System and Method to Determine the Validity of an Interaction on a Network

• US 20080010307A1
• Filed: 09/20/2007
• Published: 01/10/2008
• Est. Priority Date: 02/14/2000
• Status: Active Grant

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Overture Services Incorporated (Apollo Global Management, Inc.)
• Inventors: Doliov, Stephan
• Granted Patent: US 7,668,861 B2
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0242 Determining effectiveness of advertisements
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99942 : Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 : Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99944 : Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 : Object-oriented database structure processing

Abstract

A system and method are disclosed for classifying a user interaction on a network. A user interaction is identified on a network and user interaction data is collected relating to the user interaction on the network. The user interaction data includes an aggregate measure data and a unique feature data. The user interaction data is processed to generate a value score for the interaction. A classification of the user interaction is determined based on the value score.

Claims

1. A method for classifying a user interaction on a network, comprising:

identifying a user interaction on a network;

collecting a user interaction data relating to the user interaction on the network wherein the user interaction data comprises an aggregate measure data and a unique feature data;

processing the user interaction data to generate a value score for the interaction; and

determining a classification of the user interaction based on the value score.

2. The method of claim 1 wherein the aggregate measure data comprises data representing a set of user interactions.

3. The method of claim 2 wherein the aggregate measure data comprises at least one of:

a number of clicks per network address for a time period, a number of unique queries per user session, a number of network clicks for the time period, and a number of distinct referral partners generating clicks for the time period.

4. The method of claim 1 wherein the unique feature data comprises data representing the interaction with the user.

5. The method of claim 4 wherein the unique feature data comprises at least one of:

an origin of the user, a time of the interaction, a type of the interaction, and a user cookie data.

6. The method of claim 1 wherein the risk score represents a likelihood of the user interaction being valid.

7. The method of claim 1 wherein the risk score represents a likelihood of the user interaction being legitimate.

8. The method of claim 1 wherein the risk score represents a likelihood of the user interaction being desirable.

9. The method of claim 1 wherein a minimum amount of user interaction data is collected before processing the user interaction data.

10. The method of claim 1 wherein processing the user interaction data comprises applying a model to the user interaction data.

11. The method of claim 10 wherein the model comprises a mathematical model.

12. The method of claim 11 wherein the mathematical model comprises a mathematical model of interactions derived using at least one measure of mathematical probability.

13. The method of claim 10 wherein the model comprises a model.

14. The method of claim 13 wherein the model is generated by:

identifying a dataset corresponding to a set of user interactions on a network;

processing the dataset to generate a set of inputs;

generating a model from the set of inputs;

15. The method of claim 1 wherein the classification of the interaction comprises at least one of:

an acceptable but unusual classification, a normal behavior classification and an unacceptable classification.

16. A method for monitoring user interactions on a network, comprising:

identifying a user interaction on a network;

collecting a user interaction data relating to the user interaction on the network wherein the user interaction data comprises an aggregate measure data and an unique feature data;

processing the user interaction data to generate a set of user interaction inputs;

generating a value score by applying a model to the user interaction inputs;

determining a classification of the user interaction based on the value score; and

handling the user interaction based on the classification of the interaction.

17. The method of claim 16 wherein handling the user interaction based on the classification comprises removing the user interaction from a report used to charge network operators.

18. The method of claim 16 wherein handling the user interaction based on the classification comprises storing the value score of the interaction.

19. The method of claim 18 further comprising using the stored value score to produce a report.

20. The method of claim 16 wherein handing the user interaction based on the classification comprises ignoring interactions from a network address of the user interaction.

21. The method of claim 16 wherein the user interaction comprises clicking on a link of an advertiser.

22. The method of claim 21 wherein handling the user interaction based on the classification comprises alerting the advertiser of the classification.

23. A method for classifying a user interaction on a network, comprising:

identifying a dataset corresponding to a set of user interactions on a network;

processing the dataset to generate a set of inputs;

generating a model from the set of inputs;

identifying a current user interaction on the network;

collecting a current user interaction data relating to the current user interaction on the network wherein the current user interaction data comprises an aggregate measure data and an unique feature data;

processing the current user interaction data to generate a set of current user interaction inputs;

generating a value score by applying the model to the set of current user interaction inputs; and

determining a classification of the user interaction based on the value score.

24. The method of claim 24 further comprising reassessing the model.

25. A system for generating scores relating to interactions on a network, comprising:

a memory to store a model, a dataset, a set of inputs, a current interaction data and a set of current interaction inputs;

an interface operatively connected to the memory to collect the current interaction data from a current interaction on a network; and

a processor operatively connected to the memory and the interface, which processes the dataset to identify the set of inputs, generates the model from the set of inputs, processes the current interaction data to generate the set of current interaction inputs, and generates a value score signifying a likelihood of the current user interaction being valid by applying the model to the set of current interaction inputs.