Many publishers and advertisers alike cite ad fraud as a big problem in the industry — it cost advertisers an estimated $7 billion in 2016.

The good news: the number of robot traffic detected on advertising campaigns in 2018 is 32%, down from 60% in 2017, according to a new report from Dianomi, a native content marketing platform.

The bad news: that figure varies greatly by month, and in April 2017 was as high as 85%.

Dianomi’s study, which looked at hundreds of publishers using its ad platform over six years, found that up to 90% of clicks generated in an ad campaign can come from bots.

The study found bot traffic varies greatly over time and by publishers. Since 2013, bots have averaged 38% of clicks, but have varied significantly – from 27% in 2014 to 60% in 2017.

The study noted there “seemed to be little correlation between the size of the publisher in terms of the amount of clicks delivered and the percent of robot clicks.”

Robot clicks can come from both fraudulent bots and “good” bots.

Most bots (24.3%) are “impersonators,” or “bots that assume false identities to bypass security solutions,” according to Dianomi’s report.

“Good” bots are from companies like Google, which click on links to collect information from sites for its search-engine algorithm.

A graphic in Dianomi’s study shows that on average, about 28.9% of clicks on sites are from bad bots, and 22.9% are from the good ones .(The rest are from humans.)

What can publishers do to protect themselves from bots?

The Association of National Advertisers’ bot fraud report states: “Behind every big bot problem, someone is paying a traffic source.”

“When sourcing traffic, publishers should carefully measure the traffic in the same ways that we recommend advertisers do in the report and end relationships with traffic sources that have a high level of bot traffic,” Cabell De Marcellus, Chief Technology Officer at Dianomi, told Publishers Daily.

And what should advertisers do?

“When buying clicks from a publisher or other source, you must carefully measure the amount of robot traffic that may have been delivered,” the study advises. “Like measuring ad viewability of display advertising, measuring the number of robotclicks is critical to achieving ROI on your ad spend.”

A third-party platform like Neustar, DoubleVerify, IAS or MOAT, for example, can analyze clicks and look for tell-tale signs of robot behavior, as well as automatically void clicks coming from high-risk IP addresses, according to the report.

“Ask your ad partners to provide full transparency of the clicks with time, IP address, user agent and other data, and whether they have validated or voided them,” the report added.

To be extra-cautious, advertisers could pass the clicks through a Google captcha for authentication if they look suspicious.