METHODS, SYSTEMS AND MEDIA FOR DETECTING NON-INTENDED TRAFFIC USING CO-VISITATION INFORMATION

• US 20140351931A1
• Filed: 05/06/2014
• Published: 11/27/2014
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Dstillery, Inc.
• Original Assignee: Dstillery, Inc.
• Inventors: Stitelman, Ori M., Reisz, Claudia, Hook, Rodney, Dalessandro, Brian
• Granted Patent: US 9,306,958 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A non-transitory processor-readable medium is provided that stores code representing instructions to be executed by a processor to receive data associated with access by a first plurality of entities to a first website location and to receive data associated with access by a second plurality of entities to a second website location. The processor is also caused to define a co-visitation factor for each of the first website location and the second website location based on the received data. The processor is also caused to, if the co-visitation factor of the first website location and/or the co-visitation factor of the second website location is over a predefined threshold, select the first website location and/or the second website location as target website locations. The processor is caused to send a signal to set a flag associated with each target website location indicating the target website location as a suspicious website location.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code to cause the processor to:

receive a first data associated with access by a first plurality of entities to a first website location;

receive a second data associated with access by a second plurality of entities to a second website location;

define a percentage of total entities in the first plurality of entities and the second plurality of entities that accessed both of the first website location and the second website location based, at least in part, on the first data and the second data;

define a co-visitation factor for each of the first website location and the second website location based, at least in part, on the percentage of total entitles;

send a signal indicating the first website location is a suspicious website location when the co-visitation factor for the first website locations over a predefined threshold;

send a single indicating the second website location is a suspicious website location when the co-visitation factor for the second website location is over the predefined threshold.

2. The non-transitory processor-readable medium of claim 1, wherein:

the code to send the signal associated with the first website location includes code to cause the processor to send a signal to perform at least one of (1) prevent the first website location from being designated to receive advertisements, or (2) block a bid request from the first website location; and

the code to send the signal associated with the second website location includes code to cause the processor to send a signal to perform at least one of (1) prevent the second website location from being designated to receive advertisements, or (2) block a bid request from the second website location.

3. The non-transitory processor-readable medium of claim 1, wherein the first data or the second data includes information indicative of bid requests received in an online real-time bidding auction.

4. The non-transitory processor-readable medium of claim 1, wherein the code to define the co-visitation factor includes code to:

define a normalization of the percentage of total entities for each of the first website location and the second website location based, at least in part, on a number of entities in the first plurality of entities and a number of entities in the second plurality of entities,

the co-visitation factor for each of the first website location and the second website location based, at least in part, on the normalization of the percentage of total entities.

5. The non-transitory processor-readable medium of claim 1, wherein:

the first data is associated with access by the first plurality of entities to the first website location during a first time period;

the second data is associated with access by the second plurality of entities to the second website location during a second time period at least a portion of which overlaps with the first time period; and

the co-visitation factor for each of the first website location and the second website location is defined for access during a third time period that is within the first time period and the second time period.

6. The non-transitory processor-readable medium of claim 1, further comprising code to cause the process to:

send a signal indicating a publisher of the first website location is a suspicious publisher when (1) the co-visitation factor for the first website location is over the predefined threshold, (2) the co-visitation factor for the second website location is over the predefined threshold, and (3) the publisher of the first website location corresponds to a publisher of the second website location.

7. The non-transitory processor-readable medium of claim 6, wherein the code to send the signal indicating the publisher includes code to cause the processor to send a signal to block a bid request from the suspicious publisher.

8. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code to cause the processor to:

receive data associated with access by a plurality of entities to a first plurality of website locations;

define a co-visitation factor for each website location from the first plurality of website locations based, at least in part, on the data;

select a second plurality of website locations from the first plurality of website locations, the co-visitation factor for each website location from the second plurality of website locations being over a predefined threshold;

select a third plurality of website locations from the second plurality of website locations, each website location from the third plurality of website locations being associated with a common publisher; and

send a signal indicating the common publisher is a suspicious publisher.

9. The non-transitory processor-readable medium of claim 8, wherein:

the code to send the signal includes code to cause the processor to send a signal to block a bid request from the suspicious publisher.

10. The non-transitory processor-readable medium of claim 8, wherein the data includes information indicative of bid requests received in an online real-time bidding auction.

11. The non-transitory processor-readable medium of claim 8, wherein the code to define the co-visitation factor includes code to:

define, for each website location from the first plurality of website locations, a percentage of total entities in the plurality of entities that accessed that website location and at least one other website location from the first plurality of website locations; and

define a normalization of the percentage of total entities for each website location from the first plurality of website locations based, at least in part, on a number of entities in the plurality of entities,

the co-visitation factor for each website location from the first plurality of website locations based, at least in part, on the normalization of the percentage of total entities for that website location.

12. The non-transitory processor-readable medium of claim 8, wherein:

a first portion of the data is associated with access during a first time period; and

a second portion of data is associated with access during a second time period at least a portion of which overlaps with the first time period,

the co-visitation factor for each website location from the second plurality of website locations is defined for access during a third time period that is within the first time period and the second time period.

13. The non-transitory processor-readable medium of claim 8, wherein the code to send the signal includes code to cause the processor to send a signal to block a bid request from the suspicious publisher.

14. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code to cause the processor to:

receive data associated with access by a plurality of entities to a plurality of website locations;

calculate, for each website location from the plurality of website locations, a number of entities in the plurality of entities that accessed that website location and at least one other website locations from the plurality of website locations based, at least in part, on the data; and

send, for each website location from the plurality of website locations for which the number of entities for that website location indicates a likelihood of unintended access to that website location, a signal indicating that website location is a suspicious website location.

15. The non-transitory processor-readable medium of claim 14, wherein:

the code to send includes code to cause the processor to send, for each website location from the plurality of website locations and associated with unintended access, a signal to perform at least one of (1) prevent that website location from being designated to receive advertisements, or (2) block a bid request from that website location.

16. The non-transitory processor-readable medium of claim 14, wherein the data includes information indicative of bid requests received in an online real-time bidding auction.

17. The non-transitory processor-readable medium of claim 14, further comprising code to cause the processor to:

define, for each website location from the plurality of website locations, a percentage of total entities in the plurality of entities that accessed that website location and at least one other website location from the plurality of website locations based, at least in part, on the number of entities; and

define, for each website location from the plurality of website locations, a co-visitation factor for that website location based, at least in part, on the percentage of total entitles for that website location,

the code to send includes code to send the signal, for each website location from the plurality of website locations and associated with unintended access, when the co-visitation factor for that website location is over a predefined threshold.

18. The non-transitory processor-readable medium of claim 17, wherein, for each website location from the plurality of website locations, the co-visitation factor for that website location is defined based, at least in part, on a bi-partite graph.

19. The non-transitory processor-readable medium of claim 14, wherein:

the data is associated with access by the plurality of entities to the plurality of website locations during a first time period,

the number of entities, for each website location from the plurality of website locations, is calculated for access during a second time period that is smaller than and within the first time period.

20. The non-transitory processor-readable medium of claim 14, further comprising code to cause the process to:

send, for each suspicious website location, a signal indicating a publisher of that suspicious website location is a suspicious publisher when the publisher of that suspicious website location corresponds to a publisher of at least one other suspicious website location.