ABUSIVE TRAFFIC DETECTION

• US 20180255088A1
• Filed: 05/07/2018
• Published: 09/06/2018
• Est. Priority Date: 06/15/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Cazin, Victor, Rival, Nicolas
• Granted Patent: US 10,554,679 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Aspects of an abuse detection system for a web service include an abuse detection engine executing on a server. The abuse detection engine includes a pre-processing module for aggregating a data set for processing and analysis; a suspiciousness test module for identifying suspicious content owners and suspicious users; a graphing module for finding connections between suspicious content owners and suspicious users; an analysis module for determining which groups are constituted of fraudulent or abusive accounts; and a notification generation and output module for generating a list of abusive entities and a notification for output to at least one of: the abusive entity, a digital content distribution company associated with the abusive entity, and a legal department or other entity for further investigation or action. Additionally, royalties for content consumptions associated with abusive accounts may be held. Aspects of an abusive traffic detection method enable multi-account and multi-content owner fraud detection.

Claims

1. A method of detecting abusive traffic on a web service, the method comprising:

gathering consumption records associated with consumption of digital content via the web service, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;

aggregating a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records;

identifying one or more suspicious content owners, wherein the one or more suspicious content owners provide digital content accessible via the web service;

identifying one or more suspicious content users, wherein the one or more suspicious content users are consumers of digital content via the web service;

generating a notification including the at least one of the one or more suspicious content owners or the at least one of the one or more suspicious content users; and

holding payment to the suspicious content owner based on the abusive traffic.

2. The method of claim 1, further comprising filtering consumption records of consumption that occurred by mistake.

3. The method of claim 1, wherein aggregating the set of consumption data comprises aggregating a set of consumption data associated with consumption within a predetermined time period.

4. The method of claim 1, wherein the payments are royalties associated with consumption of digital content.

5. The method of claim 1, wherein the digital content is a content item on the web service.

6. The method of claim 1, further comprising filtering consumption records that of legitimate consumption of content.

7. The method of claim 1, wherein the consumption of the digital content via the web service includes:

downloading the digital content;

or

streaming the digital content.

8. A computing device for detecting abusive traffic on a web service, the computing device comprising:

a processor, a memory, and an output device for presenting a visual output to a user, the visual output comprising a user interface of an application, the computing device operable to;

gathering consumption records associated with consumption of digital content via the web service, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;

aggregating a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records;

identifying one or more suspicious content owners, wherein the one or more suspicious content owners provide digital content accessible via the web service;

identifying one or more suspicious content users, wherein the one or more suspicious content users are consumers of digital content via the web service;

generating a notification including the at least one of the one or more suspicious content owners or the at least one of the one or more suspicious content users; and

holding payment to the suspicious content owner based on the abusive traffic.

9. The computing device of claim 8, further comprising filtering consumption records of consumption that occurred by mistake.

10. The computing device of claim 8, wherein aggregating the set of consumption data comprises aggregating a set of consumption data associated with consumption within a predetermined time period.

11. The computing device of claim 8, wherein the payments are royalties associated with consumption of digital content.

12. The computing device of claim 8, wherein the digital content is a content item on the web service.

13. The computing device of claim 8, further comprising filtering consumption records that of legitimate consumption of content.

14. The computing device of claim 8, wherein the consumption of the digital content via the web service includes:

downloading the digital content;

or

streaming the digital content.

15. A computer readable storage medium containing computer executable instructions which, when executed by a computer, perform a method for detecting abusive traffic on a web service, the method comprising:

gathering consumption records associated with consumption of digital content via the web service, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;

filtering consumption records of consumption that occurred by mistake;

aggregating a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records;

identifying one or more suspicious content owners, wherein the one or more suspicious content owners provide digital content accessible via the web service;

identifying one or more suspicious content users, wherein the one or more suspicious content users are consumers of digital content via the web service;

generating a notification including the at least one of the one or more suspicious content owners or the at least one of the one or more suspicious content users; and

holding payment to the suspicious content owner based on the abusive traffic.

16. The computer readable storage medium of claim 15, wherein aggregating the set of consumption data comprises aggregating a set of consumption data associated with consumption within a predetermined time period.

17. The computer readable storage medium of claim 15, wherein the payments are royalties associated with consumption of digital content. The computer readable storage medium of claim 15, wherein the digital content is a content item on the web service.

19. The computer readable storage medium of claim 15, further comprising filtering consumption records that of legitimate consumption of content.

20. The computer readable storage medium of claim 15, wherein the consumption of the digital content via the web service includes:

downloading the digital content;

or

streaming the digital content.