Methods and apparatus for detecting and filtering forced traffic data from network data

• US 9,008,104 B2
• Filed: 03/25/2013
• Issued: 04/14/2015
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Dstillery, Inc.
• Original Assignee: Dstillery, Inc.
• Inventors: Stitelman, Ori M., Hook, Rodney, Mei, Tommy Yiwel
• Primary Examiner(s): HO, DUC CHI
• Application Number:
  US13/850,099
• Publication Number:
  US 20140119185A1
• Time in Patent Office: 750 Days
• Field of Search: 709/224, 726/22, 705/26.3
• US Class Current: 370/401
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 47/10 Flow control; Congestion control

Abstract

A non-transitory processor-readable medium is provided that stores code representing instructions to be executed by a processor to filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations. The plurality of preselected network locations are associated with forced web traffic patterns. The processor is also caused to filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period. The second time is after the first time.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns; and

filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period, the second time being after the first time, an end of the second predefined time period being after an end of the first predefined approval.

2. The non-transitory processor-readable medium of claim 1, the code to filter data associated with the entity for a second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

3. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

modify filtering of data associated with the entity in response to receiving a new forced web traffic pattern.

4. The non-transitory processor-readable medium of claim 3, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to cause the processor to modify filtering including code to cause the processor to filter data associated with the entity during the at least one temporary period of forced web traffic.

5. The non-transitory processor-readable medium of claim 1, wherein the entity is associated with at least one of a spyware or a virus.

6. The non-transitory processor-readable medium of claim 1, wherein the data associated with the entity includes bid requests received in an online real-time bidding auction.

7. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

receive an indication of the entity accessing a first network location at a first time, the first network location being preselected as associated with forced web traffic patterns, the first time being before filtering data associated with the entity for the first time period,

the code to cause the processor to filter data associated with the entity for the first predefined time period including code to cause the processor to filter data from the first network location and data from a second network location not being preselected as being associated with forced web traffic patterns.

8. The non-transitory processor-readable medium of claim 1, wherein:

the data associated with the entity includes data from the preselected network location and data from a network location not included within the plurality of preselected network locations,

the data from the second network location not included within the plurality of preselected network locations being produced in response to the entity accessing the second network location not included within the plurality of preselected network locations.

9. The non-transitory processor-readable medium of claim 1, wherein:

the code to cause the processor to filter data associated with the entity for a first predefined time period includes code to cause the processor to;

receive data associated with the entity during the first predefined time period; and

delete a first datum associated with forced web traffic; and

the code to cause the processor to filter data associated with the entity for a second predefined time period includes code to cause the processor to;

receive data associated with the entity during the second predefined time period; and

delete a second datum associated with forced web traffic.

18. The non-transitory processor-readable medium of claim 7, wherein:

the first signal is a signal to remove a third datum from data associated with the entity, the third datum associated with forced web traffic; and

the second signal is a signal to remove a fourth datum associated with forced web traffic from data associated with the entity, the fourth datum associated with forced web traffic.

10. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a first datum associated with an access by an entity to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns;

send a first signal to filter data associated with the entity for a predefined time period based, at least in part, on the first datum;

receive a second datum associated with an access by the entity to a website location during the first predefined time period; and

send a second signal to modify filtering of data associated with the entity based, at least in part, on the second datum.

11. The non-transitory processor-readable medium of claim 10, wherein the predefined time period is a first predefined time period, the code to cause the processor to send the second signal to modify filtering comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity if the second datum indicates no access to a preselected network location from the plurality of preselected network locations during the predefined time period; and

send a signal to filter data associated with the entity for a second predefined time period if the second datum indicates at least one access to a preselected network location from the plurality of preselected network locations during the first predefined time period, an end of the second predefined time period being after an end time of the first predefined time period.

12. The non-transitory processor-readable medium of claim 11, wherein a length of the first predefined time period equals a length of the second predefined time period.

13. The non-transitory processor-readable medium of claim 10, wherein the entity is associated with at least one of a spyware or a virus.

14. The non-transitory processor-readable medium of claim 10, wherein the code to cause the processor to send the second signal to modify filtering includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to any of the plurality of preselected network locations.

15. The non-transitory processor-readable medium of claim 10, wherein the code to cause the processor to send the second signal to modify filtering includes code to cause the processor to:

send a signal to start a counter of number of accesses by the entity to any of the plurality of preselected network locations if the second datum indicates no access to a preselected network location from the plurality of preselected network locations during the predefined time period.

16. The non-transitory processor-readable medium of claim 10, wherein the data associated with the entity includes a bid request received in an online real-time bidding auction.

17. The non-transitory processor-readable medium of claim 10, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to cause the processor to send the second signal to modify filtering includes code to cause the processor to send the second signal to filter data associated with the entity during the at least one temporary period of forced web traffic.

19. The non-transitory processor-readable medium of claim 10, further comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity after an end of the predetermined time period in response to not receiving a datum associated with an access by the entity to any of the plurality of network locations.

20. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive data associated with an access by an entity to a network location from a plurality of preselected network locations, during a first predefined time period;

define a model of behavior for the entity based, at least in part, on the data; and

send a signal to filter data associated with the entity for a second predefined time period based, at least in part, on the model of behavior of the entity, an end of the second predefined time period being after an end of the first predefined time period.

21. The non-transitory processor-readable medium of claim 20, the code further comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity based, at least in part, on the model of behavior of the entity.

22. The non-transitory processor-readable medium of claim 20, wherein the code to cause the processor to send a signal to filter data includes code to cause the processor to send a signal to filter data based on simultaneous multiple access to a network location from the plurality of preselected network locations by a plurality of entities.

23. The non-transitory processor-readable medium of claim 20, wherein the network location is a first network location, the code further comprising code to cause the processor to:

receive data associated with an access to a second network location by the entity during the first predefined time period; and

define the model of behavior for the entity based, at least in part, on the data associated with the access to the second network location by the entity.

24. The non-transitory processor-readable medium of claim 20, the code further comprising code to cause the processor to:

define a forced web traffic pattern based, at least in part, on the model of behavior of the entity, the code to cause the processor to send the signal to filter being based on the forced web traffic pattern.

25. The non-transitory processor-readable medium of claim 24, wherein:

the code to cause the processor to send the signal to filter is based on a plurality of forced web traffic patterns,

the plurality of forced web traffic patterns are based, at least in part, on a plurality of models of behavior of a plurality of entities, the plurality of entities including the entity.

26. The non-transitory processor-readable medium of claim 20, wherein the signal to filter data associated with the entity for the second predefined time period is a signal to delete a datum associated with forced web traffic from data associated with the entity.