Method and system for detecting abnormal online user activity

• US 10,419,460 B2
• Filed: 07/21/2017
• Issued: 09/17/2019
• Est. Priority Date: 07/21/2017
• Status: Active Grant

• Current Assignee: Yahoo AD Tech LLC
• Original Assignee: Oath Inc. (Verizon Communications Inc.)
• Inventors: Wang, Liang, Qiu, Angus Xianen, Han, Chun, Peng, Liang
• Primary Examiner(s): Gracia, Gary S
• Application Number:
  US15/656,411
• Publication Number:
  US 20190028489A1
• Time in Patent Office: 788 Days
• Field of Search: None
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The present teaching generally relates to detecting abnormal user activity associated with an entity. In a non-limiting embodiment, baseline distribution data representing a baseline distribution characterizing normal user activities for an entity may be obtained. Information related to online user activities with respect to the entity may be received, distribution data representation a dynamic distribution may be determined based, at least in part, on the information. One or more measures characterizing a difference between the baseline distribution and the dynamic distribution may be computed, and in real-time it may be assessed whether the information indicates abnormal user activity. If the first information indicates abnormal user activity, then output data including the distribution data and the one or more measures may be generated.

Claims

1. A method for detecting abnormal online user activities, the method being implemented on a computer comprising at least one processor, storage, and communications circuitry, the method comprising:

obtaining, by the at least one processor, baseline distribution data representing a baseline distribution characterizing normal user activities with respect to a first entity;

receiving, dynamically, first information related to online user activities with respect to the first entity;

determining first distribution data representing a first dynamic distribution based, at least in part, on the first information;

computing, using the baseline distribution data and the first distribution data, at least one measure characterizing a difference between the baseline distribution and the first dynamic distribution;

assessing in real-time whether the first information indicates abnormal user activity behavior based, at least in part, on the at least one measure, wherein the abnormal user activity behavior is identified by detecting time-to-click (“

TTC”

) abnormalities, which includes a duration between when an advertisement is rendered and when a user clicks on the advertisement, and wherein the abnormal user activity behavior signifies fraudulent activities by at least one of a bot or fake user clicks; and

generating, in response to determining that the first information indicates that first distribution data comprises a first indication of the abnormal user activity behavior, first output data comprising at least the first distribution data and the at least one measure.

2. The method of claim 1, further comprising:

sending the first output data to a quality assurance processor system to determine at least one additional property associated with the first dynamic distribution.

3. The method of claim 1, wherein receiving, dynamically, the first information further comprises:

receiving online user activity data representing a plurality of online user activity events associated with the first entity during a first amount of time.

4. The method of claim 1, wherein obtaining the baseline distribution data further comprises at least one of:

receiving the baseline distribution data from a baseline distribution database, the baseline distribution database being configured to store first baseline data associated with at least one first temporal duration for at least one entity; and

generating the baseline distribution data using online user activity data representing online user activity events associated with the first entity during a second temporal duration.

5. The method of claim 1, wherein computing the at least one measure further comprises at least one of:

performing a Kolmogorov-Smirnov measure; and

performing an Information Value measure.

6. The method of claim 1, wherein assessing in real-time whether the first information indicates the abnormal user activity behavior further comprises:

determining, by the at least one processor, a first threshold associated the abnormal user activity for the first entity; and

determining that the at least one measure exceeds the first threshold.

7. The method of claim 1, further comprising:

receiving, dynamically, second information related to second online user activities with respect to the first entity;

determining second distribution data representing a second dynamic distribution based, at least in part, on the second information;

computing, using the baseline distribution data and the second distribution data, at least one second measure characterizing a second difference between the baseline distribution and the second dynamic distribution;

determining that the second information indicates that the second distribution data comprises a second indication of normal user activity behavior;

storing that the second distribution data in a baseline distribution database; and

generating updated baseline distribution data representing an updated baseline distribution with respect to the first entity based, at least in part, on the baseline distribution data and the second distribution data.

8. The method of claim 7, further comprising:

receiving, dynamically, third information related to third online user activities with respect to the first entity;

determining third distribution data representing a third dynamic distribution based, at least in part, on the third information; and

determining, based at least in part on at least one third measure characterizing a third difference between the updated baseline distribution and the third dynamic distribution, the at least one third measure being computed using the updated baseline distribution data and the third distribution data that the third distribution data comprises one of the first indication or the second indication.

9. The method of claim 1, wherein generating the output data further comprises:

determining temporal information indicating a temporal range associated with the online user activities; and

generating an abnormal user activity flag identifier such that the output data further comprises the temporal information and the abnormal user activity flag identifier.

10. A system for detecting abnormal online user activities, the system comprising:

a baseline distribution generation system configured to obtain baseline distribution data representing a baseline distribution characterizing normal user activities with respect to a first entity;

an online data collection system configured to receive, dynamically, first information related to online user activities with respect to the first entity;

an online data distribution generation system configured to determine first distribution data representing a first dynamic distribution based, at least in part, on the first information;

a distribution measure system configured to compute, using the baseline distribution data and the first distribution data, at least one measure characterizing a difference between the baseline distribution and the first dynamic distribution;

an abnormal user activity detection system configured to assess in real-time whether the first information indicates abnormal user activity behavior based, at least in part, on the at least one measure, wherein the abnormal user activity behavior is identified by detecting time-to-click (“

TTC”

) abnormalities, which includes a duration between when an advertisement is rendered and when a user clicks on the advertisement, and wherein the abnormal user activity behavior signifies fraudulent activities by at least one of a bot or fake user clicks; and

an output data generation system configured to generate, in response to determining that the first information indicates that first distribution data comprises a first indication of the abnormal user activity behavior, first output data comprising at least the first distribution data and the at least one measure.

11. The system of claim 10, wherein the output data generation system is further configured to:

the first output data to a quality assurance processor system to determine at least one additional property associated with the first dynamic distribution.

12. The system of claim 10, wherein the online data collection system is further configured to:

receive online user activity data representing a plurality of online user activity events associated with the first entity during a first amount of time.

13. The system of claim 10, wherein the user activity detection system further comprises:

at least one baseline distribution database configured to store to store first baseline data associated with at least one first temporal duration for at least one entity, wherein the baseline distribution data being obtained further comprises the baseline distribution generation system being configured to one of;

receive the baseline distribution data from a baseline distribution database; and

generate the baseline distribution data using online user activity data representing online user activity events associated with the first entity during a second temporal duration.

14. The system of claim 10, wherein the distribution measure system being configured to compute the at least one measure comprises the distribution measure system being configured to at least one of:

perform a Kolmogorov-Smirnov measure; and

perform an Information Value measure.

15. The system of claim 10, wherein the abnormal user activity detection system being configured to assess in real-time whether the first information indicates the abnormal user activity behavior comprises the abnormal user activity detection system being further configured to:

determine a first threshold associated the abnormal user activity for the first entity; and

determine that the at least one measure exceeds the first threshold.

16. The system of claim 10, wherein:

the online data collection system is further configured to receive, dynamically, second information related to second online user activities with respect to the first entity;

the online data distribution generation system is further configured to determine second distribution data representing a second dynamic distribution based, at least in part, on the second information;

the distribution measure system is further configured to compute, using the baseline distribution data and the second distribution data, at least one second measure characterizing a second difference between the baseline distribution and the second dynamic distribution;

the abnormal user activity detection system is further configured to determine that the second information indicates that the second distribution data comprises a second indication of normal user activity behavior;

the user activity detection system further comprises a baseline distribution database configured to store the second distribution data; and

the baseline distribution generation system is further configured to generate updated baseline distribution data representing an updated baseline distribution with respect to the first entity based, at least in part, on the baseline distribution data and the second distribution data.

17. The system of claim 16, wherein:

the online data collection system is further configured to receive, dynamically, third information related to third online user activities with respect to the first entity;

the online data distribution generation system is further configured to determine third distribution data representing a third dynamic distribution based, at least in part, on the third information; and

the distribution measure system is further configured to determine, based at least in part on at least one third measure characterizing a third difference between the updated baseline distribution and the third dynamic distribution, the at least one third measure being computed using the updated baseline distribution data and the third distribution data that the third distribution data comprises one of the first indication or the second indication.

18. The system of claim 10, wherein the abnormal user activity detection system further comprises:

a temporal range identifier module configured to determine temporal information indicating a temporal range associated with the online user activities; and

an abnormal user activity flagger module configured to generate an abnormal user activity flag identifier such that the output data further comprises the temporal information and the abnormal user activity flag identifier.

19. The system of claim 10, wherein the abnormal user activity detection system further comprises:

an abnormal user activity flagger module configured to determine that second information related to additional online user activities with respect to a second entity indicates normal user activity behavior; and

a baseline update database configured to store second dynamic distribution data representing a second dynamic distribution based on the second information.

20. A non-transitory computer readable medium having information recorded thereon for detecting abnormal online user activity, wherein the information, when read by the computer, causes the computer to:

obtain baseline distribution data representing a baseline distribution characterizing normal user activities with respect to a first entity;

receive, dynamically, first information related to online user activities with respect to the first entity;

determine first distribution data representing a first dynamic distribution based, at least in part, on the first information;

compute, using the baseline distribution data and the first distribution data, at least one measure characterizing a difference between the baseline distribution and the first dynamic distribution;

assess in real-time whether the first information indicates abnormal user activity behavior based, at least in part, on the at least one measure, wherein the abnormal user activity behavior is identified by detecting time-to-click (“

TTC”

) abnormalities, which includes a duration between when an advertisement is rendered and when a user clicks on the advertisement, and wherein the abnormal user activity behavior signifies fraudulent activities by at least one of a bot or fake user clicks; and

generate, in response to determining that the first information indicates that first distribution data comprises a first indication of the abnormal user activity behavior, first output data comprising at least the first distribution data and the at least one measure.