Granted Patent B2

US 10,721,255 · App. 15/946,190 · Granted Jul 21, 2020

Abstract

Claims (57)

1. A method, comprising:

executing, on a processor of a computing device, instructions that cause the computing device to perform operations, the operations comprising:

receiving a content request over a network from a remote computer hosting a content provider service that transmits content data over the network to computing devices for rendering on displays of the computing devices;

evaluating the content request to identify request features, wherein the request features correspond to at least one of a time of the content request, characteristics of a requestor computing device of a requestor that requested the content data from the content provider service, content provider characteristics of the content provider service, or requestor behavior of the requestor;

for each request feature, assigning a feature score to a request feature based upon a score of a labeled feature corresponding to the request feature;

aggregating the feature scores to generate a content request risk score for the content request;

aggregating the content request risk score with a plurality of content risk scores for a plurality of content requests received from the content provider service to create a content provider risk score;

blocking the content provider service based upon the content provider risk score exceeding a threshold risk; and

transmitting requested content to the content provider service for the content request based upon the content provider risk score not exceeding the threshold risk.

2. The method of claim 1 , comprising:

storing the content provider risk score within a database mapping content provider risk scores to content provider services;

in response to receiving a subsequent content request from the content provider service, utilizing the subsequent content request, the content request, and the plurality of content requests to create a new content provider risk score for the content provider service; and

updating the content provider risk score within the database with the new content provider risk score.

3. The method of claim 1 , wherein the content provider risk score comprises a value indicative of a likelihood that the content provider service is fraudulent.

4. The method of claim 1 , comprising:

determining that a domain of the content provider service is being domain spoofed based upon the content provider risk score exceeding the threshold risk.

5. The method of claim 1 , wherein the content provider service is blocked based upon the content provider risk score exceeding a threshold risk, and the method comprising:

receiving a subsequent content request from the content provider service;

utilizing the subsequent content request, the content request, and the plurality of content requests to create a new content provider risk score for the content provider service; and

responsive to the new content provider risk score not exceeding the threshold risk, unblocking the content provider service and transmitting corresponding requested content to the content provider service for the subsequent content request.

6. The method of claim 1 , wherein the content request is a bid to display content of a content source through a user interface constructed using the content data.

7. The method of claim 6 , comprising:

responsive to the content provider risk score exceeding a first threshold:

transmitting the requested content to the content provider service for the content request; and

discounting a bid price paid to the content provider service for user interaction with the requested content through the user interface.

8. The method of claim 1 , wherein the characteristics of the requestor computing device comprise at least one of a country where the requestor computing device is located, a zip code where the requestor computing device is located, an IP address of the requestor computing device, a browser of the requestor computing device, an operating system of the requestor computing device, a device type of the requestor computing device, or an application name of an application of the of the requestor computing device requesting the content data.

9. A computing device comprising:

a processor; and

memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:

receiving a content request over a network from a remote computer hosting a content provider service that transmits content data over the network to computing devices for rendering on displays of the computing devices;

evaluating the content request to identify request features, wherein the request features correspond to at least one of a time of the content request, characteristics of a requestor computing device of a requestor that requested the content data from the content provider service, content provider characteristics of the content provider service, or requestor behavior of the requestor;

for each request feature, assigning a feature score to a request feature based upon a score of a labeled feature corresponding to the request feature;

aggregating the feature scores to generate a content request risk score for the content request;

aggregating the content request risk score with a plurality of content risk scores for content requests received from the content provider service to create a content provider risk score;

blocking the content provider service based upon the content provider risk score exceeding a threshold risk; and

transmitting requested content to the content provider service for the content request based upon the content provider risk score not exceeding the threshold risk.

10. The computing device of claim 9 , wherein the operations comprise:

accessing a database comprising data of content requests, content impressions, and click logs; and

applying a set of rules to characteristics of the data to label the content requests of the database to create labeled content requests.

11. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of a threshold number of web page views within a time period.

12. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of user activity being active greater than a threshold time span.

13. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of a new cookie rate provided to users exceeding a threshold.

14. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of an internet protocol address visiting a same website a threshold amount of time within a time span.

15. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of a click rate of content exceeding a threshold indicative of non-human user input.

16. The computing device of claim 10 , wherein a rule of the set of rules labels a first content request as fraudulent based upon the first content request corresponding to characteristics of a user visiting a threshold number of websites within a time period.

17. The computing device of claim 10 , comprising:

creating the labeled feature based upon the labeled content requests.

18. A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:

receiving a content request over a network from a remote computer hosting a content provider service that transmits content data over the network to computing devices for rendering on displays of the computing devices;

evaluating the content request to identify request features, wherein the request features correspond to at least one of a time of the content request, characteristics of a requestor computing device of a requestor that requested the content data from the content provider service, content provider characteristics of the content provider service, or requestor behavior of the requestor;

for each request feature, assigning a feature score to a request feature based upon a score of a labeled feature corresponding to the request feature;

aggregating the feature scores to generate a content request risk score for the content request;

aggregating the content request risk score with a plurality of content risk scores for content requests received from the content provider service to create a content provider risk score;

blocking the content provider service based upon the content provider risk score exceeding a threshold risk; and

transmitting requested content to the content provider service for the content request based upon the content provider risk score not exceeding the threshold risk.

19. The non-transitory machine readable medium of claim 18 , wherein the content provider characteristics comprise at least one of a domain of the content provider service, a sub-domain of the content provider service, a publisher category of the content provider service, a website layout of a website hosted by the content provider service, a position within the website at which the requested content will be rendered, or a supply side platform subscribed to by the content provider service.

20. The non-transitory machine readable medium of claim 18 , wherein the requestor behavior comprise at least one of an age of the requestor, a gender of the requestor, cookie ages of cookies maintained for the requestor, historic website visit and interaction information of the requestor, or click behavior of the requestor.

Assignments (7)