Data transfer for network interaction fraudulence detection

• US 7,801,985 B1
• Filed: 11/19/2007
• Issued: 09/21/2010
• Est. Priority Date: 03/22/2007
• Status: Active Grant

• Current Assignee: comScore, Inc.
• Original Assignee: Anchor Intelligence, Inc.
• Inventors: Pitkow, Jim, Brown, Marc, Chelliah, Raman
• Primary Examiner(s): JEAN GILLES, JUDE
• Application Number:
  US11/986,312
• Time in Patent Office: 1,037 Days
• Field of Search: 709/224, 709/214, 709/245, 709/226, 709/229, 709/227, 707/100, 707/3, 707/10
• US Class Current: 709/224
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/0633 Lists, e.g. purchase orders, compilation or processing
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Transferring metadata is disclosed. Information about a network interaction is processed to generate metadata describing the network interaction. Based on the metadata it is determined whether the metadata is to be transferred to an aggregator. In the event that the metadata is to be transferred, one or more aggregators are determined to which the metadata is to be transferred. The metadata is transferred to the one or more aggregators.

Claims

1. A system for transferring metadata, comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to;

process information about a first network interaction to generate metadata describing the network interaction;

determine based on the metadata whether the metadata is to be transferred to an aggregator, wherein determining whether the metadata is to be transferred includes determining whether a confidence level is below a threshold;

in the event that the metadata is to be transferred, determine one or more aggregators to which the metadata is to be transferred;

transfer the metadata to the one or more aggregators, wherein one of the one or more aggregators uses the metadata for determining fraudulence or legitimacy of a second network interaction.

2. A system as in claim 1, wherein the network interaction is a click.

3. A system as in claim 1, wherein the information about the network interaction includes one or more of the following:

an IP address, a time stamp, a network route, or a referring IP address.

4. A system as in claim 1, wherein the metadata is one or more of the following:

a statistic, a distribution, an interclick time, a composite measure of clicks, a model, a model parameter, HTTP data, TCP data, machine fingerprint data, or user fingerprint data.

5. A system as in claim 1, wherein the confidence level is based on one or more models.

6. A system as in claim 5, wherein the one or more models use the information about the network interaction as input information.

7. A system as in claim 1, wherein determining whether the metadata is to be transferred includes determining whether a certainty level is below a threshold.

8. A system as in claim 7, wherein the certainty level is based on one or more models.

9. A system as in claim 8, wherein the one or more models use the information about the network interaction as input information.

10. A system as in claim 1, wherein determining whether the metadata is to be transferred includes determining whether the metadata indicates a red alert situation.

11. A system as in claim 10, wherein the red alert situation is based on one or more models.

12. A system as in claim 11, wherein the one or more models use the information about the network interaction as input information.

13. A system as in claim 1, wherein determining whether the metadata is to be transferred includes determining a sampling of the metadata.

14. A system as in claim 1, wherein the one or more aggregators includes one or more of the following:

a centralized aggregator, a country aggregator, a regional aggregator, a local aggregator, an organizational aggregator, a peer, an edge appliance, a model server, an analytics server, a local tier peer, a layer tier server, or a segment aggregator.

15. A system as in claim 1, wherein transferring the metadata includes encrypting the metadata before sending the metadata to the one or more aggregators.

16. A system as in claim 1, wherein transferring the metadata includes decrypting the metadata after receiving the metadata at one of the one or more aggregator.

17. A method for transferring metadata, comprising:

processing information about a first network interaction to generate metadata describing the network interaction;

determining based on the metadata whether the metadata is to be transferred to an aggregator, wherein determining whether the metadata is to be transferred includes determining whether a confidence level is below a threshold;

in the event that the metadata is to be transferred, determining one or more aggregators to which the metadata is to be transferred;

transferring the metadata to the one or more aggregators, wherein one of the one or more aggregators uses the metadata for determining fraudulence or legitimacy of a second network interaction.

18. A computer program product for transferring metadata, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

processing information about a first network interaction to generate metadata describing the network interaction;

determining based on the metadata whether the metadata is to be transferred to an aggregator, wherein determining whether the metadata is to be transferred includes

determining whether a confidence level is below a threshold;

in the event that the metadata is to be transferred, determining one or more aggregators to which the metadata is to be transferred;

transferring the metadata to the one or more aggregators, wherein one of the one or more aggregators uses the metadata for determining fraudulence or legitimacy of a second network interaction.