METHODS AND APPARATUS FOR DETECTING AND FILTERING FORCED TRAFFIC DATA FROM NETWORK DATA

• US 20140068061A1
• Filed: 05/30/2013
• Published: 03/06/2014
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Dstillery, Inc.
• Original Assignee: Media6degrees
• Inventors: Hook, Rodney, Stitelman, Ori M., Mei, Tommy Yiwel
• Granted Patent: US 9,118,563 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 47/10 Flow control; Congestion control

Abstract

A non-transitory processor-readable medium is provided that stores code representing instructions to be executed by a processor to filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations. The plurality of preselected network locations are associated with forced web traffic patterns. The processor is also caused to filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period. The second time is after the first time.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns;

if the entity accesses at a second time a preselected network location from the plurality of preselected network locations before an end of the first predefined time period, then filter data associated with the entity for a second predefined time period, an end of the second predefined time period being after the end of the first predefined time period; and

if the entity does not access at the second time the preselected network location from the plurality of presented networks locations before the end of the first predefined time period, then discontinue filtering data associated with the entity at the end of the first predefined time period.

2. The non-transitory processor-readable medium of claim 1, the code to filter data associated with the entity for a second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

3. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

modify filtering of data associated with the entity in response to receiving a new forced web traffic pattern.

4. The non-transitory processor-readable medium of claim 1, wherein the entity is associated with at least one of a spyware or a virus.

5. The non-transitory processor-readable medium of claim 3, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to modify filtering includes code to cause the processor to filter data associated with the entity during the at least one temporary period of forced web traffic.

6. The non-transitory processor-readable medium of claim 1, wherein the data associated with the entity include bid requests received in an online real-time bidding auction.

21. The non-transitory processor-readable medium of claim 1, wherein:

the code to filter data associated with the entity for the first predefined time period includes data from the preselected network location and data from a network location not included in the plurality of preselected network locations.

22. The non-transitory processor-readable medium of claim 1, wherein:

the code to filter data associated with the entity for the first predefined time period includes data from the preselected network location and data from a network location not included in the plurality of preselected network locations,

the data from the network location not included in the plurality of preselected network locations being produced in response to the entity accessing the network location not included in the plurality of preselected network locations.

7. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a first data associated with an access by an entity to a preselected network location from a plurality of preselected network locations, the plurality of preselected network locations being associated with forced web traffic patterns;

send a first signal to filter data associated with the entity for a first predefined time period based, at least in part, on the first data;

receive a second data associated with an access by the entity to a website location during the first predefined time period;

send a signal to stop filtering data associated with the entity, if the second data indicates no access to a preselected network location from the plurality of preselected network locations during the first predefined time period; and

send a signal to filter data associated with the entity for a second predefined time period if the second data indicates at least one access to a preselected network location from the plurality of preselected network locations during the first predefined time period, an end time of the second predefined time period being after an end time of the first predefined time period.

10. The non-transitory processor-readable medium of claim 7, wherein the entity is associated with at least one of a spyware or a virus.

11. The non-transitory processor-readable medium of claim 7, the code to send the signal to filter data associated with the entity for the second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

12. The non-transitory processor-readable medium of claim 7, the code to send the signal to stop filtering includes code to cause the processor to:

send a signal to start a counter of number of accesses by the entity to a preselected network location from the plurality of preselected network locations.

13. The non-transitory processor-readable medium of claim 7, wherein the data associated with the entity include bid requests received in an online real-time bidding auction.

14. The non-transitory processor-readable medium of claim 7, wherein the forced web traffic patterns include at least one temporary period of forced web traffic, the code to send the second signal to modify filtering includes code to cause the processor to filter data associated with the entity during the at least one temporary period of forced web traffic.

8. (canceled)

9. The non-transitory processor-readable medium of claim 8, wherein a length of the first predefined time period equals a length of the second predefined time period.

15. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

for each preselected network location from a plurality of preselected network locations, receive data associated with an access to that preselected network location by an entity, during a first predefined time period;

define a model of behavior for the entity based, at least in part, on the data;

send a signal to filter data associated with the entity for a second predefined time period based, at least in part, on the model of behavior of the entity and when the model of behavior indicates that the entity accessed at least one preselected network location from the plurality of preselected network locations during the first predefined time period, an end time of the second predefined time period being after an end time of the first predefined time period; and

send a signal to stop filtering data associated with the entity based, at least in part, on the model of behavior of the entity and when the model of behaviors indicates that the entity did not access at least one preselected network location from the plurality of preselected network locations during the first predefined time period.

17. The non-transitory processor-readable medium of claim 15, wherein the code to send the signal to filter includes code to send the signal filter based on simultaneous multiple access to a preselected network location from the plurality of preselected network locations by a plurality of entities.

18. The non-transitory processor-readable medium of claim 15, the code further comprising code to cause the processor to:

receive data associated with an access to a non-preselected network location by the entity, during the first predefined time period; and

define the model of behavior for the entity based, at least in part, on the data associated with the access to the non-preselected network location by the entity.

19. The non-transitory processor-readable medium of claim 15, the code further comprising code to cause the processor to:

define a forced web traffic pattern based, at least in part, on the model of behavior of the entity, the code to send the signal to filter being based on the forced web traffic pattern.

20. The non-transitory processor-readable medium of claim 19, wherein:

the entity is a first entity,

the code to send the signal to filter is based on a plurality of forced web traffic patterns that includes the forced web traffic pattern,

the plurality of forced web traffic patterns are based, at least in part, on a plurality of models of behavior of a plurality of entities, each model of behavior being associated with an entity from the plurality of entities, the plurality of entities including the first entity, the plurality of models of behavior including the model of behavior for the first entity.

16. (canceled)