System and method of using spatial and temporal signals to identify and prevent attacks

• US 9,936,339 B1
• Filed: 06/13/2013
• Issued: 04/03/2018
• Est. Priority Date: 08/07/2009
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Liang, Sam, Chu, Michael, Luo, Yuhua, Ji, Zhengrong, Yu, Yan
• Primary Examiner(s): Dollinger, Tonia L. M.
• Assistant Examiner(s): Belani, Kishin G
• Application Number:
  US13/916,838
• Time in Patent Office: 1,755 Days
• Field of Search: 709235
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

Systems and methods according to aspects of the invention verify requests for information over a network. Computing devices communicating over a network transmit numerous signals with various types of information including spatial information, temporal information, device-specific information, and transmission specific information. This information may be used to generate statistical records of valid request for information. Various combinations of these signals may be used to determine whether a request for information is a valid request based on the statistical records associated with the signals. Where a request for information has been verified, the system and method may provide the information. Where the request for information has not been verified, the system and method may deny the request for information. Thus the system and method may be used to prevent and block scraping and spamming attacks.

Claims

1. A method of determining the validity of a request for information over a network, the method comprising:

storing, by one or more processors, a plurality of statistical records of requests each associated with a geographic area and including information identifying a temporal pattern of requests for the geographic area aggregated over a plurality of different client devices;

receiving, by the one or more processors, from a network device, a new request for information, the new request including a time attribute indicating a time of the new request and a geographic location of the network device at the time of the new request;

in response to the receiving, selecting, by the one or more processors, a statistical record of requests from the plurality of statistical records of requests associated with a geographic area corresponding to the geographic location of the new request; and

determining, by the one or more processors, whether the new request for information is a valid request by comparing the time attribute to the temporal pattern of requests for the selected statistical record of requests.

2. The method of claim 1, wherein the selected statistical record of requests includes queries per second.

3. The method of claim 1, wherein the selected statistical record of requests includes queries per second identifying unique keys, where a unique key indicates that a request for information is newly requested.

4. The method of claim 1, wherein the selected statistical record of requests includes a time distribution of requests from a particular geographic area.

5. The method of claim 1, wherein the selected statistical record of requests includes failure rates for requests for information.

6. The method of claim 1, wherein the time attributes includes a time of day and a day of the week.

7. A system of determining the validity of a request for information over a network, the system comprising:

one or more computing devices having one or more processors configured to;

store a plurality of statistical records of requests each associated with a geographic area and including information identifying a temporal pattern of requests for the geographic area aggregated over a plurality of different client devices;

receive from a network device, a new request for information, the new request including a time attribute indicating a time of the new request and a geographic location of the network device at the time of the new request;

in response to the receiving, select a statistical record of requests from the plurality of statistical records of requests associated with a geographic area corresponding to the geographic location of the new request; and

determine whether the new request for information is a valid request by comparing the time attribute to the temporal pattern of requests for the selected statistical record of requests.

8. The system of claim 7, wherein the selected statistical record of requests includes queries per second.

9. The system of claim 7, wherein the selected statistical record of requests includes queries per second identifying unique keys, where a unique key indicates that a request for information is newly requested.

10. The system of claim 7, wherein the selected statistical record of requests includes a time distribution of requests from a particular geographic area.

11. The system of claim 7, wherein the selected statistical record of requests includes failure rates for requests for information.

12. The system of claim 7, wherein the time attributes includes a time of day and a day of the week.

13. A non-transitory computer readable medium on which instructions are stored, the instructions, when executed by one or more processors, cause the one or more processors to perform a method of determining the validity of a request for information over a network, the method comprising:

storing a plurality of statistical records of requests each associated with a geographic area and including information identifying a temporal pattern of requests for the geographic area aggregated over a plurality of different client devices;

receiving from a network device, a new request for information, the new request including a time attribute indicating a time of the new request and a geographic location of the network device at the time of the new request;

in response to the receiving, selecting a statistical record of requests from the plurality of statistical records of requests associated with a geographic area corresponding to the geographic location of the new request; and

determining whether the new request for information is a valid request by comparing the time attribute to the temporal pattern of requests for the selected statistical record of requests.

14. The medium of claim 13, wherein the selected statistical record of requests includes queries per second.

15. The medium of claim 13, wherein the selected statistical record of requests includes queries per second identifying unique keys, where a unique key indicates that a request for information is newly requested.

16. The medium of claim 13, wherein the selected statistical record of requests includes a time distribution of requests from a particular geographic area.

17. The medium of claim 13, wherein the selected statistical record of requests includes failure rates for requests for information.

18. The medium of claim 13, wherein the time attributes includes a time of day and a day of the week.