Methods and apparatus to identify media distributed via a network

• US 9,516,001 B2
• Filed: 10/10/2014
• Issued: 12/06/2016
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: The Nielsen Company LLC (MOOD Media Corporation)
• Original Assignee: The Nielsen Company LLC (MOOD Media Corporation)
• Inventors: Borland, Robert P., Stringer, Anthony B., Schenker, Adam, Paranjape, Shailendra, Rubin, Jonathon Brett
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US14/512,143
• Publication Number:
  US 20160094567A1
• Time in Patent Office: 788 Days
• Field of Search: 713/154
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copyright
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

Methods, apparatus, systems and articles of manufacture to monitor media presentations are disclosed. An example method includes extracting first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page, storing, at the media device, the first network packet parameters in association with a uniform resource locator for the first encrypted web page, the uniform resource locator received from an extension in a web browser at the media device, extracting second network packet parameters from a second network packet received at the media device from an unknown encrypted web page, when the extension is inoperative, comparing the second network packet parameters to the first network packet parameters, and identifying the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet to the first network packet parameters has a similarity above a threshold.

Claims

1. A method for monitoring a media device, the method comprising:

extracting, by executing an instruction via a processor, first network packet parameters from a first network packet received at a media device when retrieving a first encrypted web page;

storing, at the media device, the first network packet parameters in association with a uniform resource locator for the first encrypted web page, the uniform resource locator received from an extension in a web browser at the media device;

extracting, by executing an instruction via the processor, second network packet parameters from a second network packet received at the media device from an unknown encrypted web page;

when the extension is inoperative, comparing, by executing an instruction via the processor, the second network packet parameters to the first network packet parameters; and

identifying, by executing an instruction via the processor, the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.

2. The method as defined in claim 1, further including detecting that the extension is inoperative, wherein the comparing and the identifying is performed in response to detecting that the extension is inoperative.

3. The method as defined in claim 1, wherein the extension is inoperative when the extension is not executing.

4. The method as defined in claim 1, wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.

5. The method as defined in claim 1, wherein the storing is performed in response to determining that the extension is operative.

6. The method as defined in claim 1, wherein the extension becomes inoperative as a result of an update to the web browser.

7. The method as defined in claim 1, wherein comparing the second network packet parameters to the first network packet parameters includes:

determining a set of similarities for the parameters in the second network packet parameters; and

determining the similarity as an average of the set of similarities.

8. The method as defined in claim 1, wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.

9. The method as defined in claim 1, further including storing an identification of the uniform resource locator in a data store in response to the identifying.

10. The method as defined in claim 1, further including transmitting an identification of the uniform resource locator to a central facility.

11. The method as defined in claim 1, wherein the similarity is a Jaccard similarity coefficient.

12. The method as defined in claim 1, wherein comparing the second network packet parameters to the first network packet parameters further includes comparing the second network packet parameters to a plurality of records.

13. The method as defined in claim 1, wherein the first network packet parameters are stored in a record including network packet parameters from a plurality of network packets.

14. The method as defined in claim 1, wherein the second network packet is encrypted, the second network packet parameters are extracted while the extension is inoperative, and the second network packet parameters are extractable without decrypting the second network packet.

15. An apparatus:

a parameter extractor to extract first network packet parameters from a first network packet received at a media device in connection with accessing a first encrypted web page, to store the first network packet parameters in association with a uniform resource locator for the first encrypted web page, the uniform resource locator received from an extension in a web browser at the media device, and to extract second network packet parameters from a second network packet received at the media device from an unknown encrypted web page; and

an identifier to, when the extension is inoperative, compare the second network packet parameters to the first network packet parameters and identify the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packet parameters has a similarity above a threshold.

16. The apparatus as defined in claim 15, further including a browser extension data receiver to detect that the extension is inoperative.

17. The apparatus as defined in claim 15, wherein the extension is inoperative when the extension is not executing.

18. The apparatus as defined in claim 15, wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.

19. The apparatus as defined in claim 15, wherein the parameter extractor is to store the parameters in response to determining that the extension is operative.

20. The apparatus as defined in claim 15, extension becomes inoperative as a result of an update to the web browser.

21. The apparatus as defined in claim 15, wherein the identifier is to compare the second network packet parameters to the first network packet parameters by:

determining a set of similarities for the parameters in the second network packet parameters; and

determining the similarity as an average of the set of similarities.

22. The apparatus as defined in claim 15, wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.

23. The apparatus as defined in claim 15, wherein the identifier is further to store an identification of the uniform resource locator in a data store in response to the identifying.

24. The apparatus as defined in claim 15, further including a data store interface to transmit an identification of the uniform resource locator to a central facility.

25. The apparatus as defined in claim 15, wherein the similarity is a Jaccard similarity coefficient.

26. The apparatus as defined in claim 15, wherein the identifier is used to compare the second network packet parameters to the first network packet parameters by comparing the second network parameters in a plurality of records.

27. The apparatus as defined in claim 15, wherein the first network packet parameters are stored in a record including network packet parameters from a plurality of network packets.

28. The apparatus defined in claim 15, wherein the second network packet is encrypted, the second network packet parameters are extracted while the extension is inoperative, and the second network packet parameters are extractable without decrypting the second network packet.

29. A tangible computer readable storage medium comprising instructions that, when executed, cause a media device to at least:

extract first network packet parameters from a first network packet when retrieving a first encrypted web page;

store the first network packet parameters in association with a uniform resource locator for the first encrypted web page, the uniform resource locator received from an extension in a web browser at the media device;

extract second network packet parameters from a second network packet received at the media device from an unknown encrypted web page;

when the extension is inoperative, compare the second network packet parameters to the first network packet parameters; and

identify the unknown encrypted web page as the first encrypted web page when the comparison of the second network packet parameters to the first network packets parameters has a similarity above a threshold.

30. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to detect that the extension is inoperative.

31. The tangible computer readable storage medium as defined in claim 29, wherein the extension is inoperative when the extension is not executing.

32. The tangible computer readable storage medium as defined in claim 29, wherein the extension is inoperative when the extension is unable to determine identifying information associated with the unknown encrypted web page.

33. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to store the parameters in response to determining that the extension is operative.

34. The tangible computer readable storage medium as defined in claim 29, wherein the extension becomes inoperative as a result of an update to the web browser.

35. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to compare the second network parameters to the first network packet parameters by:

determining a set of similarities for the parameters in the second network packet parameters; and

determining the similarity as an average of the set of similarities.

36. The tangible computer readable storage medium as defined in claim 29, wherein the network packet parameters include at least one of a duration, a source hostname, a destination hostname, and a size.

37. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to store an identification of the uniform resource locator in a data store in response to the identifying.

38. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to transmit an identification of the uniform resource locator to a central facility.

39. The tangible computer readable storage medium as defined in claim 29, wherein the similarity is a Jaccard similarity coefficient.

40. The tangible computer readable storage medium as defined in claim 29, wherein the instructions, when executed, cause the media device to compare the second network packet parameters to the first network packet parameters by comparing the second network packet parameters to a plurality of records.

41. The tangible computer readable storage medium as defined in claim 29, wherein the first network packet parameters are stored in a record including network packet parameters from a plurality of network packets.

42. The tangible computer readable storage medium as defined in claim 29, wherein the second network packet is encrypted, the second network packet parameters are extracted while the extension is inoperative, and the second network packet parameters are extractable without decrypting the second network packet.