Okay, this is my final big blob of output on this topic. I'll put my results on a wiki page and link to it in Phabricator.

—Trey

TL;DR We get some ridiculously long queries (up to 5K characters)—lots are junk. We are also getting a Zerg Rush from bots:
   - DOI and "timestamp" queries are everywhere (automata).
   - We have lots of searches for energy-related articles (automaton?).
   - There's a likely automaton searching for term+term+term country
   - spam-looking queries for <manufacturing terms> ## de tel fax
   - paint bot: ""<artist>"" paint and <wikimedia commons file name> paint
   - Chinese product descriptions and part numbers/phone numbers/etc.

• I reviewed two samples similar to my original one, from a week before and from two weeks before, and found the distribution of zero-result queries was generally similar, though one week dewiki got ~30K (~60%) more. DOI searches ranged from ~15K to ~100K (!!) and "unix timestamp" searches ranged from 26K to 42K.

• Boolean AND queries were also within a factor of two in the other samples. quot queries and " film" queries were very similar.

• I mentioned very long queries before. Here's a breakdown by length (the categories overlap):

length count
150+ 2262
200+ 725
300+ 435
400+ 331
500+ 261
1000+ 120
2000+ 59
3000+ 24
4000+ 10
5000+ 1

Some of the DOI queries are over 150 characters, and make the list. The really long ones often look like random bits of text.


• A regular fixture in the top 100 zero-result queries per day is a 173-character string from a particular novel (Google Books found it right away). That's just weird.


• I looked at crosswiki zero-results searches and broke out the individual words in the queries to find recurring patterns. I've noted ones that have ~1000 instances. (Even 0.2% is a fair chunk for a single phenomenon.)

There are lots of DOI-related terms, of course, and our old friend "quot", lots of URL bits. {searchTerms} shows up 1998 times (mostly in ru). search_suggest_query shows up 440 times (en, de, fr, sv, nl and others).

There are lots of words related to searching for articles about energy: wind, power, turbine, energy, etc. Lots of long titles are included in several formats. I think this may also be a bot.

• There's a weird pattern, largely in eswiki, but some in enwiki and frwiki, where there are a bunch of search terms joined by +, followed by space and the name of a country. Australia, Austria, Bangladés, Bélgica, and Argentina are most used, but there are ~90 different countries (sometimes the same countrty with its name in different languages), for >5600 total instances. The alphabetic skew may or may not be related to the size of my sample.


   1719  Australia
   1682  Austria
    659  Bangladés
    537  Bélgica
    519  Argentina
    119  Bolivia
...


There are 2380 more instances in es wiki of a bunch of words mushed together with +'s

Looking at them in order in the logs, the are largely in alphabetical order.

A one-week earlier sample had fewer, a two-week earlier sample has even more.

Another likely bot.

• There are lots of intitle searches. Many in nlwiki (out of 355) and frwiki (out of 414) are for names who seem not to be in that wiki. Most failed intitle searches in enwiki (out of 504) are in Spanish or Portuguese. The rest are <100 instances, so I didn't investigate.

Similar patterns in the other two samples.

• There's a weird pattern (1293 instances), all in dewiki, like this:
<manufacturing terms> ## de tel fax

<manufacturing terms> includes injection molding, stone cutting die casting, etc.

Other samples have a similar pattern.

• Another weird pattern (953):
""<artist>"" paint <-- literally double double quoted.
and (~140)
<wikimedia commons file name> paint

All on enwiki, and the commons file names don't include the file type (e.g., ".jpg").

The same or more in other samples.

• 989 instances of this on enwiki
<descriptions of products in chinese> *###########*QQ########座机###########*<misc>.<misc>.xyz

座机 = "landline"
<misc> = letters, numbers, an transliterated Chinese (Pinyin?)

Online searches for parts of these reveal a similar pattern on Chinese-language business/manufacturing sites.

The same in samples from other weeks.

• Finally, I reviewed the larger collections of zero-results (10K+ from a gven wiki). My ability to analyze languages I don't know is limited, but here are some very brief impressions:

- dewiki has a few hundred OR'd together wildcard searches, some of which seem to be trying handle variations in declension.
- jawiki has lots of " film" searches.
- ruwiki has a few non-cyrillic searches
- itwiki has lots of queries that are multi-word phrases with underscores instead of spaces
- eswiki and frwiki have a fair number of build up searches and searches in Arabic, and frwiki has a fair number of searches in Chinese
- zhwiki has lots of non-Chinese searches in various languages

Trey Jones
Software Engineer, Discovery
Wikimedia Foundation


On Tue, Jul 28, 2015 at 3:57 PM, Trey Jones <tjones@wikimedia.org> wrote:
Hi everyone,

I've broadened my analysis from enwiki to the other larger wikis, looking at the same phenomena I found in enwiki.

While the DOI searches are definitely an issue across 25 wikis, with the other earlier-identified issues some are cross-wiki and some are not.

TL;DR: After DOI searches, "unix timestamp" searches are the biggest cross-wikipedia issue. Weird AND queries and quot queries are big contributors on enwiki, which make them important overall. We could easily fix the unix timestamp queries (either auto correct or make suggestions), and we could fix lots of the quot queries. All of these could be included in the category of "automata" that could potentially be separated from regular queries, and it wouldn't hurt to track down their sources and help people search better.

The <unix-timestamp-looking number>:<wiki title> format (with a small number with a space after the colon) is spread across 45 wikis, with 28,089 instances out of 500K (~5.6%). More than half of the results are enwiki (15,961), but there are 3133 on ru, 2986 on it, 1889 on ja, and hundreds on tr, fa, nl, ar, he, hi, id, and cs. At a cursory glance, all seem to be largely named entities or queries in the appropriate language. Removing the "14###########:", tracking down the source, or putting this on the automata list would help a lot.

The boolean AND queries are largely in enwiki (17607: ~3.5% overall, ~7.9% in enwiki), and they are a mixed bag, but many (626) appear with quot, and most (16657) are of the form 
"article_title_with_underscore" AND "article title without underscores"
where the first half is repeated over and over and the second half is something linked to in the first article. Find the source and add to the automata list.

In plwiki (263), the AND queries are all of the form 
*<musical thing>* AND (muzyk* OR Dyskografia)
where <musical thing> seems to be an artist, band, album, or something similar. This looks like an automaton, but may not be worth pursuing. Similarly the ones from nl.

Globally, OR queries are much more common. 46,035 (~9.2%), spread much more evenly over all the wikis. These are almost all the DOI queries.

quot is totally an enwiki thing. It's ~1.2% overall and ~2.8% in enwiki in this sample, which is a lot for one small thing. We should either create a secondary search with filtered quot or track down the source and help them figure out how to do better.

TV episodes and films ("<title> S#E#" film) are mostly on enwiki (~1.1% overall, ~2.4% of enwiki queries), with some on ja, fr, and de, and single digits on it and ru. I'd count this as automata, though finding a source would be nice.

Strings of numbers do happen everywhere, but are only common on enwiki, with less on jawiki, and much less on de, fr, ru, vi, and nl.

My last bit of analysis will later this week, and I'll try to look at non-English and/or cross-wiki stuff, write it all up in Phabricator, and move on.

On Tue, Jul 28, 2015 at 9:51 AM, Trey Jones <tjones@wikimedia.org> wrote:
Okay, I have a slightly better sample this morning. (I accidentally left out Wikipedias with abbreviations longer than 2 letters).

My new sample:
500K zero-result full_text queries (web and API) across the Wikipedias with 100K+ articles
383,433 unique search strings (that's a long, long tail)
The sample covers a little over an hour: 2015-07-23 07:51:29 to 2015-07-23 08:55:42
The top 10 (en, de, pt, ja, ru, es, it, fr, zh, nl), account for >83% of queries

Top 10 counts, for reference:
 221618  enwiki
  51936  dewiki
  25500  ptwiki
  24206  jawiki
  21891  ruwiki
  19913  eswiki
  18303  itwiki
  14443  frwiki
  11730  zhwiki
   7685  nlwiki
-----
417225

The DOI searches that appear to come from Lagotto installations hit 25 wikis (as the Lagotto docs said they would), with en getting a lot more, and ru getting fewer in this sample, and the rest very evenly distributed. (I missed ceb and war before—apologies). The total is just over 50K queries, or >10% of the full text queries against larger wikis that result in zero results.

===DOI
   6050 enwiki
   1904 nlwiki
   1902 cebwiki
   1901 warwiki
   1900 viwiki
   1900 svwiki
   1900 jawiki
   1899 frwiki
   1899 eswiki
   1899 dewiki
   1898 zhwiki
   1898 ukwiki
   1898 plwiki
   1898 itwiki
   1897 ptwiki
   1897 nowiki
   1897 fiwiki
   1896 huwiki
   1896 fawiki
   1896 cswiki
   1896 cawiki
   1895 kowiki
   1895 idwiki
   1895 arwiki
    475 ruwiki
-----
50181

On Mon, Jul 27, 2015 at 5:04 PM, Trey Jones <tjones@wikimedia.org> wrote:
 
I've started looking at a 500K sample from 7/24 across all wikis. I'll have more results tomorrow, but right now it's already clear that someone is spamming useless DOI searches across wikis—and it's 9% of the wiki zero-results queries.