Methods and apparatus to prevent illicit proxy communications from affecting a monitoring result

1. A method to prevent illicit network communications from affecting a monitoring result of an audience measurement entity, the method comprising:

accessing, at the audience measurement entity, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider;

identifying a subnet represented in the log of communications;

identifying, with a processor, the subnet as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device;

generating a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication; and

providing the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting the monitoring result of the audience measurement entity.

2. The method as disclosed in claim 1 , wherein the identifying of the subnet as having originated the illicit network communication includes identifying that there are at least a threshold number of records originating from the subnet in the log of communications.

3. The method as disclosed in claim 1 , further including:

determining whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet; and

alerting an administrator of the subnet for manual inclusion in the blacklist.

4. The method as disclosed in claim 1 , further including:

determining whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet; and

alerting an administrator of the subnet for manual inclusion in the blacklist.

5. The method as disclosed in claim 1 , further including:

excluding, with the processor, records from the log of communications associated with the subnet to form a log of legitimate communications; and

processing the log of legitimate communications to credit usage of mobile computing devices.

6. The method as disclosed in claim 1 , wherein the log of communications is a current log of communications, and the blacklist includes the subnet when the subnet was identified as having originated illicit network communications in a prior log of communications from the proxy.

7. The method as disclosed in claim 6 , wherein the prior log of communications corresponds to a first period of time immediately preceding a second period of time corresponding to the current log of communications from the proxy.

8. The method as disclosed in claim 1 , wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time.

9. An apparatus to prevent illicit network communications from affecting a monitoring result of an audience measurement entity, the apparatus comprising:

a hardware logic circuit;

a proxy log filterer to access, at the audience measurement entity, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider;

a heartbeat detector to identify a subnet within the log of communications as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device; and

a blacklist generator to generate a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication, the blacklist generator to provide the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting the monitoring result of the audience measurement entity, wherein at least one of the proxy log filterer, the heartbeat detector, or the blacklist generator is implemented via the hardware logic circuit.

10. The apparatus as disclosed in claim 9 , further including a crediting processor to generate the monitoring result using a subsequent log of communications created by the proxy, the subsequent log of communications excluding communications from the subnet identified in the blacklist.

11. The apparatus as disclosed in claim 9 , further including a proxy log parser to determine whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet, the proxy log parser to identify the subnet to an administrator when there are less than the threshold number of unique user agents identified by the records of the log of communications associated with the subnet.

12. The apparatus as disclosed in claim 9 , further including a proxy log parser to determine whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet, the proxy log parser to identify the subnet to an administrator when there are greater than the threshold number of ports identified by the records of the log of communications associated with the subnet.

13. The apparatus as disclosed in claim 9 , wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time.

14. A non-transitory computer-readable medium comprising instructions which, when executed, cause a central facility of an audience measurement entity to at least:

access, at the central facility, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider;

identify a subnet represented in the log of communications;

identify the subnet as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device;

generate a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication; and

provide the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting a monitoring result of the audience measurement entity.

15. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the instructions, when executed, further cause the central facility to identify that there are at least a threshold number of records in the log of communications.

16. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the instructions, when executed, further cause the central facility to at least:

determine whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet; and

alert an administrator of the subnet for manual inclusion in the blacklist.

17. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the instructions, when executed, further cause the central facility to at least:

determine whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet; and

alert an administrator of the subnet for manual inclusion in the blacklist.

18. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the instructions, when executed, further cause the central facility to at least:

exclude records from the log of communications associated with the subnet to form a log of legitimate communications; and

process the log of legitimate communications to credit usage of mobile computing devices.

19. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the log of communications is a current log of communications, and the blacklist includes the subnet when the subnet was identified as having originated illicit network communications in a prior log of communications from the proxy.

20. The non-transitory computer-readable medium as disclosed in claim 19 , wherein the prior log of communications corresponds to a first period of time immediately preceding a second period of time corresponding to the current log of communications from the proxy.

21. The non-transitory computer-readable medium as disclosed in claim 14 , wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time.