Early detection of high volume peer-to-peer swarms

• US 9,386,089 B2
• Filed: 06/04/2009
• Issued: 07/05/2016
• Est. Priority Date: 11/11/2008
• Status: Active Grant

• Current Assignee: NBC Universal Media LLC (Comcast Corporation)
• Original Assignee: NBC Universal Media LLC (Comcast Corporation)
• Inventors: Doganaksoy, Necip, Lizzi, John Michael, Saha, Angshuman, Marasanapalle, Jayanth Kalle, Cates, Joseph E., Huynh, Michelle My-Ly, Skinner, Andrew Francis
• Primary Examiner(s): Khan, Aftab N.
• Application Number:
  US12/478,356
• Publication Number:
  US 20100121955A1
• Time in Patent Office: 2,588 Days
• Field of Search: 709/224, 709/226, 726/31
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 12/00 Data switching networks interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units G06F13/00
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

Early detection of high volume swarms in a peer-to-peer network, including a data feed of peer-to-peer swarm activity, and an analytics engine processing the data feed and identifying the high volume swarms that have parameters that exceed a threshold. The system can include a pre-processing section for conditioning the swarm data for the analytics section. There can also be a verification section that confirms that the peer download file matches the target file. The early detection provides for enhanced anti-piracy efforts, improved allocation of network resources, and better business decision-making.

Claims

1. An early identification system for high volume swarms involved in distribution of a target asset on a peer-to-peer network, comprising:

a data gatherer stored on a non-transitory computer readable medium with executable code that gathers swarm data including peer-to-peer swarm activity involving distribution of peer-to-peer content;

data gatherer circuitry configured to execute the executable code of the data gatherer;

an analytics section stored on a computer readable medium with executable code establishing a high volume swarm detection threshold for the target asset and processing the swarm data, wherein;

the high volume swarm detection threshold is initially set as a static number and the static number is used until a level of swarm data defined by an adjustable threshold parameter is collected; and

analytics section circuitry configured to identify and flag the high volume swarms as those having a number of unique peers involved in the distribution of the target asset such that the number of unique peers exceeds the threshold, such that the early identification system indicates the high volume swarms involved in distribution of the target asset.

2. The system according to claim 1, further comprising a verification section for confirming that the peer-to-peer content from the high volume swarms is likely to be the target asset.

3. The system according to claim 1, wherein the unique peers are based upon unique Internet Protocol (IP) addresses.

4. The system according to claim 1, wherein the level of swarm data is at least swarm data for 30 swarms.

5. The system according to claim 1, wherein the threshold is calculated using a predictive model or a probabilistic model.

6. The system according to claim 1, further comprising a pre-processing section for conditioning the swarm data.

7. The system according to claim 1, wherein network resources are allocated based upon the high volume swarms.

8. The system according to claim 1, wherein the data gathers are crawlers in the peer-to-peer network.

9. The system according to claim 1, further comprising a database coupled to the data gatherer and the analytics section, the database storing the swarm data over time.

10. The system according to claim 9, further comprising organizing the swarm data into organized master swarm data comprising historical data of swarm activity over a certain period of time and storing the master organized swarm data in said database.

11. A tangible, non-transitory, computer readable medium, comprising computer executable instructions for identifying high risk swarms involved in unauthorized distribution of a target asset, the computer executable instructions comprising instructions to:

retrieve swarm data, wherein the swarm data is involved in downloading of an alleged target asset;

set a high volume swarm detection threshold for the target asset at a static number if there is an inadequate amount of swarm data;

update the threshold;

flag alleged high risk swarms as those that exceed the threshold; and

verify that the alleged high risk swarms are the high risk swarms involved in the download of the target asset, by downloading the alleged target asset for comparison to the target asset.

12. The computer readable medium of claim 11, wherein the instructions to update the threshold comprises processing instructions based on predictive models or probabilistic models.

13. The computer readable medium of claim 11, further comprising instructions to store and organize the swarm data in a database.

14. The computer readable medium of claim 11, further comprising instructions for pre-processing the swarm data.

15. The computer readable medium of claim 11, further comprising instructions to collect the swarm data without any processing until a pre-defined swarm number is obtained or based upon a collection time period.

16. The computer readable medium of claim 11, further comprising instructions to analyze the high volume swarms for patterns and extract business intelligence based upon the patterns, wherein the business intelligence is useful for making business decisions based on the patterns.

17. The computer readable medium of claim 11, further comprising instructions to notify Internet Service Providers of one or more of the high volume swarms.