I started up a thread titled "PPC Advertising, Click Fraud, and Its Effect on Search Engines" on the TELECOM Digest recently, in the hopes of trying to find some sources of technical discussion on the issue. One of the responses I got was somewhat disconcerting, although expected:

   me: I have described many scenarios such as this where there is no
       reliable way to differentiate them from clickstreams where the users
       do not find what they are looking for at the advertiser's site, or
       decide (non-fraudulently) not to buy, or are just window shopping.

   Yup that's the point. It's *impossible* to do so. Which answers your
   question about "why aren't people working on better fraud-detection?"
   Those who have seriously looked at the problem recognize that
   detecting such actions 'in progress' chews up exorbitant amounts of
   resources, and costs more than the fraud does. The 'simple' stuff --
   e.g. paying only for 'unique' clicks over time -- kills off all but
   the sophisticated fraudster. The sophisticated fraudster, on the
   other hand, is effectively _impossible_ to so much as slow down.

I was hoping this might turn into some kind of business opportunity for me, but that might not happen. There are some companies that do that, and some of the bigger search engines do that in-house, but either they're not hiring, or I don't have the right background for the openings. Because there are so many companies, I'm not sure if the market will support any more. (I suspect many of these companies will eventually have to consolidate.)

There doesn't seem to be much interest in the open-source community either, at least based on looking around the Apache, web stats, and intrusion detection communities. OTOH, there is a sizable and growing open-source movement to fight email spam. Perhaps that's because there are far fewer people who are affected by click fraud than email spam. Although I imagine there's a fair amount of geeks who support their web sites through programs like AdSense, but perhaps they're not targets of click fraud (yet), or they don't notice it enough to matter. I've heard of a few people whose AdSense accounts have been shut down because their ads on their sites received an inordinate amount of clicks, but perhaps it hasn't affected the people who run these sites enough to try to do something about it.

Also, as a result of engaging in the debates over what is/isn't click fraud, and exploring possible solutions, my bp has gone up again and I'm not sleeping well. :( I wish I could figure out how to make a living while maintaining good health ...