Detecting digital content misuse based on digital content usage clusters

• US 10,417,393 B2
• Filed: 11/04/2016
• Issued: 09/17/2019
• Est. Priority Date: 11/04/2015
• Status: Active Grant

• Current Assignee: SR Labs, Inc.
• Original Assignee: Screening Room Media, Inc.
• Inventors: Baldwin, James Armand, Akkaraju, Prem, Vanzini, Giorgio
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/344,286
• Publication Number:
  US 20170124298A1
• Time in Patent Office: 1,047 Days
• Field of Search: None
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06K 7/1417 2D bar codes
• CPC Class Codes: G06Q 30/0635 Processing of requisition or of purchase orders
• CPC Class Codes: G06Q 50/184 Intellectual property management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/00 Network arrangements or protocols for supporting network services or applications user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A method for detecting digital content misuse can include clustering, by a digital content delivery system, a set of data points into a set of digital content usage clusters, each data point from the set of data points representing a unique user account from a set of user accounts maintained by the digital content delivery system, and each data point from the set of data points having been determined based on usage signal data describing digital content usage associated with the unique user account represented by the data point; determining, based on the set of digital content usage clusters, that a first data point from the set of data points is an outlier; and in response to determining that the first data point from the set of data points is an outlier, executing a remedial action with respect to a user account represented by the first data point.

Claims

1. A method comprising:

gathering, by a digital content delivery system, usage signal data describing digital content usage by a plurality of user accounts of the digital content delivery system;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique user account of the plurality of user accounts and having been generated based on usage signal data describing digital content usage associated with the respective unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of digital content usage clusters, each digital content usage cluster from the set of digital content clusters having a determined center;

determining, based on the set of digital content usage clusters, a first distance between a first data point from the set of data points and the respective center of a digital content cluster that is closest to the first data point;

determining that the first distance is greater than a threshold distance; and

in response to determining that the first distance is greater than the threshold distance, placing a restriction on the respective user account corresponding to the first data point, the restriction disabling the respective user account corresponding to the first data point from accessing digital content from the digital content delivery system.

2. The method of claim 1, wherein the usage signal data describing digital content usage by the plurality of user accounts includes one or more of a number of times digital content was accessed, a frequency at which digital content was accessed, digital content items that were accessed, a geographic location of a client-side computing device associated with the unique user account, a number of known family members residing in a dwelling associated with the unique user account, and a number of mobile computing devices detected during performance of digital content.

3. The method of claim 1, further comprising:

determining, from the set of digital content usage clusters, a subset of digital content usage clusters that meet a quality threshold level, wherein the digital content usage cluster that is closest to the first data point is selected from the subset of digital content usage clusters.

4. The method of claim 3, wherein determining the subset of digital content usage clusters that meet a quality threshold level comprises:

determining a density of data point in a first digital content usage cluster; and

comparing the density of data point in the first digital content usage cluster to a threshold density level.

5. The method of claim 1, wherein the clustering algorithm is a k-means clustering algorithm.

6. The method of claim 1, further comprising:

scanning social media activity of a user associated with the respective user account corresponding to the first data point for postings made by the user that indicate that the user is allowing unauthorized access to the digital content.

7. The method of claim 1, further comprising:

causing a client-side computing device associated with the respective user account corresponding to the first data point to suspend performance of digital content.

8. A digital content delivery system comprising:

one or more computer processors; and

one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, causes the digital content delivery system to perform operations comprising;

gathering usage signal data describing digital content usage by a plurality of user accounts of the digital content delivery system;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique user account of the plurality of user accounts and having been generated based on usage signal data describing digital content usage associated with the respective unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of digital content usage clusters, each digital content usage cluster from the set of digital content clusters having a determined center;

determining, based on the set of digital content usage clusters, a first distance between a first data point from the set of data points and the respective center of a digital content duster that is closest to the first data point;

determining that the first distance is greater than a threshold distance; and

in response to determining that the first distance is greater than the threshold distance, placing a restriction on the respective user account corresponding to the first data point, the restriction disabling the respective user account corresponding to the first data point from accessing digital content from the digital content delivery system.

9. The digital content delivery system of claim 8, wherein the usage signal data describing digital content usage by the plurality of user accounts includes one or more of a number of times digital content was accessed, a frequency at which digital content was accessed, digital content items that were accessed, a geographic location of a client-side computing device associated with the unique user account, a number of known family members residing in a dwelling associated with the unique user account, and a number of mobile computing devices detected during performance of digital content.

10. The digital content delivery system of claim 8, the operations further comprising:

determining, from the set of digital content usage clusters, a subset of digital content usage clusters that meet a quality threshold level, wherein the digital content usage cluster that is closest to the first data point is selected from the subset of digital content usage clusters.

11. The digital content delivery system of claim 10, wherein determining the subset of digital content usage clusters that meet a quality threshold level comprises:

determining a density of data point in a first digital content usage cluster; and

comparing the density of data point in the first digital content usage cluster to a threshold density level.

12. The digital content delivery system of claim 8, wherein the clustering algorithm is a k-means clustering algorithm.

13. The digital content delivery system of claim 8, the operations further comprising:

scanning social media activity of a user associated with the respective user account corresponding to the first data point for postings made by the user that indicate that the user is allowing unauthorized access to the digital content.

14. The digital content delivery system of claim 8, the operations further comprising:

causing a client-side computing device associated with the respective user account corresponding to the first data point to suspend performance of digital content.

15. A non-transitory computer-readable medium storing instructions that, when executed by the one or more computer processors of a digital content delivery system, causes the digital content delivery system to perform operations comprising:

gathering usage signal data describing digital content usage by a plurality of user accounts of the digital content delivery system;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique user account of the plurality of user accounts and having been generated based on usage signal data describing digital content usage associated with the respective unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of digital content usage clusters, each digital content usage cluster from the set of digital content clusters having a determined center;

determining, based on the set of digital content usage clusters, a first distance between a first data point from the set of data points and the respective center of a digital content cluster that is closest to the first data point;

determining that the first distance is greater than a threshold distance; and

in response to determining that the first distance is greater than the threshold distance, placing a restriction on the respective user account corresponding to the first data point, the restriction disabling the respective user account corresponding to the first data point from accessing digital content from the digital content delivery system.

16. The non-transitory computer-readable medium of claim 15, wherein the usage signal data describing digital content usage by the plurality of user accounts includes one or more of a number of times digital content was accessed, a frequency at which digital content was accessed, digital content items that were accessed, a geographic location of a client-side computing device associated with the unique user account, a number of known family members residing in a dwelling associated with the unique user account, and a number of mobile computing devices detected during performance of digital content.

17. The non-transitory computer-readable medium of claim 15, the operations further comprising:

determining, from the set of digital content usage clusters, a subset of digital content usage clusters that meet a quality threshold level, wherein the digital content usage cluster that is closest to the first data point is selected from the subset of digital content usage clusters.

18. The non-transitory computer-readable medium of claim 17, wherein determining the subset of digital content usage clusters that meet a quality threshold level comprises:

determining a density of data point in a first digital content usage cluster; and

comparing the density of data point in the first digital content usage cluster to a threshold density level.

19. The non-transitory computer-readable medium of claim 15, wherein the clustering algorithm is a k-means clustering algorithm.

20. The non-transitory computer-readable medium of claim 15, the operations further comprising:

scanning social media activity of a user associated with the respective user account corresponding to the first data point for postings made by the user that indicate that the user is allowing unauthorized access to the digital content.