EARLY DETECTION OF HIGH VOLUME PEER-TO-PEER SWARMS

• US 20100121955A1
• Filed: 06/04/2009
• Published: 05/13/2010
• Est. Priority Date: 11/11/2008
• Status: Active Grant

• Current Assignee: NBC Universal Media LLC (Comcast Corporation)
• Original Assignee: General Electric Company
• Inventors: Skinner, Andrew Francis, Cates, Joseph E., Huynh, Michelle My-Ly, Doganaksoy, Necip, Marasanapalle, Jayanth Kalle, Saha, Angshuman, Lizzi, John Michael
• Granted Patent: US 9,386,089 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 12/00 Data switching networks interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units G06F13/00
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

Early detection of high volume swarms in a peer-to-peer network, including a data feed of peer-to-peer swarm activity, and an analytics engine processing the data feed and identifying the high volume swarms that have parameters that exceed a threshold. The system can include a pre-processing section for conditioning the swarm data for the analytics section. There can also be a verification section that confirms that the peer download file matches the target file. The early detection provides for enhanced anti-piracy efforts, improved allocation of network resources, and better business decision-making.

Claims

1. An early identification system for high volume swarms involved in distribution of a target asset on a peer-to-peer network, comprising:

a data feed of peer-to-peer swarm activity involving distribution of peer-to-peer content, wherein said data feed provides swarm data;

an analytics section stored on a computer readable medium with executable code, said analytics section establishing thresholds and processing the swarm data, wherein said high volume swarms are each identified as those having a number of unique peers involved in said distribution of the target asset such that the number of unique peers exceeds said threshold.

2. The system according to claim 1, further comprising a verification section for confirming that the peer-to-peer content from the high volume swarms is substantially similar to the target asset.

3. The system according to claim 1, wherein the unique peers are based upon unique Internet Protocol (IP) addresses.

4. The system according to claim 1, wherein said threshold is initially set as a static number.

5. The system according to claim 4, wherein the static number is used until a sufficient level of swarm data is collected.

6. The system according to claim 5, wherein the sufficient level is at least 30 swarms.

7. The system according to claim 1, wherein the threshold is calculated using a predictive model or a probabilistic model.

8. The system according to claim 1, further comprising a database coupled to said data feed and said analytics section, said database storing said swarm data over time.

9. The system according to claim 8, further comprising organizing the swarm data into organized swarm data and storing said organized swarm data in said database.

10. The system according to claim 1, further comprising a pre-processing section for conditioning the swarm data.

11. The system according to claim 1, wherein network resources are allocated based upon the high volume swarms.

12. The system according to claim 1, wherein the data feed is provided by crawlers in the peer-to-peer network.

13. A computer readable medium having computer executable instructions providing a method of identifying high risk swarms involved in unauthorized distribution of a target asset, comprising;

retrieving swarm data, wherein said swarm data is involved in downloading of an alleged target asset;

setting a threshold at a static number if there is an inadequate amount of swarm data;

updating said threshold based on if there is sufficient swarm data;

flagging alleged high risk swarms as those that exceed said threshold; and

verifying that the alleged high risk swarms are the high risk swarms involved in the download of the target asset.

14. The method according to claim 13, wherein updating said threshold is processing based on predictive models or probabilistic models.

15. The method according to claim 13, further comprising storing and organizing said swarm data in a database.

16. The method according to claim 13, further comprising pre-processing the swarm data.

17. The method according to claim 13, further comprising collecting the swarm data without any processing until a pre-defined swarm number is obtained or based upon a collection time period.

18. The method according to claim 13, wherein the verifying is downloading the alleged target asset for comparison to the target asset.

19. The method according to claim 13, further comprising analyzing the high volume swarms for patterns and making business decisions based on said patterns.

20. The method according to claim 13, further comprising notifying Internet Service Providers of one or more of said high volume swarms.