System and method for monitoring and analyzing internet traffic

• US 6,804,701 B2
• Filed: 05/10/2001
• Issued: 10/12/2004
• Est. Priority Date: 10/04/1999
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Urchin Software Corporation (Alphabet Inc.)
• Inventors: Muret, Paul Nicolas, Moon, Hui Sok
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): JACOBS, LASHONDA T
• Application Number:
  US09/852,264
• Publication Number:
  US 20020042821A1
• Time in Patent Office: 1,251 Days
• Field of Search: 709/203, 709/217-19, 709/223-229
• US Class Current: 709/203
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

A system and method for monitoring and analyzing Internet traffic is provided that is efficient, completely automated, and fast enough to handle the busiest websites on the Internet, processing data many times faster than existing systems. The system and method of the present invention processes data by reading log files produced by web servers, or by interfacing with the web server in real time, processing the data as it occurs. The system and method of the present invention can be applied to one website or thousands of websites, whether they reside on one server or multiple servers. The multi-site and sub-reporting capabilities of the system and method of the present invention makes it applicable to servers containing thousands of websites and entire on-line communities. In one embodiment, the system and method of the present invention includes e-commerce analysis and reporting functionality, in which data from standard traffic logs is received and merged with data from e-commerce systems. The system and method of the present invention can produce reports showing detailed “return on investment” information, including identifying which banner ads, referrals, domains, etc. are producing specific dollars.

Claims

1. A method for resolving host and domain name information for a plurality of internet protocol (IP) numbers, comprising the steps of:

initiating a resolver loop, wherein each iteration of the resolver loop comprises the steps of;

generating a plurality of queries, wherein each query corresponds to an unresolved IP number,

relaying the plurality of queries in parallel to a distributed network, and

waiting, for a period of time, to receive answers to the plurality of queries;

wherein;

the period of time used during a subsequent iteration of the resolver loop is selectively adjusted based on how many answers are received during a previous iteration of the resolver loop, and

relayed queries for which no answer is received during the previous iteration of the resolver loop are again generated and relayed to the distributed network during the subsequent iteration of the resolver loop.

2. The method of claim 1, wherein the period of time used during the subsequent iteration of the resolver loop is increased if no answer was received for one or more of the plurality of queries during the previous iteration of the resolver loop.

3. The method of claim 1, wherein the generating and relaying steps comprise the steps of:

during an initial iteration of the resolver loop, generating and relaying, for an unresolved IP number, a first query requesting an entire IP number;

during a first subsequent iteration of the resolver loop, generating and relaying, if an answer received for the first query does not identify the entire IP number, a second query requesting a first subset of the entire IP address;

during a second subsequent iteration of the resolver loop, generating and relaying, if an answer received for the second query does not identify the first portion of the entire IP address, a third query requesting a second subset of the entire IP address; and

during a third subsequent iteration of the resolver loop, generating and relaying, if an answer received for the third query does not identify the second portion of the entire IP address, a fourth query requesting a third subset of the entire IP address.

4. The method of claim 3, wherein the first, second and third subsets of the entire IP address comprise a Class-C network address, a Class-B network address and a Class-A network address, respectively.

5. The method of claim 3, wherein each of the plurality of queries generated and relayed comprises a unique ID number for matching answers received to corresponding queries.

6. The method of claim 3, wherein the plurality of queries are relayed in parallel to the distributed network via a plurality of User Datagram Protocol sockets.

7. A memory for a computer that stores a program for resolving host and domain name information for a plurality of internet protocol (IP) numbers, wherein the program, when executed by the computer, performs the steps of:

initiating a resolver loop, wherein each iteration of the resolver loop comprises the steps of;

generating a plurality of queries, wherein each query corresponds to an unresolved IP number,

relaying the plurality of queries in parallel to a distributed network, and

waiting, for a period of time, to receive answers to the plurality of queries;

wherein;

the period of time used during a subsequent iteration of the resolver loop is selectively adjusted based on how many answers are received during a previous iteration of the resolver loop, and

relayed queries for which no answer is received during the previous iteration of the resolver loop are again generated and relayed to the distributed network during the subsequent iteration of the resolver loop.