Methods and apparatus for detecting and filtering forced traffic data from network data

• US 9,118,563 B2
• Filed: 05/30/2013
• Issued: 08/25/2015
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Dstillery, Inc.
• Original Assignee: Dstillery, Inc.
• Inventors: Stitelman, Ori M., Hook, Rodney, Mei, Tommy Yiwel
• Primary Examiner(s): Christensen, Scott B
• Application Number:
  US13/906,016
• Publication Number:
  US 20140068061A1
• Time in Patent Office: 817 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 47/10 Flow control; Congestion control

Abstract

A non-transitory processor-readable medium is provided that stores code representing instructions to be executed by a processor to filter data associated with an entity for a first predefined time period in response to an access by the entity at a first time to a preselected network location from a plurality of preselected network locations. The plurality of preselected network locations are associated with forced web traffic patterns. The processor is also caused to filter data associated with the entity for a second predefined time period in response to an access by the entity at a second time to a preselected network location from the plurality of preselected network locations during the first predefined time period. The second time is after the first time.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive an indication of an entity accessing a first network location at a first time, the first network location being preselected as associated with forced web traffic patterns;

filter data associated with the entity for a first predefined time period in response to receiving the indication of the entity accessing the first network location;

receiving an indication of the entity accessing a second network location at a second time before an end of the first predefined time period, the second network location being preselected as associated with forced web traffic patterns; and

filter data associated with the entity for a second predefined time period in response to receiving the indication of the entity accessing the second network location, an end of the second predefined time period being after the end of the first predefined time period.

2. The non-transitory processor-readable medium of claim 1, the code to cause the processor to filter data associated with the entity for the second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to any of a plurality of network locations, the plurality of network locations being preselected as associated with forced web traffic patterns and including the first network location and the second network location.

3. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to:

receive indication of a new forced web traffic pattern; and

modify the filtering of data associated with the entity for the first predefined time period in response to receiving the new forced web traffic pattern.

4. The non-transitory processor-readable medium of claim 1, wherein the entity is associated with at least one of a spyware or a virus.

5. The non-transitory processor-readable medium of claim 1, wherein at least one of (1) the forced web traffic pattern associated with the first network location, (2) the forced web traffic pattern associated with the second network location, or (3) the new forced web traffic pattern, includes a temporary period of forced web traffic, the code further comprising code to cause the processor to:

modify the filtering of data associated with the entity for the first predefined time period to filter data associated with the entity during the temporary period of forced web traffic.

6. The non-transitory processor-readable medium of claim 1, wherein the data associated with the entity includes bid requests received in an online real-time bidding auction.

7. The non-transitory processor-readable medium of claim 1, wherein:

the code to cause the processor to filter data associated with the entity for the first predefined time period includes data from the first network location and data from a third network location not being preselected as being associated with forced web traffic patterns.

8. The non-transitory processor-readable medium of claim 1, wherein:

a plurality of network locations are preselected as being associated with forced web traffic patterns, the plurality of network locations including the first network location and the second network location,

the code to cause the processor to filter data associated with the entity for the first predefined time period includes data from the first network location and data from a third network location not included within the plurality of network locations preselected as being associated with forced web traffic patterns,

the data from the third network location being produced in response to the entity accessing the third network location.

9. The non-transitory processor-readable medium of claim 1, wherein:

the code to cause the processor to filter data associated with the entity for a first predefined time period includes code to cause the processor to;

receive data associated with the entity during the first predefined time period; and

delete a first datum associated with forced web traffic; and

the code to cause the processor to filter data associated with the entity for a second predefined time period includes code to cause the processor to;

receive data associated with the entity during the second predefined time period; and

delete a second datum associated with forced web traffic.

10. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a first datum associated with an access by an entity to a first network location being preselected as associated with forced web traffic patterns;

send a first signal to filter data associated with the entity for a first predefined time period based, at least in part, on the first datum;

receive a second datum associated with an access by the entity to a website location during the first predefined time period, the website location being preselected as associated with forced web traffic patterns;

and

send a second signal to filter data associated with the entity for a second predefined time period based, at least in part, on the second datum, an end time of the second predefined time period being after an end time of the first predefined time period.

11. The non-transitory processor-readable medium of claim 10, wherein a length of the first predefined time period equals a length of the second predefined time period.

12. The non-transitory processor-readable medium of claim 10, wherein the entity is associated with at least one of a spyware or a virus.

13. The non-transitory processor-readable medium of claim 10, the code to cause the processor to send the second signal to filter data associated with the entity for the second predefined time period includes code to cause the processor to:

send a signal to stop a counter of a number of accesses by the entity to any of a plurality of network locations, the plurality of network locations being preselected as being associated with forced web traffic and including the first network location and the website location.

14. The non-transitory processor-readable medium of claim 10, the code further comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity after the end time of the second predetermined time period in response to not receiving a datum associated with an access by the entity to any of a plurality of network locations, the plurality of network locations being preselected as associated with forced web traffic and including the first network location and the website location; and

send a signal to start a counter of number of accesses by the entity to any of the plurality of network locations.

15. The non-transitory processor-readable medium of claim 10, wherein the data associated with the entity includes bid requests received in an online real-time bidding auction.

16. The non-transitory processor-readable medium of claim 10, wherein:

the first signal is a signal to remove a third datum from data associated with the entity, the third datum associated with forced web traffic; and

the second signal is a signal to remove a fourth datum associated with forced web traffic from data associated with the entity, the fourth datum associated with forced web traffic.

17. The non-transitory processor-readable medium of claim 10, further comprising code to cause the processor to:

send a signal to stop filtering data associated with the entity after the end time of the second predetermined time period in response to not receiving a datum associated with an access by the entity to any of a plurality of network locations preselected as being associated with forced web traffic patterns, the plurality of network locations including the first network location and the second network location.

18. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive data associated with an access by an entity to a network location from a plurality of network locations during a first predefined time period, the plurality of network locations being preselected as being associated with forced web traffic patterns;

define a model of behavior for the entity based, at least in part, on the data;

send a signal to filter data associated with the entity for a second predefined time period based, at least in part, on the model of behavior of the entity and when the model of behavior indicates that the entity accessed at least one network location from the plurality of network locations during the first predefined time period, an end time of the second predefined time period being after an end time of the first predefined time period; and

send a signal to stop filtering data associated with the entity based, at least in part, on the model of behavior of the entity and when the model of behaviors indicates that the entity did not access at least one network location from the plurality of network locations during the second predefined time period.

19. The non-transitory processor-readable medium of claim 18, wherein the code to send the signal to filter includes code to send the signal filter based on simultaneous multiple access to a network location from the plurality of network locations by a plurality of entities.

20. The non-transitory processor-readable medium of claim 18, wherein the network location is a first network location, the code further comprising code to cause the processor to:

receive data associated with an access to a second network location by the entity, during the first predefined time period, the second network location not included within the plurality of network locations preselected as being associated with forced web traffic patterns; and

define the model of behavior for the entity based, at least in part, on the data associated with the access to the second network location by the entity.

21. The non-transitory processor-readable medium of claim 18, the code further comprising code to cause the processor to:

define a forced web traffic pattern based, at least in part, on the model of behavior of the entity, the code to cause the processor to send the signal to filter being code to cause the processor to filter based on the forced web traffic pattern.

22. The non-transitory processor-readable medium of claim 21, wherein:

the entity is a first entity,

the code to cause the processor to send the signal to filter is code to cause the processor to filter based on a plurality of forced web traffic patterns that includes the forced web traffic pattern,

the plurality of forced web traffic patterns are based, at least in part, on a plurality of models of behavior of a plurality of entities, each model of behavior being associated with an entity from the plurality of entities, the plurality of entities including the first entity, the plurality of models of behavior including the model of behavior for the first entity.

23. The non-transitory processor-readable medium of claim 18, wherein the signal to filter data associated with the entity for the second predefined time period is a signal to delete a datum associated with forced web traffic from data associated with the entity.