Measuring response trends in a digital television network
Techniques and systems for providing a trend server outside a content provider network to communicate with the content provider network to build a trend record based on responses received from the content provider network for monitoring certain activity trend or tendency in the content provider network and provide an alert when the content provider network behaves abnormally.
1. A computer-implemented method of monitoring communications, the method comprising:
receiving, by a first server, a message associated with a type value;
receiving, by the first server, a response message generated based on the message, the response message including data associated with the message and a parameter value associated with an attribute of the data;
determining, by the first server, that the response message is acceptable at least in part by determining that the parameter value of the response message meets a threshold defined in one or more activity records, the one or more activity records being associated with the type value associated with the message;
updating an activity record of the one or more activity records based on the response message and based on the parameter value of the response message meeting the threshold; and
providing, by the first server, the updated activity record for use by a second server.
2. The computer-implemented method of claim 1 , wherein the first server and the second server are part of a network of servers.
3. The computer-implemented method of claim 1 , wherein the first server and the second server are geographically separated.
4. The computer-implemented method of claim 1 , wherein the message is a first message, and the response message is a first response message, and wherein the method further comprises:
receiving, by the first server, a second message associated with the type value;
receiving, by the first server, a second response message generated based on the second message; and
determining, by the first server, that a parameter value of the second response message does not meet the threshold defined in the one or more activity records, wherein an alert is generated based on the parameter value of the second response message not meeting the threshold.
5. The computer-implemented method of claim 1 , wherein the activity record is generated based on one or more messages associated with the type value received before the message.
6. The computer-implemented method of claim 1 , wherein the response message is generated by a computer system, and wherein receiving the response message includes receiving the response message from the computer system.
7. The computer-implemented method of claim 6 , wherein the computer system includes an application server.
8. The computer-implemented method of claim 1 , wherein the response message is a first response message, wherein the data is first data, wherein the parameter value is a first parameter value, wherein the attribute is a first attribute, and wherein the method further comprises:
receiving, by the first server, a second response message including second data associated with a second message and a second parameter value associated with a second attribute of the second data;
determining, by the first server, that the second parameter value of the second response message meets the threshold defined in the one or more activity records; and
updating the activity record of the one or more activity records based on the second response message and based on the second parameter value of the response message meeting the threshold.
9. The computer-implemented method of claim 1 , wherein the response message includes a link to a malicious resource.
10. The computer-implemented method of claim 1 , wherein the parameter value includes a numerical amount associated with a transaction.
11. A system for monitoring communications, the system comprising:
a first server; and
a second server configured for communication with a service provider network, wherein at least one of the first server and the second server are configured to:
monitor communication between a computing device and the service provider network, the communication being associated with a type value;
identify a response message to the computing device generated based on the monitored communication, the response message including data associated with the monitored communication, the data having a parameter value defining a characteristic of the data;
determine that the response message is acceptable at least in part by determining that the parameter value of the response message is in a range of values for one or more activity records, the range of values being defined based at least on the type value associated with the monitored communication between the computing device and the service provider network; and
update an activity record of the one or more activity records based on the response message including the parameter value that is in the range of values for the one or more activity records.
12. The system of claim 11 , wherein the first server and the second server are part of a network of servers.
13. The system of claim 11 , wherein the first server and the second server are geographically separated.
14. The system of claim 11 , wherein the first server is not configured for communication with the service provider network.
15. The system of claim 11 , wherein the first server and the second server are geographically separated, and wherein at least one of the first server and the second server monitors the communication between the computing device and the service provider network without receiving any of the communications between the computing device and the service provider network.
16. The system of claim 11 , wherein the response message is received from one or more servers located in the service provider network and is under management of a service provider of the service provider network.
17. The system of claim 11 , wherein the second server is configured to:
provide the updated activity record to the first server.
18. A first server for monitoring communications, comprising:
one or more processors; and
a memory accessible to the one or more processors and storing instructions which, upon execution by the one or more processors, causes the one or more processors to perform operations comprising:
receive a message associated with a type value;
receive a response message generated based on the message, the response message including data associated with the message and a parameter value associated with an attribute of the data;
determine that the response message is acceptable at least in part by determining that the parameter value of the response message meets a threshold defined in one or more activity records, the one or more activity records being associated with the type value associated with the message;
update an activity record of the one or more activity records based on the response message and based on the parameter value of the response message meeting the threshold; and
provide the updated activity record for use by a second server.
19. The first server of claim 18 , wherein the first server and the second server are part of a network of servers.
20. The first server of claim 18 , wherein the response message is generated by an application server, and wherein receiving the response message includes receiving the response message from the application server.