System and method to determine the validity of an interaction on a network

• US 7,447,691 B2
• Filed: 05/11/2005
• Issued: 11/04/2008
• Est. Priority Date: 02/14/2000
• Status: Expired due to Term

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Overture Services Incorporated (Apollo Global Management, Inc.)
• Inventors: Doliov, Stephan
• Primary Examiner(s): Pardo; Thuy N
• Application Number:
  US11/127,024
• Publication Number:
  US 20060004594A1
• Time in Patent Office: 1,273 Days
• Field of Search: 707/2, 707/6, 707/7, 707/101, 707/102, 707/103.X, 707/104.1, 707/9, 707/10, 709/223, 709/224, 705/37, 705/2, 705/4, 703/6, 455/410
• US Class Current: 1/1
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0242 Determining effectiveness of advertisements
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99942 : Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 : Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99944 : Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 : Object-oriented database structure processing

Abstract

The methods and systems of the invention utilize limited data to yield information about the validity of any given interaction with a website. Once validity information is available, an operator can determine whether or not to continue offering interactions to a given user. The determination could also relate to whether to report website interaction statistics based on undesired interactions, how to handle billing or payment for such undesired interactions, and what type of content to send to users who are interacting with the website in an undesirable manner.

Claims

1. A computer-implemented method of identifying a possible illegitimate interaction of a presumed user on a network, the method comprising:

generating by the user an interaction on network;

collecting data from the interaction, the data including aggregate measure data and unique feature data;

applying a predictive model to the aggregate measure data and the unique feature data to result in a risk value of a click interaction on the Internet, wherein the predictive model is built based on previously collected data, the previously collected data being collected from previous interactions and including previous aggregate measure data and previous unique feature data from the previous interactions;

determining a validity of the interaction based on the risk value;

saving the risk value in a database; and

charging an advertiser in accordance with the generated interaction on the network and based on the determined validity of the interaction.

2. The method according to claim 1 wherein the predictive model is based on at least one approach selected from the group comprising:

a probabilistic approach; and

a stochastic approach.

3. The method according to claim 1 wherein the step of collecting data includes collecting data on a number of clicks per network address in a given time period.

4. The method according to claim 1 wherein the step of collecting data includes collecting data relating to a number of unique queries per user session.

5. The method according to claim 1 wherein the step of collecting data includes collecting data on a number of network clicks for a given time period.

6. The method according to claim 1 wherein the step of collecting data includes collecting data on a number of distinct referral partners who could access the network.

7. The method according to claim 1 wherein the step of collecting data includes at least one step selected from the group comprising:

collecting data on an origin of the presumed user;

collecting data on a time of the interactions;

collecting data on a type of the interactions; and

collecting data on presumed measures of uniqueness of the presumed user.

8. The method according to claim 1 wherein the interaction comprises following a link to a website of the advertiser.

9. A computer-implemented method of rating a user interaction on a network, the method comprising:

generating by the user an interaction on network;

collecting data from the interaction, the data including aggregate measure data and unique feature data;

applying a predictive model to the aggregate measure data and the unique feature data to result in a risk value for a click interaction on the Internet, wherein the predictive model is built based on previously collected data, the previously collected data being collected from previous interactions and including previous aggregate measure data and previous unique feature data from the previous interactions;

rating the interaction based on the risk value;

saving the risk value in a database; and

charging an advertiser in accordance with the generated interaction on the network and based on the rating of the interaction.

10. The method according to claim 9 wherein the predictive model is based on at least one approach selected from the group comprising:

a probabilistic approach; and

a stochastic approach.

11. The method according to claim 9 wherein the step of collecting data includes collecting data on a number of clicks per network address in a given time period.

12. The method according to claim 9 wherein the step of collecting data includes collecting data relating to a number of unique queries per user session.

13. The method according to claim 9 wherein the step of collecting data includes collecting data on a number of network clicks for a given time period.

14. The method according to claim 9 wherein the step of collecting data includes collecting data on a number of distinct referral partners who could access the network.

15. The method according to claim 9 wherein the step of collecting data includes at least one step selected from the group comprising:

collecting data on an origin of the presumed user;

collecting data on a time of the interactions;

collecting data on a type of the interactions; and

collecting data on presumed measures of uniqueness of the presumed user.

16. The method according to claim 9 wherein the interaction comprises following a link to a website of the advertiser.

17. A system for detecting a possibly fraudulent interaction in a pay-for-placement search engine, the system comprising:

at least one interaction with the pay-for-placement search engine being generated by a user;

a first processor for collecting aggregate measure data and unique feature data about the interaction; and

a second processor for applying a predictive model to the aggregate measure data and unique feature data to result in a risk value for a click interaction on the Internet, wherein the predictive model is built based on previously collected data, the previously collected data being collected from previous interactions and including previous aggregate measure data and previous unique feature data from the previous interactions, wherein the a legitimacy of the interaction is determined based on the risk value, and wherein an advertiser is charged in accordance with the at least one interaction with the search engine and based on the risk value for the interaction.

18. The system according to claim 17 wherein the predictive model is based on at least one approach selected from the group comprising:

a probabilistic approach; and

a stochastic approach.

19. The system according to claim 17 wherein the first processor collects data on a number of clicks per network address in a given time period.

20. The system according to claim 17 wherein the first processor collects data relating to a number of unique queries per user session.

21. The system according to claim 17 wherein the first processor collects data on a number of network clicks for a given time period.

22. The system according to claim 17 wherein the first processor collects data on a number of distinct referral partners who could access the network.

23. The system according to claim 17 wherein the first processor collects data by performing at least one step selected from the group comprising:

collecting data on an origin of the presumed user;

collecting data on a time of the interactions;

collecting data on a type of the interactions; and

collecting data on presumed measures of uniqueness of the presumed user.

24. The system according to claim 17 wherein the interaction comprises a user following a link to a website of the advertiser.