Method and system for monitoring online computer network behavior and creating online behavior profiles

• US 7,996,912 B2
• Filed: 01/29/2009
• Issued: 08/09/2011
• Est. Priority Date: 06/30/2000
• Status: Expired due to Term

• Current Assignee: Connexity Audience, Inc.
• Original Assignee: Hitwise Pty. Ltd. (Experian plc)
• Inventors: Gullette, Brian, Nortman, Randall, Spalink, Jan-Dieter, Hatchell, Andrew
• Primary Examiner(s): Dinh; Minh
• Application Number:
  US12/361,679
• Publication Number:
  US 20090182873A1
• Time in Patent Office: 922 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A method and system for monitoring users on one or more computer networks, disassociating personally identifiable information from the collected data, and storing it in a database so that the privacy of the users is protected. The system receives a user identifier and uses it to creates an anonymized identifier, defined as a user identifier stripped of all personally identifiable information. The anonymized identifier is then associated with one or more users'"'"' computer network transactions. The data is stored by a collection engine and then aggregated to a central database server across a computer network.

Claims

1. A computer-implemented method for collecting network usage data about users accessing a network and resources thereon without associating personally identifiable information with the usage data, comprising:

obtaining an identifier at a network service provider representing a user of a computer network;

creating an anonymized identifier using the identifier obtained from the network service provider;

associating the anonymized identifier with the user;

identifying a network communication session between a host and the user;

identifying a network request collected by the network service provider, the network request comprising a resource location identifier, the network request being determined to be related to the network communication session;

stripping personally identifying data from the resource location identifier to create a modified resource location identifier, based on matching one or more patterns against the resource location identifier;

recording, in a database, data associating the anonymized identifier with a subset of data related to the network communication session, the subset of data comprising the modified resource location identifier.

2. The method of claim 1, wherein the obtained identifier is a Mobile Subscriber Integrated Services Digital Network (MSISDN) number.

3. The method of claim 1, wherein the obtained identifier is a static Internet Protocol (IP) address.

4. The method of claim 1, wherein the anonymized identifier is created by applying a one-way hashing function to the obtained identifier.

5. The method of claim 1, wherein the anonymized identifier is created by applying a one-way hashing function to the obtained identifier and a security key.

6. The method of claim 5, wherein the one-way hashing function is the Secure Hashing Algorithm 1 (SHA-1).

7. The method of claim 5, wherein the one-way hashing function is the Message Digest 4 (MD4) algorithm.

8. The method of claim 5, wherein the one-way hashing function is the Message Digest 5 (MD5) algorithm.

9. The method of claim 5, wherein the one-way hashing function is the Digital Encryption Standard (DES).

10. The method of claim 1, wherein obtaining the identifier representing the user of the computer network includes:

receiving packets at the network service provider sent by an authentication server; and

extracting the identifier at the network service provider from the received packets.

11. The method of claim 10, wherein the authentication server is a RADIUS authentication server.

12. The method of claim 11, wherein the received packets are RADIUS authentication packets.

13. The method of claim 10, wherein the authentication server is a Dynamic Host Configuration Protocol (DHCP) server.

14. The method of claim 1, further comprising monitoring network traffic, collecting data about network transactions and recording the data in the database.

15. The method of claim 14, further comprising creating online behavioral profiles unassociated with individual users, based at least in part on the data recorded in the database.

16. The method of claim 14, wherein multiple collection engines monitor network traffic, collect data about network transactions and record the data in the database, and further comprising, configuring and managing said multiple collection engines and aggregating data collected therewith through the use of an aggregation server.

17. The computer-implemented method of claim 1, wherein matching one or more patterns against the resource location identifier comprises searching for a predefined set of words in the resource location identifier.

18. The computer-implemented method of claim 1, wherein the resource location identifier is a Uniform Resource Locator.

19. The computer-implemented method of claim 1, further comprising database-associating the anonymized identifier with a physical location of the user.

20. The computer-implemented method of claim 19, wherein the physical location of the user is based on a billing address of the user.

21. The computer-implemented method of claim 19, wherein the physical location of the user identifies the general location of that address without revealing personally identifying information of the user.

22. A computing device configured to collect network usage data relating to users accessing a network and resources thereon without associating personally identifiable information with the usage data, comprising:

one or more network interfaces configured to receive network packets from an internet service provider, the network packets originating from a plurality of computer servers, the network packets comprising information descriptive of a use of a respective computer network; and

a processor configured to extract data from the network packets, aggregate the data from different networks for a session into second data that describes use of a plurality of computer networks during the session, and store the second data in a database;

the second data being associated in the database with an anonymized identifier associated with a user of the internet service provider, wherein the anonymized identifier comprises no personally identifying information of the user;

wherein the extracted data comprises a resource location identifier, and wherein the processor is further configured to strip personally identifying data from the resource location identifier prior to storing the second data in the database.

23. The computing device of claim 22, wherein the plurality of computer servers comprises internet service providers.

24. The computing device of claim 22, wherein the second data comprises one or more identifiers that anonymously identify a user, the second data further comprising associated information about the behavior of the user on the plurality of computer networks.

25. The computing device of claim 22, wherein the second data comprises information relating to transactions that occur online.

26. The computing device of claim 22, wherein the processor is configured to strip personally identifying data from the resource location identifier by searching for a predefined set of words in the resource location identifier.

27. The computing device of claim 22, wherein the resource location identifier is a Uniform Resource Locator.

28. The computing device of claim 22, wherein the processor is further configured to associate the anonymized identifier with a physical location of the user.

29. The computing device of claim 28, wherein the physical location of the user is based on a billing address of the user.

30. The computing device of claim 28, wherein the physical location of the user identifies the general location of that address without revealing personally identifying information of the user.