System and method of using spatial and temporal signals to identify and prevent attacks

• US 8,489,732 B1
• Filed: 05/07/2010
• Issued: 07/16/2013
• Est. Priority Date: 08/07/2009
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Liang, Sam, Chu, Michael, Luo, Yuhua, Ji, Zhengrong, Yu, Yan
• Primary Examiner(s): Nguyen, Phuoc
• Assistant Examiner(s): Belani, Kishin G
• Application Number:
  US12/775,848
• Time in Patent Office: 1,166 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

Systems and methods according to aspects of the invention verify requests for information over a network. Computing devices communicating over a network transmit numerous signals with various types of information including spatial information, temporal information, device-specific information, and transmission specific information. This information may be used to generate statistical records of valid request for information. Various combinations of these signals may be used to determine whether a request for information is a valid request based on the statistical records associated with the signals. Where a request for information has been verified, the system and method may provide the information. Where the request for information has not been verified, the system and method may deny the request for information. Thus the system and method may be used to prevent and block scraping and spamming attacks.

Claims

1. A method of determining the validity of a request for information over a network, the method comprising:

receiving a first request from a node of the network, the request associated with first location information and a first time attribute;

receiving a second request from the node of the network, the request associated with second location information and a second time attribute;

determining a first location of a device from the first location information;

determining a second location of the device from the second location information;

determining a time difference between the first time attribute and the second time attribute;

determining a geographic distance between the first location and the second location;

selecting, from a plurality of statistical records of requests each associated with a time difference and a threshold distance, a statistical record of requests based on the time difference;

generating a list of valid combinations identifying valid combinations of device information and transmission information; and

identifying the second request as a valid request if the geographic distance is less than the threshold distance associated with the selected statistical record;

wherein the identifying of the second request as a valid request further includes identifying a geographic location, device information and device transmission information identified in the list of valid combinations.

2. The method of claim 1, further comprising identifying the second request as an invalid request if the geographic distance is greater than the threshold distance associated with the selected statistical record.

3. The method of claim 1, wherein the selected statistical record of requests includes queries per second.

4. The method of claim 1, wherein the selected statistical record of requests includes queries per second identifying unique keys, where each unique key indicates that a request for information is newly requested.

5. The method of claim 1, wherein the selected statistical record of requests includes a time distribution of requests from a particular geographic area.

6. The method of claim 1, wherein the selected statistical record of requests includes failure rates for requests for information.