I have an idea for a "pay per click" model web service.

One problem though is click fraud.

Are there any reliable ways of filtering out bots
and other fraudulent clicks.

Maybe a .htaccess redirects?
Maybe limit the number of click throughs per IP address?

Any ideas welcome.

Are there any reliable ways of filtering out bots
and other fraudulent clicks.

If you find one, patent it immediately!

It can be difficult when proxies are involved. I use google adwords and always monitor my logs routinely.

Look at your adwords clicks, and look for similar IPs and duration of visit. On the off chance there may be some repetivie clicking if you get a lot of clicks within a short period of time from the same IP, report that.

If you have a high number of people clicking your ads but staying less than 10 seconds, but your page copy and content is relevant and high quality, report that.

As long as you have the raw data to prove this, google will always refund your ad costs. And they appreciate this as it helps them weed out spammers.

Edit:

I re-read your post, I guess you were talking about this from a merchant point of view. I guess you will have to build your inhouse system with clever coders to deal with this, google has a pretty decent click-fraud detection service. I guess it will involve repetitive IP ad click removal, removal of clicks from known proxy servers, using session cookies