Granted Patent B2

US 12,526,298 · App. 18/133,594 · Granted Jan 13, 2026

Inventor: Donald J McQueen (Leesburg, VA)

Assignee: Yahoo Assets LLC

H04L63/1425H04L63/1416

Abstract

Claims (76)

1 . A method, comprising:

analyzing network activity to identify a plurality of events;

determining, based upon the plurality of events, a plurality of first-tier Internet Protocol (IP) address reputation scores, wherein determining the plurality of first-tier IP address reputation scores comprises:

determining a first first-tier IP address reputation score for a first first-tier IP address group based upon one or more first events, of the plurality of events, associated with the first first-tier IP address group; and

determining a second first-tier IP address reputation score for a second first-tier IP address group based upon one or more second events, of the plurality of events, associated with the second first-tier IP address group;

determining, based upon the plurality of first-tier IP address reputation scores, a second-tier IP address reputation score for a second-tier IP address group comprising the first first-tier IP address group and the second first-tier IP address group;

generating an IP address reputation profile based upon the plurality of first-tier IP address reputation scores and the second-tier IP address reputation score for the second-tier IP address group;

receiving a request for content associated with a first IP address; and

determining, based upon the IP address reputation profile and the first IP address, whether or not the request for content is fraudulent.

2 . The method of claim 1 , wherein determining whether or not the request for content is fraudulent comprises:

analyzing the IP address reputation profile to identify one or more IP address reputation scores associated with the first IP address; and

determining whether or not the request for content is fraudulent based upon the one or more IP address reputation scores.

3 . The method of claim 1 , wherein determining whether or not the request for content is fraudulent comprises:

analyzing the IP address reputation profile to determine an availability of a first-tier IP address reputation score associated with the first IP address; and

based upon (i) the first-tier IP address reputation score associated with the first IP address not being available in the IP address reputation profile and (ii) the second-tier IP address group comprising the first IP address, using the second-tier IP address reputation score to determine whether or not the request for content is fraudulent.

4 . The method of claim 1 , wherein:

each of the first first-tier IP address group and the second first-tier IP address group spans a first range of IP addresses of a first size; and

the second-tier IP address group spans a second range of IP addresses of a second size at least twice the first size.

5 . The method of claim 1 , wherein determining the first first-tier IP address reputation score comprises:

determining, based upon the one or more first events, one or more features associated with the first first-tier IP address group; and

determining the first first-tier IP address reputation score based upon the one or more features.

6 . The method of claim 5 , wherein the one or more features comprise at least one of:

a measure of successful authentication events associated with the first first-tier IP address group; or

a measure of unsuccessful authentication events associated with the first first-tier IP address group.

7 . The method of claim 5 , wherein the one or more features comprise at least one of:

a measure of successful user validation events associated with the first first-tier IP address group; or

a measure of unsuccessful user validation events associated with the first first-tier IP address group.

8 . The method of claim 1 , comprising:

determining a short-term IP address reputation score associated with the first first-tier IP address group based upon one or more third events that occur within a period of time that starts after the first first-tier IP address reputation score is determined; and

updating the first first-tier IP address reputation score based upon the short-term IP address reputation score.

9 . The method of claim 1 , comprising:

in response to determining that the request for content is not fraudulent, transmitting a content item to a client device associated with the first IP address.

10 . The method of claim 1 , comprising:

in response to determining that the request for content is fraudulent, not transmitting a content item to a client device associated with the first IP address.

11 . The method of claim 1 , comprising:

in response to determining that the request for content is fraudulent, providing, for display on a client device associated with the first IP address, an authentication interface.

12 . A computing device comprising:

a processor; and

memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:

analyzing network activity to identify a plurality of events;

determining, based upon the plurality of events, a plurality of first-tier Internet Protocol (IP) address reputation scores, wherein determining the plurality of first-tier IP address reputation scores comprises:

determining a first first-tier IP address reputation score for a first first-tier IP address group based upon one or more first events, of the plurality of events, associated with the first first-tier IP address group; and

determining a second first-tier IP address reputation score for a second first-tier IP address group based upon one or more second events, of the plurality of events, associated with the second first-tier IP address group;

determining, based upon the plurality of first-tier IP address reputation scores, a second-tier IP address reputation score for a second-tier IP address group comprising the first first-tier IP address group and the second first-tier IP address group;

generating an IP address reputation profile based upon the plurality of first-tier IP address reputation scores and the second-tier IP address reputation score for the second-tier IP address group;

receiving a request for content associated with a first IP address; and

determining, based upon the IP address reputation profile and the first IP address, a fraud risk score associated with the request for content.

13 . The computing device of claim 12 , wherein determining the fraud risk score comprises:

analyzing the IP address reputation profile to identify one or more IP address reputation scores associated with the first IP address; and

determining the fraud risk score based upon the one or more IP address reputation scores.

14 . The computing device of claim 12 , wherein determining the fraud risk score comprises:

analyzing the IP address reputation profile to determine an availability of a first-tier IP address reputation score associated with the first IP address; and

based upon (i) the first-tier IP address reputation score associated with the first IP address not being available in the IP address reputation profile and (ii) the second-tier IP address group comprising the first IP address, using the second-tier IP address reputation score to determine the fraud risk score.

15 . The computing device of claim 12 , wherein:

each of the first first-tier IP address group and the second first-tier IP address group spans a first range of IP addresses of a first size; and

the second-tier IP address group spans a second range of IP addresses of a second size at least twice the first size.

16 . The computing device of claim 12 , wherein determining the first first-tier IP address reputation score comprises:

determining, based upon the one or more first events, one or more features associated with the first first-tier IP address group; and

determining the first first-tier IP address reputation score based upon the one or more features.

17 . The computing device of claim 16 , wherein:

the first first-tier IP address group corresponds to a first subscriber endpoint;

the second first-tier IP address group corresponds to a second subscriber endpoint; and

the second-tier IP address group corresponds to a provider site providing service to the first subscriber endpoint and the second subscriber endpoint.

18 . The computing device of claim 16 , wherein the second-tier IP address group corresponds to a geographical area comprising both the first first-tier IP address group and the second first-tier IP address group.

19 . A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:

analyzing network activity to identify a plurality of events;

determining, based upon the plurality of events, a plurality of first-tier client identifier reputation scores, wherein determining the plurality of first-tier client identifier reputation scores comprises:

determining a first first-tier client identifier reputation score for a first first-tier client identifier group based upon one or more first events, of the plurality of events, associated with the first first-tier client identifier group; and

determining a second first-tier client identifier reputation score for a second first-tier client identifier group based upon one or more second events, of the plurality of events, associated with the second first-tier client identifier group;

determining, based upon the plurality of first-tier client identifier reputation scores, a second-tier client identifier reputation score for a second-tier client identifier group comprising the first first-tier client identifier group and the second first-tier client identifier group;

generating a client identifier reputation profile based upon the plurality of first-tier client identifier reputation scores and the second-tier client identifier reputation score for the second-tier client identifier group;

receiving a request for content associated with a first client identifier; and

determining, based upon the client identifier reputation profile and the first client identifier, a fraud risk score associated with the request for content.

20 . The non-transitory machine readable medium of claim 19 , wherein determining the fraud risk score comprises:

analyzing the client identifier reputation profile to identify one or more client identifier reputation scores associated with the first client identifier; and

determining the fraud risk score based upon the one or more client identifier reputation scores.

Assignments (2)

Continuity (1)

References Cited (10)