Methods and apparatus to identify media distributed via a network
Methods, apparatus, systems and articles of manufacture to monitor media presentations are disclosed. An example method includes extracting first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page, storing the first network packet parameters in association with identifying information for the first encrypted web page, extracting second network packet parameters from a second network packet received at the media device from an unknown encrypted web page, when the extension does not collect identifying information for the unknown encrypted web page, comparing the second network packet parameters to the first network packet parameters, and identifying the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.
1. A method for monitoring a media device, the method comprising:
extracting, by executing an instruction with a processor, first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page;
storing the first network packet parameters in association with identifying information for the first encrypted web page, the identifying information collected by an extension in a web browser at the media device;
extracting, by executing an instruction with the processor, second network packet parameters from a second network packet received at the media device from an unknown encrypted web page;
when the extension does not collect identifying information for the unknown encrypted web page, comparing, by executing an instruction with the processor, the second network packet parameters to the first network packet parameters; and
identifying, by executing an instruction with the processor, the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.
2. The method as defined in claim 1 , wherein the extension does not collect identifying information because the extension is inoperative.
3. The method as defined in claim 2 , further including detecting that the extension is inoperative.
4. The method as defined in claim 2 , wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.
5. The method as defined in claim 1 , wherein comparing the second network packet parameters to the first network packet parameters includes:
determining a set of similarities for the parameters in the second network packet parameters; and
determining the similarity as an average of the set of similarities.
6. The method as defined in claim 1 , wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.
7. The method as defined in claim 1 , wherein the identifying information is a uniform resource locator.
8. An apparatus for monitoring a media device, the apparatus comprising:
a parameter extractor to extract first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page, store the first network packet parameters in association with identifying information for the first encrypted web page, the identifying information collected by an extension in a web browser at the media device, and extract second network packet parameters from a second network packet received at the media device from an unknown encrypted web page; and
an identifier to, when the extension does not collect identifying information for the unknown encrypted web page, compare the second network packet parameters to the first network packet parameters and identify the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.
9. The apparatus as defined in claim 8 , wherein the extension does not collect identifying information because the extension is inoperative.
10. The apparatus as defined in claim 9 , further including a browser extension data receiver to detect that the extension is inoperative.
11. The apparatus as defined in claim 9 , wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.
12. The apparatus as defined in claim 8 , wherein identifier is to compare the second network packet parameters to the first network packet parameters by:
determining a set of similarities for the parameters in the second network packet parameters; and
determining the similarity as an average of the set of similarities.
13. The apparatus as defined in claim 8 , wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.
14. The apparatus as defined in claim 8 , wherein the identifying information is a uniform resource locator.
15. A non-transitory computer readable medium comprising instructions that, when executed, cause a machine to at least:
extract first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page;
store the first network packet parameters in association with identifying information for the first encrypted web page, the identifying information collected by an extension in a web browser at the media device;
extract second network packet parameters from a second network packet received at the media device from an unknown encrypted web page;
when the extension does not collect identifying information for the unknown encrypted web page, compare the second network packet parameters to the first network packet parameters; and
identify the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.
16. The non-transitory computer readable medium as defined in claim 15 , wherein the extension does not collect identifying information because the extension is inoperative.
17. The non-transitory computer readable medium as defined in claim 16 , wherein the instructions, when executed, cause the machine to detect that the extension is inoperative.
18. The non-transitory computer readable medium as defined in claim 16 , wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.
19. The non-transitory computer readable medium as defined in claim 15 , wherein the instructions, when executed, cause the machine to compare the second network packet parameters to the first network packet parameters by:
determining a set of similarities for the parameters in the second network packet parameters; and
determining the similarity as an average of the set of similarities.
20. The non-transitory computer readable medium as defined in claim 15 , wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.
21. The non-transitory computer readable medium as defined in claim 15 , wherein the identifying information is a uniform resource locator.