Granted Patent B2

US 10,193,908 · App. 15/672,149 · Granted Jan 29, 2019

Abstract

Claims (40)

1. A method for analyzing network interaction data for detection of network interaction fraudulence, the method comprising:

receiving network interaction data from a network over time, wherein the network interaction data is indicative of computer network interaction between a first computer system and a second computer system;

receiving a predetermined model comprising predetermined values associated with network interaction parameters;

processing the received network interaction data to determine the network interaction parameters and information regarding the network interaction data, wherein the information regarding the network interaction data is indicative of an attribute of the computer network interaction;

calculating a score for the network interaction data based on the predetermined model and the determined network interaction parameters;

comparing the score to a threshold; and

forwarding, based on the comparison of the score to the threshold, the information regarding the network interaction data, wherein the information regarding the network interaction data is further indicative of network interaction fraudulence.

2. The method of claim 1 , wherein the information regarding the network interaction data comprises metadata regarding the network interaction data.

3. The method of claim 2 , wherein the metadata comprises an IP address, a time stamp, an assessment of whether the IP address is a source of fraudulent network interactions, referrer information, the score, interclick time, interclick distributions, click statistics, HTTP data, TCP data, machine fingerprint data, or user fingerprint data.

4. The method of claim 3 , wherein the metadata indicates a source IP address that has been involved with spam, a source IP address is not available for tracing, a user that visited a predetermined number of sites without a conversion, a spacing between clicks has the same timing, a source IP address has recently sent a predetermined number of spam or phishing emails, a source IP address cannot be located with a probe within a predetermined amount of time, or a predetermined number of network interactions within a predetermined amount of time have the same source IP address.

5. The method of claim 3 , wherein the HTTP data includes a date, a time, a client IP address, a user name, a uniform resource identifier (URI) stem, a URI query, a protocol status, bytes sent, a user agent, a referrer, or a cookie.

6. The method of claim 3 , wherein the TCP data includes a source port, a destination port, a sequence number, an acknowledgement number, a data offset, control flags, a window, a checksum, an urgent pointer, or padding.

7. The method of claim 3 , wherein the machine fingerprinting data includes machine hardware characteristics, browser settings, browser environment, browser customization, or timing information between the machine and other machines.

8. The method of claim 3 , wherein the user fingerprint data includes user keystrokes, mouse movements, timing of the user keystrokes, or timing of the mouse movements.

9. The method of claim 1 , wherein forwarding the information regarding the network interaction data comprises forwarding the information regarding the network interaction data to at least one aggregator.

10. The method of claim 9 , wherein forwarding the information regarding the network interaction data to the at least one aggregator comprises determining one or more aggregators to which the information regarding the network interaction data is to be forwarded.

11. The method of claim 1 , wherein receiving the predetermined model comprises generating a model comprising values associated with other network interaction parameters.

12. The method of claim 1 , wherein comparing the score to the threshold comprises detecting a fraudulent network interaction.

13. A system for analyzing network interaction data for detection of network interaction fraudulence, the system comprising:

at least one processor; and

a memory in electrical communication with the at least one processor, wherein the memory stores instructions which when executed cause the at least one processor to perform operations comprising:

receive network interaction data from a network over time, wherein the network interaction data is indicative of computer network interaction between a first computer system and a second computer system;

receive a predetermined model comprising predetermined values associated with network interaction parameters;

process the received network interaction data to determine the network interaction parameters and information regarding the network interaction data, wherein the information regarding the network interaction data is indicative of an attribute of the computer network interaction;

calculate a score for the network interaction data based on the predetermined model and the determined network interaction parameters;

compare the score to a threshold; and

forward, based on the comparison of the score to the threshold, the information regarding the network interaction data, wherein the information regarding the network interaction data is further indicative of network interaction fraudulence.

14. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor of a computing system, cause the computing system to perform a method for analyzing network interaction data for detection of network interaction fraudulence, the method comprising:

receiving network interaction data from a network over time, wherein the network interaction data is indicative of computer network interaction between a first computer system and a second computer system;

receiving a predetermined model comprising predetermined values associated with network interaction parameters;

processing the received network interaction data to determine the network interaction parameters and information regarding the network interaction data, wherein the information regarding the network interaction data is indicative of an attribute of the computer network interaction;

calculating a score for the network interaction data based on the predetermined model and the determined network interaction parameters;

comparing the score to a threshold; and

forwarding, based on the comparison of the score to the threshold, the information regarding the network interaction data, wherein the information regarding the network interaction data is further indicative of network interaction fraudulence.

15. The method of claim 1 , wherein the first computer system comprises a client computer system and the second computer system comprises a server computer system.

16. The method of claim 15 , wherein the server computer system is associated with at least one of an advertiser and an advertising network.

17. The system of claim 13 , wherein the first computer system comprises a client computer system and the second computer system comprises a server computer system.

18. The system of claim 17 , wherein the server computer system is associated with at least one of an advertiser and an advertising network.

19. The non-transitory computer-readable medium of claim 14 , wherein the first computer system comprises a client computer system and the second computer system comprises a server computer system.

20. The non-transitory computer-readable medium of claim 19 , wherein the server computer system is associated with at least one of an advertiser and an advertising network.

Assignments (10)