METHODS AND APPARATUS FOR DETECTING AND FILTERING FORCED TRAFFIC DATA FROM NETWORK DATA

• US 20140119185A1
• Filed: 03/25/2013
• Published: 05/01/2014
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Dstillery, Inc.
• Original Assignee: Media6degrees
• Inventors: Stitelman, Ori M., Hook, Rodney, Mei, Tommy Yiwel
• Granted Patent: US 9,008,104 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 47/10 Flow control; Congestion control

Abstract

A non-transitory processor-readable medium is provided that stores code representing instructions to be executed by a processor to filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations. The plurality of preselected network locations are associated with forced web traffic patterns. The processor is also caused to filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period. The second time is after the first time.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns; and

filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period, the second time being after the first time.

2. The non-transitory processor-readable medium of claim 1, the code to filter data associated with the entity for a second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

3. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

modify filtering of data associated with the entity in response to receiving a new forced web traffic pattern.

4. The non-transitory processor-readable medium of claim 1, wherein the entity is associated with at least one of a spyware or a virus.

5. The non-transitory processor-readable medium of claim 3, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to modify filtering includes code to cause the processor to filter data associated with the entity during the at least one temporary period of forced web traffic.

6. The non-transitory processor-readable medium of claim 1, wherein the data associated with the entity include bid requests received in an online real-time bidding auction.

7. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a first data associated with an access by an entity to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns;

send a first signal to filter data associated with the entity for a first predefined time period based, at least in part, on the first data;

receive a second data associated with an access by the entity to a website location during the first predefined time period; and

send a second signal to modify filtering of data associated with the entity based, at least in part, on the second data.

8. The non-transitory processor-readable medium of claim 7, the code to modify comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity, if the second data indicates no access to a preselected network location from the plurality of preselected network locations during the first predefined time period; and

send a signal to filter data associated with the entity for a second predefined time period if the second data indicates at least one access to a preselected network location from the plurality of preselected network locations during the first predefined time period, an end time of the second predefined time period being after an end time of the first predefined time period.

9. The non-transitory processor-readable medium of claim 8, wherein a length of the first predefined time period equals a length of the second predefined time period.

10. The non-transitory processor-readable medium of claim 7, wherein the entity is associated with at least one of a spyware or a virus.

11. The non-transitory processor-readable medium of claim 7, the code to send the second signal to modify filtering includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

12. The non-transitory processor-readable medium of claim 7, the code to send the second signal to modify filtering includes code to cause the processor to:

send a signal to start a counter of number of accesses by the entity to a preselected network location from the plurality of preselected network locations, if the second data indicates no access to a preselected network location from the plurality of preselected network locations during the first predefined time period.

13. The non-transitory processor-readable medium of claim 7, wherein the data associated with the entity include bid requests received in an online real-time bidding auction.

14. The non-transitory processor-readable medium of claim 7, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to send the second signal to modify filtering includes code to cause the processor to filter data associated with the entity during the at least one temporary period of forced web traffic.

15. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

for each preselected network location from a plurality of preselected network locations, receive data associated with an access to that preselected network location by an entity, during a first predefined time period;

define a model of behavior for the entity based, at least in part, on the data; and

send a signal to filter data associated with the entity for a second predefined time period based, at least in part, on the model of behavior of the entity.

16. The non-transitory processor-readable medium of claim 15, the code further comprising code to cause the processor to:

send a signal to stop filtering the entity based, at least in part, on the model of behavior of the entity.

17. The non-transitory processor-readable medium of claim 15, wherein the code to filter includes code to filter based on simultaneous multiple access to a preselected network location from the plurality of preselected network locations by a plurality of entities.

18. The non-transitory processor-readable medium of claim 15, the code further comprising code to cause the processor to:

receive data associated with an access to a non-preselected network location by the entity, during the first predefined time period; and

define the model of behavior for the entity based, at least in part, on the data associated with the access to the non-preselected network location by the entity.

19. The non-transitory processor-readable medium of claim 15, the code further comprising code to cause the processor to:

define a forced web traffic pattern based, at least in part, on the model of behavior of the entity, the code to send the signal to filter being based on the forced web traffic.

20. The non-transitory processor-readable medium of claim 19, wherein:

the code to send the signal to filter is based on a plurality of forced web traffic patterns,

the plurality of forced web traffic patterns are based, at least in part, on the model of behavior of a plurality of entities.