Systems and methods for identifying a content receiving device

1. A method for identifying from among network-connected devices a particular device associated with a potential theft of distributed content, the method comprising:

obtaining content, the content having been distributed from a particular one of the network-connected devices;

identifying in the obtained content anti-collusion codes;

calculating an aggregated probability for the particular one of the network-connected devices using the identified anti-collusion codes, the aggregated probability being based on a plurality of probabilities using the identified anti-collusion codes;

determining the particular one of the network-connected devices is associated with potential theft of distributed content using the calculated aggregated probability, wherein each of the plurality of probabilities indicates a probability that the particular one of the network-connected devices is associated with potential theft of distributed content; and

blacklisting, based on whether the aggregated probability is equal to or exceeds the predetermined threshold at least one of the particular one of the network-connected devices or an account associated with the particular one of the network-connected devices.

2. The method of claim 1 , further comprising determining if at least some content of the obtained content includes a watermark containing a device identification.

3. The method of claim 1 , wherein the identified anti-collusion codes comprise Tardos codes.

4. The method of claim 1 , further comprising identifying at least one common characteristic for at least some of the obtained content, the common characteristic being one of a content encoder used to encode the at least some of the obtained content, a website for hosting content, or a private network for distributing content.

5. The method of claim 1 , further comprising calculating an anti-collusion score for the particular one of the network-connected devices.

6. The method of claim 5 , further comprising calculating a probability for the particular one of the network-connected devices based on the calculated anti-collusion score, and a predetermined number of colluders.

7. The method of claim 6 , further comprising evaluating whether the probability is above a suspicious threshold value, and storing information related to the probability when the probability is above the suspicious threshold value.

8. The method of claim 7 , wherein the information related to the probability comprises:

a timestamp of when the at least some of the obtained content was found;

a device identification;

a content identification;

the predetermined number of colluders;

a number of anti-collusion codes identified in the at least some of the obtained content; and

the probability for the particular one of the network-connected devices to be associated with the potential theft of distributed content.

9. The method of claim 1 , wherein calculating the aggregated probability for the particular one of the network-connected devices comprises an aggregated probability expression.

10. The method of claim 1 , wherein the threshold value is a first threshold value being one minus an acceptable false positive value.

11. The method of claim 1 , further comprising:

identifying at least one common characteristic for at least some of content of the obtained content, and

when the at least one common characteristic is identified, using a second threshold value as the threshold value, the second threshold value being smaller than one minus an acceptable false positive value.

12. The method of claim 1 , further comprising:

determining whether the aggregated probability is above an aggregated suspicious threshold value; and

storing information related to the particular one of the network-connected devices in the database when the aggregated probability is above the aggregated suspicious threshold value.

13. The method of claim 12 , wherein the aggregated suspicious threshold value is less than the threshold value.

14. The method of claim 1 , further comprising processing the obtained content by determining if the obtained content contains a watermark or determining if the obtained content contains anti-collusion codes, and further comprising comparing the obtained content, prior to processing the obtained content, to previously processed content, and forgo processing the obtained content when the obtained content contains the same information as the previously processed content.

15. A system for identifying from among network-connected devices a particular device likely associated with a potential theft of distributed content, the system comprising a memory storing instructions and a processor executing instructions for performing operations comprising:

obtaining content, the content having been distributed from a particular one of the network-connected devices;

identifying in the obtained content a subset of the distributed content containing anti-collusion codes;

calculating an aggregated probability for the particular one of the network-connected devices using the identified anti-collusion codes, the aggregated probability being based on a plurality of probabilities using the identified anti-collusion codes;

determining the particular one of the network-connected devices is associated with potential theft of distributed content using the calculated aggregated probability wherein each of the plurality of probabilities indicates a probability that the particular one of the network-connected devices is associated with potential theft of distributed content; and

blacklisting, based on whether the aggregated probability is equal to or exceeds the predetermined threshold at least one of the particular one of the network-connected devices or an account associated with the particular one of the network-connected devices.

16. The system of claim 15 , wherein the operations further comprise determining if at least some of content from the obtained content includes a watermark containing a device identification.

17. The system of claim 15 , wherein the operations further comprise identifying at least one common characteristic for the at least some of the identified content, the common characteristic being one of an encoder, used for encoding the at least some of the identified content, a website for hosting the at least some of the identified content, or a private network for distributing the at least some of identified content.

18. The system of claim 15 , wherein the operations further comprise:

determining whether the aggregated probability is above an aggregated suspicious threshold value; and

storing information related to the particular one of the network-connected devices in the database when the aggregated probability is above the aggregated suspicious threshold value.

19. A system for distributing content to user devices and for identifying from among network-connected devices a particular device likely associated with a potential theft of distributed content, the system comprising a processor configured to:

perform distributing operations comprising:

obtaining an identification associated with a network-connected device configured to receive a content;

generating a watermark reflecting the identification;

generating anti-collusion codes for the content;

providing the content by embedding in the content:

the watermark, wherein the watermark is not visually observable during playback of the content containing the watermark; and

the anti-collusion codes; and

perform identifying operations comprising:

obtaining content, the content having been distributed from a particular one of the network-connected devices;

determining whether at least some of content of the obtained content includes a watermark having a user device identification;

identifying in the obtained content a subset of the distributed content containing the anti-collusion codes;

calculating an aggregated probability for the particular one of the network-connected devices using the identified anti-collusion codes, the aggregated probability being based on a plurality of probabilities using the identified anti-collusion codes;

determining the particular one of the network-connected devices is associated with potential theft of distributed content using the calculated aggregated probability wherein each of the plurality of probabilities indicates a probability that the particular one of the network-connected devices is associated with potential theft of distributed content; and

blacklisting, based on whether the aggregated probability is equal to or exceeds the predetermined threshold at least one of the particular one of the network-connected devices or an account associated with the particular one of the network-connected devices.

20. The method of claim 12 , wherein at least some information related to the particular one of the network-connected devices is removed from the database based on a time at which the information was added to the database.