for vacation season, an ad for cheap flights to Alaska should be sent Josh’s way, while a hotel package in Prague would be most appropriate for David. Research would be needed to quantify the impact of this type of advertising over Facebook’s current model, but it is probably huge.

The anniversary and vacation examples are fairly straightforward, but how can Facebook systematically apply this new advertising strategy? What they need to do is analyze each of their members and create a list of potential market segments. The market segments could have varying levels of granularity and could include things like outdoor vacations, wedding gifts for a young middle-income couple, luxury women’s apparel, etc. After a list of possible segments has been created for each user, Facebook could assign weights to each one based on the level of confidence in its analysis. For example, someone who has visited Colorado once might be a skier. Someone who has visited Vail, Aspen, Breckenridge, Whistler, and Salt Lake City all during the winter and lists “skiing” as their primary interest is surely a serious skier. As the final piece of the puzzle, Facebook could multiply market segment confidence by ad bids to maximize profits.

I imagine a future where Facebook actually understands who I am and makes my life easier by displaying ads for things that I want to buy. Hopefully this will happen sooner than later for our sake, but also for Mark Zuckerberg’s.

This entry was posted on Friday, November 21st, 2008 at 7:15 pm and is filed under Phishing, Articles. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.