Implicit crowdsourcing for untracked correction or verification of categorization information

• US 10,091,224 B2
• Filed: 10/31/2015
• Issued: 10/02/2018
• Est. Priority Date: 10/31/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Olinsky, Craig Philip
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/929,270
• Publication Number:
  US 20170126720A1
• Time in Patent Office: 1,067 Days
• Field of Search: 726 22
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Embodiments of the present disclosure are directed to updating categorization of online content. An analytics engine implemented at least partially in hardware can receive an engagement indicator across a network interface; identify a type of the engagement indicator, the type of the engagement indicator comprising one of a positive engagement indicator or a negative engagement indicator; and update the reputation data stored in memory based on the type of the engagement indicator. A safe harbor time window is described during with user activity with online content is not reported to system administrators.

Claims

1. A computer program product tangibly embodied on a non-transitory computer readable medium, the computer program product comprising executable instructions to:

detect user access to online content, the user access administered by an information technology management service;

start a timer upon detecting the user access to the online content, the timer set to expire after a predetermined threshold maximum amount of time, wherein the threshold maximum amount of time comprises a safe harbor period during which user activity is not logged for reporting to the information technology management service;

detect user activity associated with the online content;

identify the user activity as a negative engagement with the online content, wherein the negative engagement comprises the user activity terminating the user access to the online content; and

when the negative engagement with the online content occurs within the threshold maximum amount of time;

transmit a negative engagement identifier to an analytics engine for updating a categorization of the online content in accordance with the negative engagement; and

forgo reporting the user activity to information technology management service.

2. The computer program product of claim 1, wherein the user activity with the online content occurs after the safe harbor period is identified as a positive engagement with the online content and the user access to the online content is reported.

3. The computer program product of claim 1, wherein the negative engagement identifier is used to verify a negative reputation of the online content.

4. The computer program product of claim 1, wherein if the user activity associated with the online content occurs after the threshold maximum amount of time, the computer program product is further operable when executed to:

report the user activity to the information technology management service.

5. The computer program product of claim 1, wherein if the user activity occurs after the threshold maximum amount of time and is a positive engagement with the online content, the computer program product is operable when executed to transmit a positive engagement identifier to the analytics engine.

6. The computer program product of claim 1, wherein the negative engagement comprises one or more of closing a browsing window, backing out of a website, moving an e-mail to a spam folder, or deleting an e-mail.

7. A computer implemented method comprising:

detecting user access to online content, the user access administered by an information technology management service;

starting a timer upon detecting the user access to the online content, the timer set to expire after a predetermined threshold maximum amount of time, wherein the threshold maximum amount of time comprises a safe harbor period during which user activity is not logged for reporting to the information technology management service;

detecting user activity associated with the online content;

identifying the user activity as a negative engagement with the online content, wherein the negative engagement comprises the user activity terminating the user access to the online content; and

when the negative engagement with the online content occurs within the threshold maximum amount of time;

transmitting a negative engagement identifier to an analytics engine for updating a categorization of the online content in accordance with the negative engagement; and

forgoing reporting the user activity to information technology management service.

8. The method of claim 7, wherein the user activity with the online content occurs after the safe harbor period is identified as a positive engagement with the online content and the user access to the online content is logged.

9. The method of claim 7, wherein the negative engagement identifier is used to verify a negative reputation of the online content.

10. The method of claim 7, wherein if the user activity associated with the online content occurs after the threshold maximum amount of time, the method further comprises reporting the user activity to the information technology management service.

11. The method of claim 7, wherein if the user activity occurs after the threshold maximum amount of time and is a positive engagement with the online content, the method further comprises transmitting a positive engagement identifier to the analytics engine.

12. The method of claim 7, wherein the negative engagement comprises one or more of closing a browsing window, backing out of a website, moving an e-mail to a spam folder, or deleting an e-mail.

13. A computing apparatus configured to operate as an analytics engine, the computer apparatus comprising:

a network interface to receive an engagement indicator of online content from one or more network devices;

one or more hardware processors to process the engagement indicator, the analytics engine operable to;

identify a type of the engagement indicator, the type of the engagement indicator comprising one of a positive engagement indicator or a negative engagement indicator, wherein a negative engagement associated with the negative engagement indicator comprises user activity terminating user access to the online content; and

update a content characteristic of the online content, the content characteristic stored in a repository.

14. The computing apparatus of claim 13, wherein the content characteristic comprises a reputation of the online content, and the analytics engine uses the engagement indicator to update the reputation of the online content.

15. The computing apparatus of claim 14, wherein the engagement indicator comprises one of a positive engagement or a negative engagement, and wherein the analytics engine uses one of the positive engagement or the negative engagement to update the reputation of the online content.

16. The computing apparatus of claim 14, wherein the analytics engine uses the positive engagement indicator to verify a positive reputation of the online content.

17. The computing apparatus of claim 13, wherein the engagement indicator represents implicit user activity, the implicit user activity comprising a mouse click on a link within the online content, a mouse click backing out of the online content, a transfer of the online content to a spam folder, or a bookmarking of the online content.

18. The computing apparatus of claim 13, wherein the engagement indicator indicates whether user activity associated with the online content was performed within a predetermined threshold amount of time.

19. The computing apparatus of claim 13, wherein reputation of the online content comprises a number value, the number value mapped to a scale that indicates a measure of the reputation of the online content, wherein the scale measures a safety and maliciousness of the online content.

20. The computing apparatus of claim 13, wherein the analytics engine uses the engagement indicator to associate the online content with one or more tags, each of the one or more tags identifying characteristics of the online content.

21. A system for updating categorization of online content, the system comprising:

one or more processors implemented at least partially in hardware;

an analytics engine implemented at least partially in hardware, the analytics engine to;

receive an engagement indicator across a network interface;

identify a type of the engagement indicator, the type of the engagement indicator comprising one of a positive engagement indicator or a negative engagement indicator, wherein a negative engagement associated with the negative engagement indicator comprises user activity terminating user access to the online content; and

update one or both of category data of the online content or reputation data of the online content stored in memory based on the type of the engagement indicator.

22. The system of claim 21, wherein the engagement indicator comprises one of a positive engagement or a negative engagement, and wherein the analytics engine uses one of the positive engagement or the negative engagement to update the reputation data of the online content.

23. The system of claim 21, wherein the engagement indicator represents implicit user activity, the implicit user activity comprising a mouse click on a link within the online content, a mouse click backing out of the online content, a transfer of the online content to a spam folder, or a bookmarking of the online content.