I think the solution is that advertisers will just need to give up the idea of having reliable metrics on ads, since that's the source of the problem. It's kind of a tragedy of the commons situation: no one would use an ad network that simply distributes JPGs because it has no metrics (malware), but users will block ads that have metrics (malware). There are two solutions: give up metrics, or install an ad blocker on every machine. Ad networks are rapidly pushing us towards the latter.
Very little trust is needed, and customers don't get crazy JS on their pages. Is something wrong with this model?
Detecting fraudulent ad views and clicks.
- PPV ads that get stacked. That, several ads laid out on top of each other so that only one (if any at all) is visible.
- PPV ads that get served to bots. Sometimes purposely so, other times as a result of phantom users who replay sessions to build fake profiles for PPC purposes.
- Ad injection that replace legit ads or include new ones via browser toolbars or compromised devices.
- PPC fraud, of course, including some combined with all of the above.
- PPA fraud through cookie stuffing, meaning flooding browsers with cookies to make it look like the traffic originate from where it doesn't.
- PPA fraud through ad injection. Nothing converts better than a popover served via ad injection for the very site you're shopping on.
I'm sure I'm forgetting quite a few, but at a high level those are the main ones to be aware of. As an advertiser you generally cannot rely on the stats you're provided with.
On top of building more valuable fake user profiles for the latter two purposes, doing this allows to bypass click-density based ad fraud detection. See this article for an example of what you see when you can sometimes observe using the latter when detecting the less sophisticated fraudsters:
http://adage.com/article/digital/inside-google-s-secret-war-...
As the latter article implies, Google's team is pretty sophisticated at detecting fraud. But even then, seeing things like this suggests there are edge cases they'd like to see go away or that are hard to detect:
So no more trust required for the advertisers?
Dealing with bots, fraudulent clicks and malware is one of the things that sets some ad platforms from the really nasty ones.
I have some ideas about build a server-side ad-network, but because I imagine is very hard to get customers I dismiss it, for the same reason: You need to be "famous/large" to attract customer in the ad-space.
Edit: The other problem you'll run into is the tragedy issue I mentioned. Your ads will be blocked by most ad-blockers' scorched-Earth policy, which comes from your shitty, unethical competitors. Good luck to ya ;)
Publishers want someone to handle monetisation of their website. If they get enough traffic, they want that someone to work in-house, but if they don't, they want some one (ad network) to do it for them.
Advertisers want impressions/clicks/performance.
A (successful) ad network needs to do both, so bootstrapping invariably looks something like matchmaking in the very beginning.
If you want to find my email address and reach out, I'm happy to talk to you more about bootstrapping: I've gotten more than one ad network off the ground.
Mine are at http://elmalabarista.com
One of the things I found incredibly annoying when I was working in this area was the fact that definitions of some metrics can be so drastically different, eg. viewable impressions, completed view impressions (in video) - these difference were so huge that a video played off screen, a video played with only 1px (or 50% height) visible - have been treated as exactly the same thing.
I heard about a company that changed their way of measuring these metrics to something more realistic than... well, a video playing off-screen, whilst increasing prices, which sounds like a decent move - they ended up losing ca. 70% of their revenue.
The problem is that it's really difficult to explain your customers that you've been potentially lying to them (or at least that's the impression they might get).
Regarding the performance footprint - I recommend taking a look at the VAST/VPAID spec. It's not uncommon for an ad to fetch 3-4 xml files containing dozens of tracking pixels coming from 10s of domains. There's also no guarantee that any if the intermediate VAST files contains the right content, how long the chain is or where it comes from.
[EDIT] disclaimer: I might've used incorrect names here, since it's been quite a long time since I've worked in this area, I hope you still get the idea.
Advertising's tragedy of the commons isn't unique to the internet. Other media went through the same adoption cycle of over-promising followed by consumer backlash.
I'm hopeful we'll see advertisers return to the model of (mostly) blindly trusting their advertisers. It will be interesting to see how our largely ad-supported internet changes as a result.
I suspect tying payments to actual user actions, in particularly the user buying something, is the best solution. Affiliate marketing essentially. Its easy to verify and very tough to profitably game so the company running the ads can pay their ad network/publishers/marketing staff with confidence.
Ultimately the advertiser doesn't really care how many impressions (or whatever) they get. They care how many people buy their thing or take some specified action.
I suspect the big roadblock is that some ad networks, publishers and marketeers don't particularly want there to be a concrete ungameable metric that requires them to produce ads that actually move product. If you are counting views or clicks it is easier to look like you are succeeding than if you are only counting people who actually get their wallet out.