Systems and methods are provided in the field of online advertising and malicious software. In some embodiments, a method for determining a degree of deceptiveness for a session is provided, the session having one or more relationships between one or more properties of interactions with an online advertisement, the method comprising: extracting one or more characteristics associated with each of the one or more relationships; applying one or more models to each of the one or more relationships to determine a degree of deceptiveness for each of the one or more relationships; aggregating the degree of deceptiveness for each of the one or more relationships to generate the degree of deceptiveness for the session.