The Machine Learning Solution: How We Built a Two-Tower ML Model to Fix Broken Web Analytics

Any conversation about enterprise web analytics usually starts with beautiful dashboards. Marketers proudly present Return on Marketing Investment (ROMI) charts, claiming that every dollar spent brings three in return. But if you put on an engineer’s hard hat and go down into the data warehouse basement, you will see a massive, gaping black hole. Its name is (direct).

In today’s reality, 30% to 50% of traffic in a large e-commerce project falls into the “Direct” or “(not set)” bucket. Marketing platforms simply shrug their shoulders, while businesses keep pouring millions into advertising channels based on broken, distorted data.

This article is the story of creating Analytics Firewall V2.0. It is an architecture that refuses to trust the default, out-of-the-box settings of Google Analytics 4. Instead, it uses an ensemble of machine learning algorithms to pull the true traffic sources out of the informational void. There is no magic here, and absolutely no marketing nonsense. It is just hardcore data engineering, decision trees, and strict cost optimization (FinOps).

Chapter 1. The Anatomy of a Disaster: Where Does “Dark Direct” Come From?

To cure a disease, you must first understand how it works. Why, in 2026, when AI is writing software, are we still losing simple UTM tracking tags? There are three fundamental reasons:

1. Apple’s Crusade Against Tracking (ITP). Apple’s Intelligent Tracking Prevention is ruthless. Safari cuts off the tails of tracking links, blocks third-party cookies, and reduces the lifespan of first-party cookies to just 24 hours if a user comes from an ad click.
2. Messengers and In-App Browsers. When a user clicks a link in Telegram, Viber, or Instagram, the app opens it in a built-in browser (WebView). During this transition, the HTTP Referrer header is often erased or replaced. The analytics system just sees a “clean,” direct visit.
3. Complex Redirects. Mobile banking apps, cashback websites, and affiliate networks often push a user through three or four redirects before finally sending them to your website. By the time the user arrives, the UTM tag is long dead.

As a result, your analytics dashboard shows an absurd picture: a user on a mobile phone at 10:00 PM suddenly types an 85-character URL by hand—something like .../category/shampoo-loreal-elseve-300ml. GA4 simply logs the source as (direct). From a human perspective, this makes no sense. Nobody types links like that. But out-of-the-box analytics does not have common sense; it only looks for specific parameters, and if they are missing, it gives up.

Chapter 2. The Evolution of a Mistake: How NOT to Build ML

When this problem started costing the business hundreds of thousands of dollars in wrongly attributed conversions, we brought in the heavy artillery: Machine Learning. However, our first attempts were a classic example of Data Science crashing into the harsh reality of Data Engineering.

The Monolith Mistake and Overfitting

The first idea sounded great in theory: let’s take all the raw server logs, throw them into a giant neural network, give it the user_id, and let it find the hidden patterns.

What actually happened? The algorithm caught a severe case of overfitting. When the model saw unique user IDs (millions of them), it stopped looking for general behavioral rules. Instead, it tried to blindly memorize the database. It decided that if User 12345 came from Facebook yesterday, then every future visit from User 12345 must also be Facebook. As soon as a brand-new, unknown user visited the site, the model froze and generated random noise because it didn’t have a “cheat sheet” for that specific person.

The BigQuery Pain (A FinOps Nightmare)

The second problem was the cost. Running a massive, monolithic model for every single event in BigQuery is a guaranteed way to get a Google Cloud invoice that will make your Chief Financial Officer cry. Calculating complex data aggregations (like “the user’s dominant channel over their lifetime”) required full scans of petabyte-sized tables.

We realized we needed a system that wasn’t just smart, but cheap, predictable, and context-aware.

Chapter 3. Analytics Firewall V2.0: The Two-Tower Architecture

The breakthrough came when we realized that web traffic is not all the same. You cannot treat brand-new users and loyal returning customers with the same mathematical pill. We designed a new architecture consisting of three layers: an SQL Router and two independent ML models powered by XGBoost (Gradient Boosted Decision Trees).

Layer 1: The Deterministic SQL Gateway (Saving the Budget)

We quickly realized that we do not need machine learning for 70% of our traffic. If a link contains a gclid (Google’s click ID) or an fbclid (Facebook’s click ID), the probability of the source is 100%. We wrote a strict SQL script that catches these perfect sessions, cleans them, and sends them straight to the final database.

Only the “garbage” traffic—empty sources, broken referrals, and fake direct visits—falls into the ML pipeline. This simple step reduced our computing costs by four times.

Layer 2: Model A (The Sequential Booster for Returning Users)

This model only looks at users who have a history with the website. The main driver of prediction here is time delays and past touchpoints.

The model relies heavily on a feature called prev_clean_source (the true source of their last visit) and the time passed since that visit. The XGBoost math perfectly calculates the “half-life” of an ad click. If a user clicked an Instagram ad two hours ago, and now they return via (direct), the model will link these events with 85% confidence. But if 40 days have passed, the algorithm understands that the ad is “cold” and starts looking for clues in the user’s current behavior instead.

Layer 3: Model B (The Cold Start Profiler)

This is where the real magic happens. How do you predict a traffic source for a person who is visiting your site for the very first time, when all tracking tags are erased? There is no history to look at.

We solved this “Cold Start” problem by feeding the model behavioral micro-factors. The model does not look for the user’s past; it looks for statistical “twins” (Lookalikes) based on the current context. It calculates probabilities based on device, time, and behavior patterns.

Chapter 4. The Feature Store: The Art of Selecting Data

You cannot feed garbage to an AI and expect gold. For this architecture to work, we had to be ruthless with our data. We threw away dozens of metrics and kept only 19 highly optimized parameters. Here are the most powerful ones—the features that can replace an entire marketing department:

• is_logged_in (The Authorization Flag). This is our replacement for the raw user_id. The brilliance of this feature lies in its paradox. If the system sees a “new” direct session, but the user is already logged in when the page loads, it is physically impossible for this to be organic search or a typed URL. The user must have clicked a special, pre-authorized link from an email newsletter, a Viber bot, or a mobile app push notification where the UTM tag fell off. Model B instantly classifies this as CRM traffic.
• referrer_domain (The Cleaned Referrer). According to HTTP rules, true (direct) traffic does not have a referring website. The value should be completely empty. If Google Analytics says the source is “Direct,” but the referrer box contains l.instagram.com, it is a tracking failure. We extract the domain, and XGBoost confidently links the session back to social media.
• session_velocity (Events per Minute). This is a calculated feature. We divide the number of clicks and scrolls by the time spent on the site. Why? To separate thoughtful Google Search users (who read a product review for 5 minutes) from fast-paced TikTok or Instagram users (who scroll 20 times in 10 seconds). The speed of interaction is the unique handwriting of the traffic channel.
• landing_page_type (URL Depth). Nobody types the long address of a specific product page by hand. If a user lands deep inside the website catalog on their very first “direct” visit, Model B knows it is the leftover trace of a targeted ad.

We also deleted heavy, expensive metrics like “days since the very first purchase” and replaced them with lightweight 30-day windows (purchases_last_30_days) to estimate the user’s loyalty profile on the fly without burning our cloud budget.

Chapter 5. Why It Beats the Market

What does the market usually offer a business that is tired of broken analytics?

1. Blind faith in GA4 Data-Driven Attribution. This is a black-box algorithm. Google essentially decides for itself which Google Ads campaign deserves the credit, often ignoring Facebook or SEO. You cannot see the math inside.
2. Expensive Customer Data Platforms (CDPs). Software vendors offer massive integrations that cost hundreds of thousands of dollars a year, promising to stitch all your data together. But you end up with a slow, heavy system and total vendor lock-in.

The Analytics Firewall solves this problem much more elegantly.

• The Cost Advantage: All calculations happen inside your own BigQuery environment. Because the SQL router filters out 70% of the easy traffic, the ML models only process the daily leftovers. Instead of spending hundreds of dollars per run, you spend cents.
• The Custom Fit (White-Box AI): Unlike standard tools, we control every single parameter. If a business has a unique URL structure for B2B partners, we just add it as a new rule. We do not force the business to adapt to the algorithm; we wrap the algorithm around the unique shape of the business.

Data engineering does not tolerate illusions. Just because you have a million rows in your database does not mean you actually have information. Garbage In means Garbage Out.

Using machine learning for marketing attribution is not a magic wand that creates tracking tags out of thin air. It is a highly precise shovel. The XGBoost algorithm takes the dust of digital footprints—the browser type, the time of day, the click speed, the length of the URL—and rebuilds the burned bridges between your advertising budget and real sales with 95% accuracy.

When you finally look at your dashboard and see 40% of your useless “Direct” traffic magically separate into crystal-clear cohorts of Paid Social, CRM, and Organic Search, you realize something important: investing in your own data infrastructure, rather than hiring yet another advertising agency, was the best business decision of the year.