Method for generating rules and parameters for assessing relevance of information derived from internet traffic

• US 8,818,927 B2
• Filed: 06/09/2011
• Issued: 08/26/2014
• Est. Priority Date: 06/09/2011
• Status: Expired due to Fees

• Current Assignee: Gfk Holding, Inc. (Nielsen Holdings plc)
• Original Assignee: Gfk Holding, Inc. (Nielsen Holdings plc)
• Inventors: Ruf, Thomas Walter, Fischer-Wuenschel, Bernhard, Wendlik, Renate
• Primary Examiner(s): Gaffin, Jeffrey A
• Assistant Examiner(s): Sugent, James F
• Application Number:
  US13/157,106
• Publication Number:
  US 20120317068A1
• Time in Patent Office: 1,174 Days
• Field of Search: 706/47, 709/224
• US Class Current: 706/47
• CPC Class Codes: G06F 3/04812 Interaction techniques based on cursor appearance or behaviour, e.g. being affected by the presence of displayed objects
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 43/028 by filtering

Abstract

A method is disclosed for generating a set of optimal rules and parameters for use by an evaluation engine on a volume of information extracted from a stream of IP packets associated with a web browsing session conducted over a network in order to filter user-initiated traffic flowing across the network from non-user-initiated traffic. Deep packet inspection is performed to extract the volume of information from the stream that conforms to at least one discrimination criteria. An initial iteration of application of the evaluation engine to the volume is performed by selecting initial discrimination criteria and rules for generating the filtered results and a distance between the filtered results and known actual user-initiated traffic is measured. Subsequent iterations of application of the evaluation engine to the volume are performed by changing the discrimination criteria and/or rules until there is no significant improvement in the measured distance.

Claims

1. A method comprising the steps of:

receiving a sample volume of information requests originating at a network access device for processing in accordance with a request/response protocol;

recording an indication of whether each information request of the sample volume was invoked by action of a network access device user or by a prior information request;

examining the response to each received information request of the sample volume to identify its file type;

storing an indication of the file type of the response to each received information request of the sample volume;

applying an evaluation engine using at least one initial criterion to thereby establish an initial boundary between those information requests invoked by an action of a network access device user and those information requests invoked by a prior information request;

classifying each information request of the sample volume as invoked by action of a network access device user or by a prior information request on the basis of whether or not the at least one criterion is satisfied;

measuring a distance between a number of information requests classified as being invoked by the user and an actual number of information requests invoked by the user;

measuring an overall ratio of information requests classified as being invoked by the user to an overall number of information requests before and after modifying the at least one initial criterion applied by the evaluation engine; and

repeating the classifying and modifying steps so as to progress toward a one-to-one correspondence between a number of information requests classified as invoked by the user and the actual number of information requests invoked by the user.

2. The method of claim 1 in which the information request is an hypertext transfer protocol (http) request.

3. The method of claim 1 in which the at least one criterion includes a requirement that the file type specified by a response to an information request have a text/html, xhtml, xml, or plain/text extension.

4. The method of claim 1 further including a step of recording a response code within the response to each information request of the sample volume.

5. The method of claim 4 in which the at least one criterion includes a requirement that a respective response code associated with a corresponding information request be 2xx to thereby indicate the corresponding information request was received, understood and accepted.

6. The method of claim 1 in which the at least one criterion includes a requirement that the file type specified by an information request not have a jpg, bmp, gif, or gs extension.

7. The method of claim 1 further including a step of tracking time differences between information requests or sequences of requests from a network access device user.

8. The method of claim 1 further including a step of tracking time differences between an information request and a response to an information request or a sequence of requests from a network access device user.

9. The method of claim 1 further including a step of tracking historical time differences between information requests having at least one shared characteristic in sequences of requests from at least one network access device user.

10. The method of claim 9 in which the at least one shared characteristic includes the Multipurpose Internet Mail Extensions (MIME) type or Uniform Resource Identifier (URI) path.

12. The one or more non-transitory computer-readable storage media of claim 1 in which the improvement comprises maximizing a number of objects in the filtered results which correspond to known true clicks and minimizing a number of objects in the filtered results which correspond to known false clicks.

11. One or more non-transitory computer-readable storage media containing instructions which, when executed by one or more processors disposed in an electronic device, perform a method for applying an evaluation engine, the method comprising the steps of:

generating a volume of test data associated with a web browsing session conducted at least in part over a communications network between a network access device and a remote server by applying one or more discrimination criteria to a stream of IP packets associated with the web browsing session;

ascertaining known true clicks and known false clicks associated with the volume of test data by observing the behavior of the network access device or a user of the network access device during the web browsing session;

using an evaluation engine that includes one or more deterministic rules or one or more evaluative rules that are applied to the volume of test data to generate a set of filtered results comprising modeled true clicks;

measuring a distance between the modeled true clicks from the evaluation engine and the known true clicks;

comparing the modeled true clicks in the set of filtered results to the known true clicks to evaluate performance of the evaluation engine;

modifying the evaluation engine by changing the discrimination criteria or the rules responsively to the comparing; and

repeating the modifying step so as to progress toward a one-to-one correspondence between the modeled true clicks and the known true clicks.

13. The one or more non-transitory computer-readable storage media of claim 11 in which the ascertaining is performed in a laboratory environment.

14. The one or more non-transitory computer-readable storage media of claim 11 in which the generating of the volume of test data utilizes a deep packet inspection (DPI) machine.

15. A computer-implemented method for applying an evaluation engine for distinguishing between true clicks and false clicks in a web browsing session between a network access device and a remote server, the method comprising the steps of:

configuring a network intelligence solution with access to a stream of Internet Protocol (IP) packets utilized in the web browsing session so that the network intelligence solution may tap at least a portion of the IP packets;

applying deep packet inspection to the tapped IP packets to extract selected information from the IP packets according to discrimination criteria, the discrimination criteria including at least one of technical data, page information, or timing-based information;

applying an evaluation engine incorporating rules arranged for filtering the extracted information to include modeled true clicks and exclude modeled false clicks, the rules being deterministic or implementing aggregative evaluation of each of the discrimination criteria;

comparing a result of application of the evaluation engine to the extracted information against known true clicks that a observed to occur during the web browsing session,

modifying the evaluation engine by changing the discrimination criteria or the rules responsively to the comparing; and

repeating the modifying step so as to progress toward a one-to-one correspondence between the modeled true clicks and the known true clicks.

16. The computer-implemented method of claim 15 in which the aggregative evaluation is additive or multiplicative.

17. The computer-implemented method of claim 15 in which the aggregative evaluation uses weighting of the discrimination criteria.

18. The computer-implemented method of claim 17 further including a step of optimizing the weighting using standard dummy regression.