Method For Generating Rules and Parameters for Assessing Relevance of Information Derived From Internet Traffic

• US 20120317068A1
• Filed: 06/09/2011
• Published: 12/13/2012
• Est. Priority Date: 06/09/2011
• Status: Active Grant

• Current Assignee: Bernhard Fischer-Wuenschel, Renate Wendlik, Thomas Walter Ruf
• Original Assignee: Bernhard Fischer-Wuenschel, Renate Wendlik, Thomas Walter Ruf
• Inventors: Ruf, Thomas Walter, Fischer-Wuenschel, Bernhard, Wendlik, Renate
• Granted Patent: US 8,818,927 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06F 3/04812 Interaction techniques based on cursor appearance or behaviour, e.g. being affected by the presence of displayed objects
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 43/028 by filtering

Abstract

A method is disclosed for generating a set of optimal rules and parameters for use by an evaluation engine on a volume of information extracted from a stream of IP packets associated with a web browsing session conducted over a network in order to filter user-initiated traffic flowing across the network from non-user-initiated traffic. Deep packet inspection is performed to extract the volume of information from the stream that conforms to at least one discrimination criteria. An initial iteration of application of the evaluation engine to the volume is performed by selecting initial discrimination criteria and rules for generating the filtered results and a distance between the filtered results and known actual user-initiated traffic is measured. Subsequent iterations of application of the evaluation engine to the volume are performed by changing the discrimination criteria and/or rules until there is no significant improvement in the measured distance.

Claims

1. A method comprising the steps of:

receiving a sample volume of information requests originating at a network access device for processing in accordance with a request/response protocol;

recording an indication of whether each information request of the sample volume was invoked by action of a network access device user or by a prior information request;

examining the response to each received information request of the sample volume to identify its file type;

storing an indication of the file type of the response to each received information request of the sample volume;

applying an evaluation engine using at least one initial criterion to thereby establish an approximate boundary between those information requests invoked by an action of a network access device user and those information requests invoked by a prior information request;

classifying each information request of the sample volume as invoked by action of a network access device user or by a prior information request on the basis of whether or not the at least one criterion is satisfied;

measuring a distance between a number of information requests classified as being invoked by the user and an actual number of information requests invoked by the user;

measuring an overall ratio of information requests classified as being invoked by the user to an overall number of information requests before and after modifying the at least one initial criterion applied by the evaluation engine; and

repeating the classifying and modifying steps until there is no significant improvement of the measured distance to be obtained.

2. The method of claim 1 in which the information request is an http request.

3. The method of claim 1 in which the at least one criterion includes a requirement that the file type specified by a response to an information request have a text/html, xhtml, xml, or plain/text extension.

4. The method of claim 1 further including a step of recording a response code within the response to each information request of the sample volume.

5. The method of claim 4 in which the at least one criterion includes a requirement that a response code associated with an information request be 2xx.

6. The method of claim 1 in which the at least one criterion includes a requirement that the file type specified by an information request not have a jpg, bmp, gif, or gs extension.

7. The method of claim 1 further including a step of tracking time differences between information requests or sequences of requests from a network access device user.

8. The method of claim 1 further including a step of tracking time differences between an information request and a response to an information request or a sequence of requests from a network access device user.

9. The method of claim 1 further including a step of tracking historical time differences between information requests having at least one shared characteristic in sequences of requests from at least one network access device user.

10. The method of claim 9 in which the at least one shared characteristic includes the MIME type or URI path.

11. One or more computer-readable storage media containing instructions which, when executed by one or more processors disposed in an electronic device, perform a method for applying an evaluation engine, the method comprising the steps of:

generating a volume of test data associated with a web browsing session conducted at least in part over a communications network between a network access device and a remote server by applying one or more discrimination criteria to a stream of IP packets associated with the web browsing session;

ascertaining known true clicks and known false clicks associated with the volume of test data by observing the behavior of the network access device or a user of the network access device during the web browsing session;

using an evaluation engine that includes one or more deterministic rules or one or more evaluative rules that are applied to the volume of test data to generate a set of filtered results comprising modeled true clicks; and

comparing the modeled true clicks in the set of filtered results to the known true clicks to evaluate performance of the evaluation engine.

12. The one or more computer-readable storage media of claim 11 in which the method further includes a step of modifying the evaluation engine by changing the discrimination criteria or the rules responsively to the comparing.

13. The one or more computer-readable storage media of claim 12 in which the evaluating comprises measuring a distance between the generated true clicks from the evaluation engine and the known true clicks and including a further step of repeating the modifying until no significant improvement in the distance is measured.

14. The one or more computer-readable storage media of claim 13 in which the improvement comprises maximizing a number of objects in the filtered results which correspond to known true clicks and minimizing a number of objects in the filtered results which correspond to known false clicks.

15. The one or more computer-readable storage media of claim 11 in which the ascertaining is performed in a laboratory environment.

16. The one or more computer-readable storage media of claim 11 in which the generating of the volume of test data utilizes a DPI machine.

17. A computer-implemented method for applying an evaluation engine for distinguishing between true clicks and false clicks in a web browsing session between a network access device and a remote server, the method comprising the steps of:

configuring a network intelligence solution with access to a stream of IP packets utilized in the web browsing session so that the network intelligence solution may tap at least a portion of the IP packets;

applying deep packet inspection to the tapped IP packets to extract selected information from the IP packets according to discrimination criteria, the discrimination criteria including at least one of technical data, page information, or timing-based information;

applying an evaluation engine incorporating rules arranged for filtering the extracted information to substantially include true clicks and substantially exclude false clicks, the rules being deterministic or implementing aggregative evaluation of each of the discrimination criteria; and

comparing a result of application of the evaluation engine to the extracted information against known true clicks that are observed to occur during the web browsing session.

18. The computer-implemented method of claim 17 in which the aggregative evaluation is additive or multiplicative.

19. The computer-implemented method of claim 17 in which the aggregative evaluation uses weighting of the discrimination criteria.

20. The computer-implemented method of claim 19 further including a step of optimizing the weighting using standard dummy regression.