Granted Patent B1

US 10,387,911 · App. 13/909,018 · Granted Aug 20, 2019

Inventors: Jason Lloyd Shaw (New York, NY); David William Luttrell (Philadelphia, PA); Arun Ahuja (Samford, CT)

Assignee: Integral Ad Science, Inc.

G06Q30/0248

Abstract

Claims (63)

1. A method for detecting suspicious activity from a plurality of websites, the method comprising:

collecting, by a server that includes a hardware processor, advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculating, by the hardware processor, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregating, by the hardware processor, the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculating, by the hardware processor, a domain-level never-in-view statistic in response to the aggregating;

classifying, by the hardware processor, the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determining, by the hardware processor, additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generating, by the hardware processor, a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibiting, by the hardware processor, inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.

2. The method of claim 1 , further comprising transmitting information relating to the potentially suspicious domain that inhibits an advertiser from associating with the potentially suspicious domain.

3. The method of claim 1 , wherein the never-in-view statistic comprises a fraction of advertisement impressions that was never in the viewable area of the browser window.

4. The method of claim 3 , wherein the domain is classified as the potentially suspicious domain based on the domain-level never-in-view statistic further comprises determining that the domain-level never-in-view statistic exceeds a selected threshold value, wherein the selected threshold value indicates that the domain is engaging in suspicious activity.

5. The method of claim 1 , further comprising:

generating a distribution of spoofing rates associated with the collected advertisement impression information;

dividing the generated distribution of spoofing rates into a first sub-distribution of normal websites and a second sub-distribution of suspicious websites using a mixture model, wherein the domain is classified as the potentially suspicious domain based on relative strength between the first sub-distribution and the second sub-distribution.

6. The method of claim 1 , further comprising:

determining a plurality of browsers associated with advertisement calls for one or more advertisement impressions from the collected advertisement impression information.

7. The method of claim 1 , further comprising:

extracting identification data associated with the potentially suspicious domain;

searching for other websites having identification data that is similar to the extracted identification data; and

determining whether at least one of the other websites should be deemed as likely to be suspicious.

8. The method of claim 1 , further comprising:

receiving training data;

identifying features for differentiating suspicious websites from normal websites using the received training data; and

identifying the suspicious websites from the plurality of pages associated with the collected advertisement impression information using a classifier with the identified features.

9. A system for detecting suspicious activity from a plurality of websites, the system comprising:

a memory; and

a hardware processor that, when executing computer-executable instructions stored in the memory:

collects advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculates, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregates the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculates a domain-level never-in-view statistic in response to the aggregating;

classifies the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determines additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generates a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibits inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.

10. The system of claim 9 , wherein the hardware processor transmits information relating to the potentially suspicious domain that inhibits an advertiser from associating with the potentially suspicious domain.

11. The system of claim 9 , wherein the never-in-view statistic comprises a fraction of advertisement impressions that was never in the viewable area of the browser window.

12. The system of claim 11 , wherein the hardware processor determines that the domain-level never-in-view statistic exceeds a selected threshold value, wherein the selected threshold value indicates that the domain is engaging in suspicious activity.

13. The system of claim 9 , wherein the hardware processor:

generates a distribution of spoofing rates associated with the collected advertisement impression information;

divides the generated distribution of spoofing rates into a first sub-distribution of normal websites and a second sub-distribution of suspicious websites using a mixture model, wherein the domain is classified as the potentially suspicious domain based on relative strength between the first sub-distribution and the second sub-distribution.

14. The system of claim 9 , wherein the hardware processor:

determines a portion of the plurality of pages corresponding to a website;

determines one or more advertisements presented on the portion of the plurality of pages; and

determines a plurality of browsers associated with advertisement calls for one or more advertisement impressions from the collected advertisement impression information.

15. The system of claim 9 , wherein the hardware processor:

extracts identification data associated with the potentially suspicious domain;

searches for other websites having identification data that is similar to the extracted identification data; and

determines whether at least one of the other websites should be deemed as likely to be suspicious.

16. The system of claim 9 , wherein the hardware processor:

receives training data;

identifies features for differentiating suspicious websites from normal websites using the received training data; and

identifies the suspicious websites from the plurality of pages associated with the collected advertisement impression information using a classifier with the identified features.

17. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting suspicious activity from a plurality of websites, the method comprising:

collecting advertisement impression information associated with a plurality of pages corresponding to a plurality of domains from one or more advertising devices;

calculating, from the collected advertisement impression information, a never-in-view statistic for each of the plurality of pages, wherein the never-in-view statistic for each of the plurality of pages corresponds to a likelihood that an advertisement displayed on a page was never within a viewable area of a browser window rendered by a browser application;

aggregating the never-in-view statistic for the plurality of pages corresponding to a domain of the plurality of domains;

calculating a domain-level never-in-view statistic in response to the aggregating;

classifying the domain as a potentially suspicious domain based on the domain-level never-in-view statistic, wherein the domain is classified as being the potentially suspicious domain based on the domain-level never-in-view statistic being greater than a threshold value;

determining additional domains from the plurality of domains having domain-level never-in-view statistics similar to the domain-level never-in-view statistic;

generating a list of pages associated with the potentially suspicious domain and the determined additional domains; and

inhibiting inventory associated with the potentially suspicious domain and the determined additional domains from being purchased via a real-time bidding exchange.

Assignments (9)

Continuity (1)

Cited By (1)

US 12,361,452