Apparatus and methods for data collection, analysis and service modification based on online activity

• US 10,116,676 B2
• Filed: 02/16/2016
• Issued: 10/30/2018
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Roosenraad, Chris, Harman, Richard, Watson, John W., Turner, Christopher, Arnhold, Phil, Durham, Brian, Stovall, Barbara
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/045,043
• Publication Number:
  US 20160241579A1
• Time in Patent Office: 987 Days
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Methods and apparatus for evaluating collected data relating to online activity, and modification of services within a service provider network. In one embodiment, a service provider collects data relating to the online activity of users of third-party services and correlates the data with subscribers of the service provider to generate useful products and analytics (e.g., classifications, behavioral models, etc.) containing information relating to the subscribers'"'"' online activity. The generated products may be used to determine whether and how to modify services provided to individual subscribers, exported for use by third parties, or for other purposes.

Claims

1. A method performed by a processing apparatus of an online service provider for modifying services based on collected data relating to online activity comprising:

collecting a plurality of data;

using a computerized process to create data structures corresponding to a plurality of activity records for a plurality of subscribers based at least in part on the plurality of data, the data structures corresponding to the plurality of activity records being representative of online activity of the plurality of subscribers;

applying a weighting factor to individual ones of the data structures corresponding to the plurality of activity records, the applying of the weighting factor comprising (i) applying a negative weighting factor to the individual ones of the data structures corresponding to the plurality of activity records that are categorized as a negative activity type, and (ii) applying a positive weighting factor to the individual ones of the data structures corresponding to the plurality of activity records that are categorized as a positive activity type;

compiling an aggregate score for an individual subscriber based at least in part on the weighted data structures corresponding to the plurality of activity records;

comparing the aggregate score of the individual subscriber to a pre-determined threshold value; and

modifying services provided to the individual subscriber based at least in part on a result of the comparison of the aggregate score to the pre-determined threshold value.

2. The method of claim 1, wherein the using of the computerized process to create the data structures corresponding to the plurality of activity records for the plurality of subscribers based at least in part on the plurality of data comprises:

algorithmically normalizing the plurality of data to extract information relating to online activity of the plurality of subscribers; and

correlating the extracted information with subscriber information to create the data structures corresponding to the plurality of activity records for the plurality of subscribers.

3. The method of claim 1, wherein the applying of the weighting factor to the individual ones of the data structures corresponding to the plurality of activity records comprises:

categorizing the data structures corresponding to the plurality of activity records based on activity type; and

based on the categorizing, applying the weighting factor to the individual ones of the data structures corresponding to the plurality of activity records.

4. The method of claim 1, wherein the compiling of the aggregate score for the individual subscriber based at least in part on the weighted data structures corresponding to the plurality of activity records comprises:

adding both positive and negative scores of individual ones of the data structures corresponding to the plurality of activity records associated with the individual subscriber.

5. The method of claim 1, wherein the compiling of the aggregate score for the individual subscriber based at least in part on the weighted data structures corresponding to the plurality of activity records comprises:

adding only negative scores of individual ones of the data structures corresponding to the plurality of activity records associated with the individual subscriber.

6. The method of claim 1, wherein the compiling of the aggregate score for the individual subscriber based at least in part on the weighted data structures corresponding to the plurality of activity records comprises:

adding only positive scores of individual ones of the data structures corresponding to the plurality of activity records associated with the individual subscriber.

7. The method of claim 1, wherein the comparing of the aggregate score of the individual subscriber to the pre-determined threshold value comprises:

comparing the aggregate score of the individual subscriber to a threshold value associated with a subscriber type corresponding to the individual subscriber.

8. The method of claim 1, wherein the comparing of the aggregate score of the individual subscriber to the pre-determined threshold value comprises:

comparing the aggregate score of the individual subscriber to a threshold value that is based on a number of devices associated with a profile of the individual subscriber.

9. The method of claim 1, wherein the modifying of the services provided to the individual subscriber based at least in part on the result of the comparison of the aggregate score to the pre-determined threshold value comprises:

performing a remediation of negative online activity in response to the result of the comparison indicating that the individual subscriber has exceeded a threshold limit of permissible negative online activity.

10. The method of claim 9, wherein the performing of the remediation comprises one or more of (i) adjusting bandwidth, (ii) disabling service, (iii) disabling one or more features, (iv) re-routing service, (v) requiring verification of identity, or (vi) providing an alert.

11. The method of claim 1, wherein the modifying of the services provided to the individual subscriber based at least in part on the result of the comparison of the aggregate score to the pre-determined threshold value comprises:

providing enhanced services in response to the result of the comparison indicating that the individual subscriber has exceeded a threshold level of positive online activity.

12. The method of claim 11, wherein the providing of the enhanced services comprises one or more of (i) adjusting bandwidth, (ii) enabling advanced services, (iii) relaxing security measures, and (iv) re-routing service.

13. A non-transitory computer-readable apparatus comprising a storage medium, the storage medium having at least one computer program comprising a plurality of instructions, the plurality of instructions being configured to, when executed on a computerized device, cause the computerized device to:

generate one or more computerized activity records for respective ones of one or more subscribers based at least in part on plurality of data related to the one or more subscribers, the one or more computerized activity records being representative of online activities of the one or more of subscribers;

based on the online activities of the one or more subscribers, apply respective weighting values to individual ones of the computerized activity records;

based on the weighted computerized activity records, update data representative of one or more profiles respectively associated with the one or more subscribers, and determine an aggregate score for a given subscriber of the one or more subscribers;

compare the aggregate score of the given subscriber to a predetermined value; and

based on the comparison of the aggregate score to the predetermined value, modify network services provided to the given subscriber;

wherein the application of the respective weighting value to the individual ones of the computerized activity records comprises;

application of a negative weighting value to the individual ones of the computerized activity records that are categorized as a negative activity type; and

application of a positive weighting value to the individual ones of the computerized activity records that are categorized as a positive activity type.

14. The non-transitory computer-readable apparatus of claim 13, wherein generation of the computerized activity records for the one or more subscribers based at least in part on plurality of data related to the one or more subscribers comprises:

normalization of the plurality of data to extract data representative of information relating to the online activities of the one or more subscribers; and

correlation of the extracted data with subscriber information obtained from a database of the network to generate the computerized activity records for the plurality of subscribers.

15. The non-transitory computer-readable apparatus of claim 13, wherein the application of the respective weighting values to the individual ones of the computerized activity records comprises:

categorization of the computerized activity records based on activity type; and

selection of a weighting value corresponding to the activity type.

16. The non-transitory computer-readable apparatus of claim 13, wherein the comparison of the aggregate score of the given subscriber to the predetermined value comprises:

comparison of the aggregate score of the given subscriber to a value that is based on a number of devices associated with a profile associated with the given subscriber.

17. The non-transitory computer-readable apparatus of claim 13, wherein the modification of the network services provided to the given subscriber comprises:

responsive to the aggregate score not being acceptable in relation to the predetermined value, implementation of a remediation procedure; and

responsive to the aggregate score being acceptable in relation to the predetermined value, provision of enhanced network services.

18. The non-transitory computer-readable apparatus of claim 17, wherein the remediation procedure comprises (i) adjusting a bandwidth, (ii) disabling the network service, (iii) disabling one or more features of the network service, (iv) re-routing the network service, (v) requiring verification of identity, or (vi) providing an alert.

19. A computerized apparatus for modifying services based on collected data relating to online activity over a network, the computerized apparatus being configured for access to a database also accessible by an operator of the network, the computerized apparatus comprising:

a processor apparatus; and

a non-transitory computer-readable apparatus comprising a storage medium, the storage medium having a computer program comprising a plurality of instructions, the plurality of instructions being configured to, when executed by the processor apparatus, cause the computerized apparatus to;

cause storage, on the database, of data relating to activities performed over the network via a client device associated with a subscriber of the network;

generate data representative of activity records based on the stored data relating to the activities;

apply a weighting value to the data representative of activity records to generate weighted activity records;

generate and cause storage of data representative of a composite score based on the weighted activity records;

based at least on a determination that the data representative of the composite score is acceptable in comparison to a threshold level determined by the operator of the network, allow the client device to continue the activities; and

based at least on a determination that the data representative of the composite score is not acceptable in comparison to a threshold level determined by the operator of the network;

attempt to confirm an identity of the subscriber;

responsive to a confirmation of the identity of the subscriber, cause adjustment of services provided to the subscriber to a first extent; and

responsive to a lack of confirmation of the identity of the subscriber, cause adjustment of the services provided to the subscriber to a second extent;

wherein the application of the weighting value to the data representative of activity records comprises;

application of a negative weighting value to the data representative of activity records that are categorized as a negative activity type by the operator of the network; and

application of a positive weighting value to the data representative of activity records that are categorized as a positive activity type by the operator of the network.

20. The computerized apparatus of claim 19, wherein:

the adjustment of services provided to the subscriber to the first extent comprises at least one of (i) adjustment of bandwidth available to the subscriber and (ii) disablement of one or more of the services provided to the subscriber; and

the plurality of instructions are further configured to, when executed by the processor apparatus, cause the computerized device to, responsive to the lack of confirmation of the identity of the subscriber, cause notification of the subscriber of illicit activity occurring on the client device associated with the subscriber.

21. The computerized apparatus of claim 19, wherein the plurality of instructions are further configured to, when executed by the processor apparatus, cause the computerized device to:

cause storage of the data representative of the composite score on the database; and

anonymize the stored data representative of the composite score.

22. The computerized apparatus of claim 19, wherein the plurality of instructions are further configured to, when executed by the processor apparatus, cause the computerized device to:

compare the data representative of the composite score to the threshold level when the subscriber requests to perform an activity over the network.

23. The computerized apparatus of claim 19, wherein the plurality of instructions are further configured to, when executed by the processor apparatus, cause the computerized device to:

based at least on the determination that the data representative of the composite score is acceptable in comparison to the threshold level, enable advanced features for the subscriber;

wherein the advanced features comprise one or more of (i) allotment of an additional amount of bandwidth to the subscriber based on a duration of the activities associated with the positive activity type, (ii) increase in an access speed associated with the services, and (iii) reduction of security measures associated with the activities.

24. The computerized apparatus of claim 19, wherein the generation of the data representative of activity records based on the stored data relating to the activities comprises:

normalization of the stored data to extract data representative of information relating to the activities performed over the network via the client device; and

correlation of the extracted data with subscriber information obtained from the database to generate the data representative of activity records.