Click quality classification and delivery

• US 8,670,334 B2
• Filed: 12/15/2008
• Issued: 03/11/2014
• Est. Priority Date: 06/04/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Keohane, Michael F., Plesman, Maarten, Novak, Jon, Smethurst, Adrian C., Mammoliti, Vincent
• Primary Examiner(s): Oveissi, David
• Application Number:
  US12/335,485
• Publication Number:
  US 20090303894A1
• Time in Patent Office: 1,912 Days
• Field of Search: 370/252, 370/352, 370/409, 705 144- 6, 705/10, 705/14, 709/201, 709/224, 709/245
• US Class Current: 370/252
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0248 Avoiding fraud
• CPC Class Codes: H04L 47/122 by diverting traffic away from congested entities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In one embodiment, a method includes receiving a packet flow associated with a click-through from an end user node destined for an advertiser server; extracting information from the packet flow; analyzing the extracted information to determine one or more characteristics of the packet flow; and classifying the packet flow based on the determined one or more characteristics; modifying the packet flow to include classification information to provide classification information indicating a quality level of the click-through. The packet flow may include a hypertext transfer protocol GET request. Modifying the packet flow may include adding a tag with classification information that indicates a likelihood of fraudulent click behavior associated with the packet flow.

Claims

1. A method comprising:

receiving a packet flow associated with a click-through from an end user node and destined for an advertiser server;

extracting information from the packet flow;

analyzing the extracted information to classify a quality of the click-through at a selected one of a plurality of quality levels; and

modifying the packet flow to include a tag that includes classification information indicating that the click-through has the selected one of the plurality of quality levels, wherein the tag is any of a virtual local area network tag, a multi protocol label switching label, and a quality of service marking tag.

2. The method of claim 1 wherein the selected one of the plurality of quality levels relates to a likelihood of fraudulent click-through behavior associated with the packet flow.

3. The method of claim 1 wherein extracting includes extracting information associated with a hypertext transfer protocol GET request.

4. The method of claim 1 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a variable representation inserted in the GET request.

5. The method of claim 1 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a cookie field inserted in the GET request.

6. The method of claim 1 wherein receiving includes receiving the packet flow redirected from a router and further comprising sending the modified packet flow to the router.

7. The method of claim 1 wherein analyzing the extracted information includes comparing the extracted information to signatures in an analysis database.

8. An apparatus comprising:

a first network interface configured to receive a packet flow associated with a click-through from an end user node and destined for an advertiser server; and

a processor coupled to the first network interface and configured to extract information from the packet flow, analyze the extracted information to classify a quality of the click-through at a selected one of a plurality of quality levels, and modify the packet flow to include a tag that includes classification information indicating that the click-through has the selected one of the plurality of quality levels, wherein the tag is any of a virtual local area network tag, a multi protocol label switching label, and a quality of service marking tag.

9. The apparatus of claim 8 wherein the selected one of the plurality of quality levels relates to a likelihood of fraudulent click-through behavior associated with the packet flow.

10. The apparatus of claim 8 wherein the processing logic is configured to extract information associated with a hypertext transfer protocol GET request.

11. The apparatus of claim 8 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a variable representation inserted in the GET request.

12. The apparatus of claim 8 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a cookie field inserted in the GET request.

13. The apparatus of claim 8 wherein the first network interface is configured to receive the packet flow redirected from a router and further comprising a second network interface configured to send the modified packet flow to the router.

14. The apparatus of claim 8 further comprising an analysis database and wherein the processor is configured to analyze the extracted information by comparing the extracted information to signatures in the analysis database.

15. A method comprising:

receiving, at a router, a packet flow associated with a click-through from an end user node and destined for an advertiser server;

redirecting the packet flow from the router to a click engine;

receiving the redirected packet flow at the click engine;

extracting information from the packet flow;

analyzing the extracted information to classify a quality of the click-through at a selected one of a plurality of quality levels;

modifying the packet flow to include a tag that includes classification information indicating that the click-through has the selected one of the plurality of quality levels, wherein the tag is any of a virtual local area network tag, a multi protocol label switching label, and a quality of service marking tag;

sending the modified packet flow from the click engine to the router; and

routing the modified packet flow at the router to the advertiser server.

16. The method of claim 15 wherein the selected one of the plurality of quality levels relates to a likelihood of fraudulent click-through behavior associated with the packet flow.

17. The method of claim 15 wherein extracting includes extracting information associated with a hypertext transfer protocol GET request.

18. The method of claim 15 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a variable representation inserted in the GET request.

19. The method of claim 15 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a cookie field inserted in the GET request.

20. The method of claim 15 wherein analyzing the extracted information includes comparing the extracted information to signatures in an analysis database.

21. A system comprising:

a router having a network interface configured to receive a packet flow associated with a click-through from an end user node and destined for an advertiser server, and redirection logic configured to redirect the packet flow;

a click engine having a first network interface configured to receive the redirected packet flow from the router;

a processor configured to (a) extract information from the packet flow, (b) analyze the extracted information to classify a quality of the click-through at a selected one of a plurality of quality levels, (c) modify the packet flow to include a tag that includes classification information indicating that the click-through has the selected one of the plurality of quality levels, wherein the tag is any of a virtual local area network tag, a multi protocol label switching label, and a quality of service marking tag; and

a second network interface configured to send the modified packet flow to the router;

wherein the network interface of the router is further configured to route the modified packet flow to the advertiser server.

22. The system of claim 21 wherein the selected one of the plurality of quality levels relates to a likelihood of fraudulent click-through behavior associated with the packet flow.

23. The system of claim 21 wherein the processor is configured to extract information associated with a hypertext transfer protocol GET request.

24. The system of claim 21 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a variable representation inserted in the GET request.

25. The system of claim 21 wherein the packet flow includes a hypertext transfer protocol GET request and the tag is a cookie field inserted in the GET request.

26. The system of claim 21 further comprising an analysis database and wherein the processor is configured to analyze the extracted information by comparing the extracted information to signatures in the analysis database.

27. An apparatus comprising:

means for receiving a packet flow associated with a click-through from an end user node and destined for an advertiser server;

means for extracting information from the packet flow;

means for analyzing the extracted information to classify a quality of the click-through at a selected one of a plurality of quality levels; and

means for modifying the packet flow to include a tag that includes classification information indicating that the click-through has the selected one of the plurality of quality levels, wherein the tag is any of a virtual local area network tag, a multi protocol label switching label, and a quality of service marking tag.