Automatic identification of travel and non-travel network addresses
First Claim
1. A method for classifying network addresses, comprising:
- collecting and analyzing user event data in logs in response to user activity;
determining non-travel network addresses as a first type of location information from the user event data;
determining travel network addresses as a second type of location information with respect to the non-travel network addresses by applying a distance parameter to geolocation location information; and
determining a network address, of the non-travel network addresses and the travel network addresses, that is a virtual private network (VPN) address or a proxy address based on a metric by applying the metric to two network addresses to determine that a user did not physically travel between locations specified by the two network addresses, wherein the determined network address is one of the two addresses.
2 Assignments
0 Petitions
Accused Products
Abstract
A system to automatically classify types of IP addresses associated with a user. Information, such as user names, machine information, IP address, etc., may be obtained from logs. For each user or host in the logs, home IP addresses are identified from IP addresses where the user or host shows a predetermined level of activity. Travel IP addresses are identified, which are IP addresses at locations greater than a predetermined distance from the home IP addresses, as determined from geolocation data. A pattern analysis may be performed to determine which of the home IP addresses are work IP addresses associated with the user or host. The system may thus provide a classification of a user'"'"'s or host'"'"'s associated IP addresses as being one of travel, home, and work IP addresses. From this classification, mobility patterns may be derived, as well as applications to enhance security, advertising, search and network management.
-
Citations
20 Claims
-
1. A method for classifying network addresses, comprising:
-
collecting and analyzing user event data in logs in response to user activity; determining non-travel network addresses as a first type of location information from the user event data; determining travel network addresses as a second type of location information with respect to the non-travel network addresses by applying a distance parameter to geolocation location information; and determining a network address, of the non-travel network addresses and the travel network addresses, that is a virtual private network (VPN) address or a proxy address based on a metric by applying the metric to two network addresses to determine that a user did not physically travel between locations specified by the two network addresses, wherein the determined network address is one of the two addresses. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A method for classifying network addresses, comprising:
-
determining location information of the network addresses; identifying candidate network addresses using the location information of the network addresses; filtering network addresses from the candidate network addresses that are associated with proxy servers or virtual private network (VPN) servers based on a metric by applying the metric to two network addresses to determine that a user did not physically travel between locations specified by the two network addresses, and removing one of the two addresses from the candidate network addresses; and identifying non-travel network addresses and travel network addresses using the filtered candidate network addresses and a distance parameter. - View Dependent Claims (16)
-
-
17. A method for classifying network addresses associated with a user, comprising:
-
determining location information of the network addresses; identifying candidate first locations from the location information; determining second locations from the candidate first locations using a geographic parameter with respect to the location information, and based on patterns of use of the network addresses; and filtering locations from the first and second locations that are associated with proxy servers or virtual private network (VPN) servers based on a metric by applying the metric to two locations of the first and second locations to determine that the user did not physically travel between the two locations, and removing one of the two locations from either the first or the second locations. - View Dependent Claims (18, 19, 20)
-
Specification