WO2008076234A1 - A network interaction monitoring appliance - Google Patents

A network interaction monitoring appliance Download PDF

Info

Publication number
WO2008076234A1
WO2008076234A1 PCT/US2007/025133 US2007025133W WO2008076234A1 WO 2008076234 A1 WO2008076234 A1 WO 2008076234A1 US 2007025133 W US2007025133 W US 2007025133W WO 2008076234 A1 WO2008076234 A1 WO 2008076234A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
interaction
appliance
network interaction
traffic
Prior art date
Application number
PCT/US2007/025133
Other languages
French (fr)
Inventor
Jim Pitkow
Raman Chelliah
Marc Brown
Original Assignee
Fraudwall Technologies, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US11/640,125 external-priority patent/US10402832B2/en
Priority claimed from US11/640,441 external-priority patent/US7685275B2/en
Priority claimed from US11/986,311 external-priority patent/US8990379B2/en
Application filed by Fraudwall Technologies, Inc. filed Critical Fraudwall Technologies, Inc.
Publication of WO2008076234A1 publication Critical patent/WO2008076234A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/02—Marketing; Price estimation or determination; Fundraising
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466—Performance evaluation by tracing or monitoring
    • G06F11/3495—Performance evaluation by tracing or monitoring for systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/144—Detection or countermeasures against botnets

Definitions

  • Figure l is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
  • Figure 2 is a block diagram illustrating software of an edge appliance in one embodiment.
  • Figure 3 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • Figure 4 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • Figure 5 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • Figure 6 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • Figure 7 is a flow diagram illustrating a process for analyzing network interactions.
  • Figure 8 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • Figure 9 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • Figure 10 is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
  • Figure 11 is a flow diagram illustrating an embodiment of a process for network interaction.
  • Figure 12 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • the invention can be implemented in numerous ways, including as a process, an apparatus, a system, a composition of matter, a computer readable medium such as a computer readable storage medium or a computer network wherein program instructions are sent over optical or communication links.
  • these implementations, or any other form that the invention may take, may be referred to as techniques.
  • a component such as a processor or a memory described as being configured to perform a task includes both a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task.
  • the order of the steps of disclosed processes may be altered within the scope of the invention.
  • An appliance is used for analyzing a network interaction.
  • the appliance includes an input to monitor network traffic without interfering with the network traffic.
  • the network traffic includes a network interaction.
  • the appliance includes a processor which analyzes the network traffic to derive information about the network interaction.
  • the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user. If the interaction is qualified, then the network interaction is legitimate and should qualify for a payment. For example, upon receiving a legitimate click, an advertiser should pay for the click and the publisher should be paid for the click.
  • an appliance passively monitors network interactions for a web server.
  • the server can be an advertising network's server, a publisher's server, an advertiser's server, an internet service provider's server, or any other appropriate server where network interactions can be monitored.
  • the appliance derives its assessment information by monitoring the transmission control protocol (TCP) and/or internet protocol (IP) layer information of network interactions. For example, some of the information detected in real-time by the appliance hardware is information from Open Systems Interconnection (OSI) layers 3 through 7 that is associated with the network interaction.
  • OSI Open Systems Interconnection
  • the appliance can ascertain that a network interaction has a common source or common routing information with other network interactions. If many network interactions aggregate at a point in the network (e.g., if the network interactions originate at a common source internet protocol address or are routed through a common network device such as a router that makes packets anonymous), it becomes a strong possibility that the network interactions are not legitimate.
  • the network interaction monitoring is performed by a system that is associated with a third party entity that is not aligned with the advertising network, the publisher, or the advertiser.
  • a network interaction at an advertising network and a network interaction at a publisher are correlated to provide an assessment as to the legitimacy or fraudulence of the network interaction (e.g., a click).
  • FIG. 1 is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
  • computer 100 is used by a user for accessing a web page on server 106.
  • server 106 is associated with an advertising network or an advertiser.
  • Computer 100 is able to communicate with network 102.
  • network 102 comprises one or more of the following: the Internet, a local area network, a wide area network, a wired network, a wireless network, or any other appropriate network.
  • Server 106 can be accessed from network 102 via firewall 104 and local area network (LAN) 105.
  • Edge appliance 108 is able to monitor traffic to and from server 106 and is connected to LAN 105.
  • monitoring comprises detecting in hardware the network traffic or the network interactions to be monitored, detecting in real-time network traffic, capturing data in real-time, analyzing data in real-time, triggering real-time queries or forensics of IP addresses/network topology/routing tables/preferred paths, detecting layer 3 through layer 7 data from the monitored traffic, monitoring Ethernet traffic, or any other appropriate monitoring of network traffic.
  • Edge appliance 108 is able to store information on storage device 110.
  • edge appliance 108 monitors traffic to and from server 106 by being between server 106 and LAN 105 by receiving and forwarding all traffic between network 102 and server 106. In this situation, all traffic is received and forwarded without substantially affecting network traffic, without substantially affecting a transaction involving the network traffic, and/or with less than 2 milliseconds of delay for the process of receiving and forwarding.
  • edge appliances can also be used to monitor traffic at other points in the network other than in front of or just beside a server - for example, on a trunk line, an internet service provider network, an advertising network, or any other appropriate traffic site.
  • Edge appliance 108 is able to communicate with model server 112.
  • Edge appliance 108 periodically transmits reports and receives models from model server 112.
  • Model server 112 can store information on storage device 114.
  • Model server 112 forwards reports from edge appliance 108 to analytics server 116 and forwards models from analytics server 116 to edge appliance 108.
  • there are a plurality of model servers and a plurality of edge appliances where an analytics server is able to support the communications with a plurality of model servers, and a model server is able to support the communications with a plurality of edge appliances.
  • scalability is achieved using a plurality of model servers.
  • Models are used by edge appliance 108 to calculate a preliminary score in real-time or quasi-real-time for detected network interactions.
  • a preliminary score can be based on information associated with detected network interaction(s) as well as on stored parameters or models received from a model server or an analytics server such as model server 112 and analytics server 116, respectively.
  • Analytics server 116 stores report information to storage device 120 which acts as a data warehouse for the report information.
  • Reports web server 122 can build reports based on the data stored in storage device 120.
  • Network operations server 118 monitors the health and status of the system for analyzing network interactions including model server 112, analytics server 116, reports web server 122, and edge appliance 108.
  • Network operations server 118 is able to communicate with each of the system hardware units including model server 112, analytics server 116, reports web server 122, and edge appliance 108 (in some cases directly or via the Internet with edge appliance 108 and in some cases via the Internet, through firewall 104, and via LAN 105).
  • edge appliance 108 monitors network traffic on a local network that is separated from other networks (e.g., the Internet) by a firewall, receives network traffic from a local network and transmits the network traffic to a web server, receives network traffic from a local network that also transmits the network traffic to a web server, or receives network traffic from any other point or between any other two points appropriate for monitoring network traffic.
  • networks e.g., the Internet
  • FIG. 2 is a block diagram illustrating software of an edge appliance in one embodiment.
  • edge appliance 200 is used to implement edge appliance 108 of Figure 1.
  • edge appliance 200 includes monitor 202, analyzer 204, and database 206.
  • Monitor 202 receives information regarding network interactions and/or network traffic and sends information to analyzer 204.
  • Monitor 202 monitors information in real-time and Analyzer 204 can provide real-time or quasi-real-time assessment of information gathered by monitor 202.
  • monitor 202 receives information in real-time from edge appliance hardware that is detecting the network traffic to be monitored.
  • Analyzer 204 analyzes network interactions and/or network traffic by examining TCP/IP or hypertext transfer protocol/secure hypertext transfer protocol (HTTP/HTTPS) layer information and uses that to make a preliminary scoring of the network interaction.
  • Preliminary scoring is based on models received from a model server and/or analytic server, and on other previously acquired network interaction information that is stored locally. Some models are specific in terms of scoring a network interaction - for example, a specific IP address is designated as scoring high because it was recently involved in a successful financial transaction or as scoring low because it was recently involved in sending significant amounts of spam and phishing email.
  • Models used in preliminary scoring of monitored network interactions can be updated locally by updating model parameters using local edge appliance network interaction data, updated from remote model and/or analytic servers either with new models or new model parameters, or any other appropriate manner of updating models for preliminary scoring.
  • Preliminary scoring or other analysis preformed by analyzer 204 can be real-time or in batch mode after a period of time.
  • monitoring and/or detection of a network interaction is done in real-time by edge appliance hardware. Extraction and capture of relevant network interaction information (e.g., layer 3 through layer 7 information) for analysis is performed in real-time.
  • preliminary scoring is provided to a user in realtime or quasi-real-time.
  • the network interaction comprises a click, a cookie, or any other appropriate network interaction.
  • Analyzer 204 is able to probe in real time the IP routing and perform forensics.
  • Analyzer 204 can store network interaction and/or network traffic information in database 206.
  • Analyzer 204 sends network interaction reports to model server and also receives from model server fraud model digests.
  • the analytic server such as analytic server 116, can calculate a final score for the network interaction based on information received at the analytic server. The final score is sent to a report server such as reports web server 122 of Figure 1, from which a customer can access summarized legitimate and fraudulent network interactions.
  • Figure 3 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • the process of Figure 3 is implemented in edge appliance 200 of Figure 2 or edge appliance 108 of Figure 1.
  • network traffic is monitored including network interactions without interfering with network traffic.
  • network traffic is analyzed to derive information about the network interaction.
  • source and timing information are gleaned from the TCP/IP layer information.
  • information is sent about the network interaction to a model server.
  • a click report or log is sent to a model server.
  • Analysis of network traffic is not limited to click type network interactions - email (e.g., simple mail transfer protocol interaction), file transfer protocol (FTP) traffic, telnet, entire page information traffic, instant messaging traffic, hypertext transfer protocol, or any other appropriate traffic can be analyzed to determine if IP addresses, routers, internet service providers (ISP's), users, or any other source or location along an Internet route is suspected of carrying or sourcing fraudulent click traffic.
  • email e.g., simple mail transfer protocol interaction
  • FTP file transfer protocol
  • telnet e.g., telnet
  • entire page information traffic e.g., instant messaging traffic
  • hypertext transfer protocol e.g., hypertext transfer protocol, or any other appropriate traffic
  • IP addresses e.g., IP addresses, routers, internet service providers (ISP's), users, or any other source or location along an Internet route is suspected of carrying or sourcing fraudulent click traffic.
  • ISP's internet service providers
  • Figure 4 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • the process of Figure 4 is implemented in edge appliance 200 of Figure 2 or edge appliance 108 of Figure 1.
  • the processes of 400-402-404, 406, 408, 410, and 412 are run in parallel.
  • 400 network traffic including clicks is/are monitored without interfering with network traffic on a LAN.
  • 402 preliminary scoring is performed.
  • 404 clicks are saved to a database, if appropriate. Control passes to 400, if appropriate, or the process ends.
  • fraud model digest is received.
  • click log is transmitted.
  • an alert is transmitted if appropriate.
  • alerts are transmitted using email, pagers, short message service (SMS), simple network management protocol (SNMP), or any other appropriate way to alert.
  • Alerts may be triggered if a user settable threshold is surpassed - for example high click velocity (i.e., click rate), or high uniform resource locator (URL) velocity (i.e., URL change rate).
  • IP forensics are performed.
  • an IP forensic or other active probe is performed in response to receiving a network interaction which satisfies a criterion or set of criteria.
  • the triggering criterion or criteria could be any suspicious characteristic of an incoming network interaction or a sampling criterion that enables the edge appliance to statistically, or otherwise, sample network interactions.
  • IP forensics refers to sampled or full probing of the network. IP forensics is based at least in part on the capture of border gateway protocol routing tables to help to analyze how the click or network interaction arrived at the monitoring edge appliance. IP forensics can also perform network veracity checks (e.g., probing network, in real-time or non-real time, to check a route back for a received click). In various embodiments, core routing, point of departure, Internet entry, detection of onion routing, honeynet data, detecting use of bot networks, and/or anonymous proxy data are assessed during IP forensics.
  • FIG. 5 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • the process of Figure 5 is implemented in model server 112 of Figure 1.
  • the processes 500, 502, 504, and 506 are run in parallel.
  • a fraud model digest is received from an analytics server.
  • the fraud model digest is transmitted to an edge appliance.
  • a click log is received form an edge appliance.
  • the click log is transmitted to an analytics server.
  • the model server supports the scalability of the system for analyzing network interactions.
  • click logs and fraud digests are compressed.
  • click logs, fraud digests, and any other communications between analyzer system components are securely transmitted using encryption or other secure transmission method.
  • FIG. 6 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
  • the process of Figure 6 is implemented in analytics server 116 of Figure 1.
  • the processes 600-602, 604-606, and 608 are run in parallel.
  • a click log is received from a model server.
  • the click log is stored in a data warehouse.
  • Control passes to 600, if appropriate, or the process ends.
  • click data is analyzed and one or more fraud models are created.
  • the fraud model(s) is/are converted to a fraud digest.
  • Control passes to 604, if appropriate, or the process ends.
  • the fraud digest is transmitted to model servers.
  • FIG. 7 is a flow diagram illustrating a process for analyzing network interactions.
  • the process of Figure 7 is implemented in analytics server 116 of Figure 1.
  • the process of Figure 7 is used to analyze click data in 604 of Figure 6.
  • the processes of 700, 702, 704, and 706 are run in parallel.
  • 700 TCP and HTTP layer information are monitored for a network interaction.
  • IP layer information is monitored for a network interaction.
  • the network interaction is analyzed for the source of the transaction based on layer information.
  • the network interaction is analyzed for the time of transaction based on layer information.
  • Figure 8 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • the process of Figure 8 is implemented on reports web server 122 of Figure 1.
  • a request is received to create a report based on click warehouse data.
  • a report is created based on the click warehouse data.
  • the report is provided.
  • Reports can be provided over any date range and can be one or more of the following: per customer (e.g., Ford), per domain (e.g., mustang.ford.com), per keyword, per uniform resource locator (URL) (e.g., ford.com/promo2567.html), per URL group, or any other appropriate break down. Reports can also provide number of clicks, percentage of valid clicks, percentage of invalid clicks, per click information (e.g., IP, timestamp, click score, score reason, URL, referrer URL, user- agent, etc.). In some embodiments, reports are provided on a regular basis automatically.
  • Figure 9 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • the process of Figure 9 is implemented on network operations server 118 of Figure 1.
  • the processes 900-902, 904, and 906 are run in parallel.
  • health and status data is received from system components.
  • the health and status data is analyzed. Control passes to 900, if appropriate, or the process ends.
  • a health and status report is provided.
  • an alert is provided, if appropriate.
  • health and status data may indicate that a certain component for analyzing network interactions is overloaded or malfunctioning, and alert would then be sent to inform a system administrator or other relevant party to address the overload or malfunction.
  • FIG. 10 is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
  • personal computer 1000 is used by a user to navigate to a publisher's web site hosted by publisher's server 1012.
  • Personal computer 1000 is able to communicate with publisher's server 1012 via network 1002.
  • network 1002 comprises one or more of the following: the Internet, a local area network, a wide area network, a wired network, a wireless network, an internet service provider, or any other appropriate network.
  • the user of personal computer 1000 can click on an advertisement published on publisher's web site and is sent to ad network server 1016.
  • Ad network server 1016 can communicate to and from network 1002 via LAN 1017 and firewall 1014.
  • Edge appliance 1018 monitors network interactions to and from ad network server 1016 via LAN 1017.
  • Edge appliance 1018 can store information on storage device 1020.
  • edge appliance 1018 is placed between ad network server 1016 and LAN 1017 and monitors by receiving and forwarding network traffic.
  • ad network server 1016 When sent to ad network server 1016 after clicking on an advertisement, ad network server 1016 redirects the user to an advertiser's site hosted by advertiser's server 1006.
  • Advertiser's server 1006 can communicate with personal computer 1000 via network 1002, firewall 1004, and LAN 1005.
  • Edge appliance 1008 monitors network traffic to and from advertiser's server 1006 via LAN 1005.
  • Edge appliance 1008 can store information on storage device 1010. In some embodiments, edge appliance 1008 can monitor network traffic to and from advertiser's server 1006 by being placed between advertiser's server 1006 and LAN 1005.
  • Network interaction information from edge appliance 1008 and 1018 can be used to assess if the interactions are correlated.
  • the network interaction information can be used to assess or account for clicks and redirects that should be reimbursed or paid for by the advertiser to the ad network or from the ad network to the publisher.
  • the publisher is one of a plurality of publishers being analyzed.
  • the advertising network is one of a plurality of advertising networks being analyzed.
  • the network interaction analysis is performed by a third party that is not affiliated with the advertising network or the publisher.
  • a third party that is not affiliated with an entity comprises one or more of the following: a third party that is not at all owned or under the influence of the entity, a third party that is not controlled by the entity, a third party that is not under management control of the entity, a third party that is not majority owned by the entity, or any other definition allowing independence of analysis by the third party.
  • FIG. 11 is a flow diagram illustrating an embodiment of a process for network interaction.
  • the process of Figure 11 is executed on the system of Figure 10.
  • a user navigates to a publisher.
  • the user receives a publisher's page.
  • the page fetches an advertisement, typically from the ad network's server.
  • the page loads the advertisement.
  • the user is navigated to an ad network server.
  • the ad network provides a redirect to the user to an advertiser server corresponding to the clicked on advertisement.
  • the user is navigated to the advertiser server.
  • the user receives the advertiser's page.
  • FIG. 12 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
  • the process of Figure 12 is used to analyze network interactions of the system of Figure 10.
  • a network interaction is detected at an advertising network.
  • the network interaction at the advertising network comprises one of the following: a click received at a publisher that directs a user to the advertising network or a redirect from a publisher to an advertiser's site corresponding to the advertisement clicked on at the publisher.
  • a network interaction is detected at an advertiser.
  • the network interaction at the advertiser comprises navigating to the advertiser's site.
  • the network interaction at the advertising network is correlated with the network interaction at the advertiser.
  • the correlation is based at least in part on a time of the network interaction at the advertising network and a time of the network interaction at the advertiser. In various embodiments, the correlation is used for one of the following: to assess if the network interaction at the advertising network is legitimate, to assess if the network interaction at the advertiser is legitimate, and/or to assess if a network interaction at a publisher is legitimate.
  • the advertising network is one of a plurality of advertising networks being analyzed
  • the advertiser is one of a plurality of advertisers being analyzed
  • the network interaction analysis is performed by a third party that is not affiliated with the advertising network or the advertiser.
  • the correlation is performed in one of the following: real-time, quasi-real-time, or batch mode.
  • detecting a network interaction at the advertising network uses an appliance or detecting the network interaction at the advertiser uses an appliance.
  • an appliance capable of real-time, quasi-real-time, or batch analysis of a network interaction is placed such that network traffic is monitored by the appliance on a local network at an advertiser or at an advertising network.
  • the appliance is able to probe the network - for example, IP addresses, routes in the network, or any other useful probe for determining network interaction legitimacy.

Abstract

An appliance for analyzing a network interaction is disclosed. The appliance includes an input to monitor network traffic that includes a network interaction without interfering with the network traffic. The appliance further includes a processor to analyze network traffic to derive information about the network interaction wherein the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user

Description

A NETWORK INTERACTION MONITORING APPLIANCE
CROSS REFERENCE TO OTHER APPLICATIONS
[0001] This application claims priority to U.S. Provisional Patent Application
No. (Attorney Docket No. FRDWPOOl) entitled A NETWORK
INTERACTION MONITORING APPLIANCE filed December 15, 2006, originally filed as non-provisional U.S. Patent Application No. 11/640,442 and subsequently converted to a provisional application by request submitted October 11, 2007, which application is incorporated herein by reference for all purposes.
BACKGROUND OF THE INVENTION
[0002] Revenue for Internet companies is often driven by advertising, which is paid out based on the number of network interactions (e.g., a click) on an advertisement. However, sometimes network interactions are not legitimate - for example, a botnet may be developed to cause network interactions with an advertisement. Illegitimate network interactions lead to inappropriate payments by advertisers and inappropriate payments to publishers. It would be useful to be able to analyze network interactions to assess their legitimacy to reduce the amount of inappropriate payments.
BRIEF DESCRIPTION OF THE DRAWINGS
[0003] Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.
[0004] Figure l is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
[0005] Figure 2 is a block diagram illustrating software of an edge appliance in one embodiment. [0006] Figure 3 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
[0007] Figure 4 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
[0008] Figure 5 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
[0009] Figure 6 is a flow diagram illustrating an embodiment of a process for analyzing network interactions.
[0010] Figure 7 is a flow diagram illustrating a process for analyzing network interactions.
[0011] Figure 8 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
[0012] Figure 9 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
[0013] Figure 10 is a block diagram illustrating an embodiment of a system for analyzing a network interaction.
[0014] Figure 11 is a flow diagram illustrating an embodiment of a process for network interaction.
[0015] Figure 12 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction.
DETAILED DESCRIPTION
[0016] The invention can be implemented in numerous ways, including as a process, an apparatus, a system, a composition of matter, a computer readable medium such as a computer readable storage medium or a computer network wherein program instructions are sent over optical or communication links. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. A component such as a processor or a memory described as being configured to perform a task includes both a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. In general, the order of the steps of disclosed processes may be altered within the scope of the invention.
[0017] A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.
[0018] Analyzing a network interaction is disclosed. An appliance is used for analyzing a network interaction. The appliance includes an input to monitor network traffic without interfering with the network traffic. The network traffic includes a network interaction. The appliance includes a processor which analyzes the network traffic to derive information about the network interaction. The information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user. If the interaction is qualified, then the network interaction is legitimate and should qualify for a payment. For example, upon receiving a legitimate click, an advertiser should pay for the click and the publisher should be paid for the click.
[0019] In some embodiments, an appliance passively monitors network interactions for a web server. The server can be an advertising network's server, a publisher's server, an advertiser's server, an internet service provider's server, or any other appropriate server where network interactions can be monitored. The appliance derives its assessment information by monitoring the transmission control protocol (TCP) and/or internet protocol (IP) layer information of network interactions. For example, some of the information detected in real-time by the appliance hardware is information from Open Systems Interconnection (OSI) layers 3 through 7 that is associated with the network interaction. Ultimately, the assessment information is used to decide if the network interaction is qualified so that a payment is made by the advertiser and/or a payment is made to a publisher. An inference regarding legitimacy or fraudulence and rates or levels of legitimacy or fraudulence can then be reported. As an example, based on the assessment information, the appliance can ascertain that a network interaction has a common source or common routing information with other network interactions. If many network interactions aggregate at a point in the network (e.g., if the network interactions originate at a common source internet protocol address or are routed through a common network device such as a router that makes packets anonymous), it becomes a strong possibility that the network interactions are not legitimate.
[0020] In some embodiments, the network interaction monitoring is performed by a system that is associated with a third party entity that is not aligned with the advertising network, the publisher, or the advertiser.
[0021] In some embodiments, a network interaction at an advertising network and a network interaction at a publisher are correlated to provide an assessment as to the legitimacy or fraudulence of the network interaction (e.g., a click).
[0022] Figure 1 is a block diagram illustrating an embodiment of a system for analyzing a network interaction. In the example shown, computer 100 is used by a user for accessing a web page on server 106. In various embodiments, server 106 is associated with an advertising network or an advertiser. Computer 100 is able to communicate with network 102. In various embodiments, network 102 comprises one or more of the following: the Internet, a local area network, a wide area network, a wired network, a wireless network, or any other appropriate network. Server 106 can be accessed from network 102 via firewall 104 and local area network (LAN) 105. Edge appliance 108 is able to monitor traffic to and from server 106 and is connected to LAN 105. In various embodiments, monitoring comprises detecting in hardware the network traffic or the network interactions to be monitored, detecting in real-time network traffic, capturing data in real-time, analyzing data in real-time, triggering real-time queries or forensics of IP addresses/network topology/routing tables/preferred paths, detecting layer 3 through layer 7 data from the monitored traffic, monitoring Ethernet traffic, or any other appropriate monitoring of network traffic. Edge appliance 108 is able to store information on storage device 110. In some embodiments, edge appliance 108 monitors traffic to and from server 106 by being between server 106 and LAN 105 by receiving and forwarding all traffic between network 102 and server 106. In this situation, all traffic is received and forwarded without substantially affecting network traffic, without substantially affecting a transaction involving the network traffic, and/or with less than 2 milliseconds of delay for the process of receiving and forwarding.
[0023] In some embodiments, edge appliances can also be used to monitor traffic at other points in the network other than in front of or just beside a server - for example, on a trunk line, an internet service provider network, an advertising network, or any other appropriate traffic site.
[0024] Edge appliance 108 is able to communicate with model server 112.
Edge appliance 108 periodically transmits reports and receives models from model server 112. Model server 112 can store information on storage device 114. Model server 112 forwards reports from edge appliance 108 to analytics server 116 and forwards models from analytics server 116 to edge appliance 108. In some embodiments, there are a plurality of model servers and a plurality of edge appliances, where an analytics server is able to support the communications with a plurality of model servers, and a model server is able to support the communications with a plurality of edge appliances. In some embodiments, scalability is achieved using a plurality of model servers.
[0025] Models are used by edge appliance 108 to calculate a preliminary score in real-time or quasi-real-time for detected network interactions. A preliminary score can be based on information associated with detected network interaction(s) as well as on stored parameters or models received from a model server or an analytics server such as model server 112 and analytics server 116, respectively.
[0026] Analytics server 116 stores report information to storage device 120 which acts as a data warehouse for the report information. Reports web server 122 can build reports based on the data stored in storage device 120. Network operations server 118 monitors the health and status of the system for analyzing network interactions including model server 112, analytics server 116, reports web server 122, and edge appliance 108. Network operations server 118 is able to communicate with each of the system hardware units including model server 112, analytics server 116, reports web server 122, and edge appliance 108 (in some cases directly or via the Internet with edge appliance 108 and in some cases via the Internet, through firewall 104, and via LAN 105).
[0027] In various embodiments, edge appliance 108 monitors network traffic on a local network that is separated from other networks (e.g., the Internet) by a firewall, receives network traffic from a local network and transmits the network traffic to a web server, receives network traffic from a local network that also transmits the network traffic to a web server, or receives network traffic from any other point or between any other two points appropriate for monitoring network traffic.
[0028] Figure 2 is a block diagram illustrating software of an edge appliance in one embodiment. In some embodiments, edge appliance 200 is used to implement edge appliance 108 of Figure 1. In the example shown, edge appliance 200 includes monitor 202, analyzer 204, and database 206. Monitor 202 receives information regarding network interactions and/or network traffic and sends information to analyzer 204. Monitor 202 monitors information in real-time and Analyzer 204 can provide real-time or quasi-real-time assessment of information gathered by monitor 202. In some embodiments, monitor 202 receives information in real-time from edge appliance hardware that is detecting the network traffic to be monitored. Analyzer 204 analyzes network interactions and/or network traffic by examining TCP/IP or hypertext transfer protocol/secure hypertext transfer protocol (HTTP/HTTPS) layer information and uses that to make a preliminary scoring of the network interaction. [0029] Preliminary scoring is based on models received from a model server and/or analytic server, and on other previously acquired network interaction information that is stored locally. Some models are specific in terms of scoring a network interaction - for example, a specific IP address is designated as scoring high because it was recently involved in a successful financial transaction or as scoring low because it was recently involved in sending significant amounts of spam and phishing email. Some models are generic in terms of scoring a network interaction - for example, an IP address that cannot be located with a probe immediately after being received in a click is designated as scoring low because it is likely fraudulent. Local edge appliance stored history can indicate that a large number of network interactions are coming from one particular IP address in a short period of time; Analyzer 204 can indicate that under these circumstances that these network interactions are designated with a low preliminary score. Models used in preliminary scoring of monitored network interactions can be updated locally by updating model parameters using local edge appliance network interaction data, updated from remote model and/or analytic servers either with new models or new model parameters, or any other appropriate manner of updating models for preliminary scoring.
[0030] Preliminary scoring or other analysis preformed by analyzer 204 can be real-time or in batch mode after a period of time. In some embodiments, monitoring and/or detection of a network interaction is done in real-time by edge appliance hardware. Extraction and capture of relevant network interaction information (e.g., layer 3 through layer 7 information) for analysis is performed in real-time. In some embodiments, preliminary scoring is provided to a user in realtime or quasi-real-time.
[0031] In various embodiments, the network interaction comprises a click, a cookie, or any other appropriate network interaction. Analyzer 204 is able to probe in real time the IP routing and perform forensics. Analyzer 204 can store network interaction and/or network traffic information in database 206. Analyzer 204 sends network interaction reports to model server and also receives from model server fraud model digests. The analytic server, such as analytic server 116, can calculate a final score for the network interaction based on information received at the analytic server. The final score is sent to a report server such as reports web server 122 of Figure 1, from which a customer can access summarized legitimate and fraudulent network interactions.
[0032] Figure 3 is a flow diagram illustrating an embodiment of a process for analyzing network interactions. In some embodiments, the process of Figure 3 is implemented in edge appliance 200 of Figure 2 or edge appliance 108 of Figure 1. In the example shown, in 300 network traffic is monitored including network interactions without interfering with network traffic. In 302, network traffic is analyzed to derive information about the network interaction. In various embodiments, source and timing information are gleaned from the TCP/IP layer information. In 304, information is sent about the network interaction to a model server. In some embodiments, a click report or log is sent to a model server.
[0033] Analysis of network traffic is not limited to click type network interactions - email (e.g., simple mail transfer protocol interaction), file transfer protocol (FTP) traffic, telnet, entire page information traffic, instant messaging traffic, hypertext transfer protocol, or any other appropriate traffic can be analyzed to determine if IP addresses, routers, internet service providers (ISP's), users, or any other source or location along an Internet route is suspected of carrying or sourcing fraudulent click traffic.
[0034] Figure 4 is a flow diagram illustrating an embodiment of a process for analyzing network interactions. In some embodiments, the process of Figure 4 is implemented in edge appliance 200 of Figure 2 or edge appliance 108 of Figure 1. In the example shown, the processes of 400-402-404, 406, 408, 410, and 412 are run in parallel. In 400, network traffic including clicks is/are monitored without interfering with network traffic on a LAN. In 402, preliminary scoring is performed. In 404, clicks are saved to a database, if appropriate. Control passes to 400, if appropriate, or the process ends. In 406, fraud model digest is received. In 408, click log is transmitted. In 410, an alert is transmitted if appropriate. In various embodiments, alerts are transmitted using email, pagers, short message service (SMS), simple network management protocol (SNMP), or any other appropriate way to alert. Alerts may be triggered if a user settable threshold is surpassed - for example high click velocity (i.e., click rate), or high uniform resource locator (URL) velocity (i.e., URL change rate). In 412, IP forensics are performed. In some embodiments, an IP forensic or other active probe is performed in response to receiving a network interaction which satisfies a criterion or set of criteria. The triggering criterion or criteria could be any suspicious characteristic of an incoming network interaction or a sampling criterion that enables the edge appliance to statistically, or otherwise, sample network interactions. IP forensics refers to sampled or full probing of the network. IP forensics is based at least in part on the capture of border gateway protocol routing tables to help to analyze how the click or network interaction arrived at the monitoring edge appliance. IP forensics can also perform network veracity checks (e.g., probing network, in real-time or non-real time, to check a route back for a received click). In various embodiments, core routing, point of departure, Internet entry, detection of onion routing, honeynet data, detecting use of bot networks, and/or anonymous proxy data are assessed during IP forensics.
[0035] Figure 5 is a flow diagram illustrating an embodiment of a process for analyzing network interactions. In some embodiments, the process of Figure 5 is implemented in model server 112 of Figure 1. In the example shown, the processes 500, 502, 504, and 506 are run in parallel. In 500 a fraud model digest is received from an analytics server. In 502, the fraud model digest is transmitted to an edge appliance. In 504, a click log is received form an edge appliance. In 506, the click log is transmitted to an analytics server. In some embodiments, there is a plurality of edge appliances that are supported by a model server. In some embodiments, there is a plurality of model servers supported by an analytics server. In some embodiments, the model server supports the scalability of the system for analyzing network interactions.
[0036] In some embodiments, click logs and fraud digests are compressed. In some embodiments, click logs, fraud digests, and any other communications between analyzer system components are securely transmitted using encryption or other secure transmission method.
[0037] Figure 6 is a flow diagram illustrating an embodiment of a process for analyzing network interactions. In some embodiments, the process of Figure 6 is implemented in analytics server 116 of Figure 1. In the example shown, the processes 600-602, 604-606, and 608 are run in parallel. In 600, a click log is received from a model server. In 602, the click log is stored in a data warehouse. Control passes to 600, if appropriate, or the process ends. In 604, click data is analyzed and one or more fraud models are created. In 606, the fraud model(s) is/are converted to a fraud digest. Control passes to 604, if appropriate, or the process ends. In 608, the fraud digest is transmitted to model servers.
[0038] Figure 7 is a flow diagram illustrating a process for analyzing network interactions. In some embodiments, the process of Figure 7 is implemented in analytics server 116 of Figure 1. In some embodiments, the process of Figure 7 is used to analyze click data in 604 of Figure 6. In the example shown, the processes of 700, 702, 704, and 706 are run in parallel. In 700, TCP and HTTP layer information are monitored for a network interaction. In 702, IP layer information is monitored for a network interaction. In 704, the network interaction is analyzed for the source of the transaction based on layer information. In 706, the network interaction is analyzed for the time of transaction based on layer information.
[0039] Figure 8 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction. In some embodiments, the process of Figure 8 is implemented on reports web server 122 of Figure 1. In the example shown, in 800 a request is received to create a report based on click warehouse data. In 802, a report is created based on the click warehouse data. In 804, the report is provided.
[0040] Reports can be provided over any date range and can be one or more of the following: per customer (e.g., Ford), per domain (e.g., mustang.ford.com), per keyword, per uniform resource locator (URL) (e.g., ford.com/promo2567.html), per URL group, or any other appropriate break down. Reports can also provide number of clicks, percentage of valid clicks, percentage of invalid clicks, per click information (e.g., IP, timestamp, click score, score reason, URL, referrer URL, user- agent, etc.). In some embodiments, reports are provided on a regular basis automatically. [0041] Figure 9 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction. In some embodiments, the process of Figure 9 is implemented on network operations server 118 of Figure 1. In the example shown, the processes 900-902, 904, and 906 are run in parallel. In 900, health and status data is received from system components. In 902, the health and status data is analyzed. Control passes to 900, if appropriate, or the process ends. In 904, a health and status report is provided. In 906, an alert is provided, if appropriate. For example, health and status data may indicate that a certain component for analyzing network interactions is overloaded or malfunctioning, and alert would then be sent to inform a system administrator or other relevant party to address the overload or malfunction.
[0042] Figure 10 is a block diagram illustrating an embodiment of a system for analyzing a network interaction. In the example shown, personal computer 1000 is used by a user to navigate to a publisher's web site hosted by publisher's server 1012. Personal computer 1000 is able to communicate with publisher's server 1012 via network 1002. In various embodiments, network 1002 comprises one or more of the following: the Internet, a local area network, a wide area network, a wired network, a wireless network, an internet service provider, or any other appropriate network. The user of personal computer 1000 can click on an advertisement published on publisher's web site and is sent to ad network server 1016. Ad network server 1016 can communicate to and from network 1002 via LAN 1017 and firewall 1014. Edge appliance 1018 monitors network interactions to and from ad network server 1016 via LAN 1017. Edge appliance 1018 can store information on storage device 1020. In some embodiments, edge appliance 1018 is placed between ad network server 1016 and LAN 1017 and monitors by receiving and forwarding network traffic.
[0043] When sent to ad network server 1016 after clicking on an advertisement, ad network server 1016 redirects the user to an advertiser's site hosted by advertiser's server 1006. Advertiser's server 1006 can communicate with personal computer 1000 via network 1002, firewall 1004, and LAN 1005. Edge appliance 1008 monitors network traffic to and from advertiser's server 1006 via LAN 1005. Edge appliance 1008 can store information on storage device 1010. In some embodiments, edge appliance 1008 can monitor network traffic to and from advertiser's server 1006 by being placed between advertiser's server 1006 and LAN 1005.
[0044] Network interaction information from edge appliance 1008 and 1018 can be used to assess if the interactions are correlated. In some embodiments, the network interaction information can be used to assess or account for clicks and redirects that should be reimbursed or paid for by the advertiser to the ad network or from the ad network to the publisher.
[0045] In some embodiments, the publisher is one of a plurality of publishers being analyzed. In some embodiments, the advertising network is one of a plurality of advertising networks being analyzed. In some embodiments, the network interaction analysis is performed by a third party that is not affiliated with the advertising network or the publisher. In various embodiments, a third party that is not affiliated with an entity comprises one or more of the following: a third party that is not at all owned or under the influence of the entity, a third party that is not controlled by the entity, a third party that is not under management control of the entity, a third party that is not majority owned by the entity, or any other definition allowing independence of analysis by the third party.
[0046] Figure 11 is a flow diagram illustrating an embodiment of a process for network interaction. In some embodiments, the process of Figure 11 is executed on the system of Figure 10. In the example shown, in 1100 a user navigates to a publisher. In 1102, the user receives a publisher's page. In 1104, the page fetches an advertisement, typically from the ad network's server. In 1106, the page loads the advertisement. In 1108, the user clicks on the advertisement. In 1110, the user is navigated to an ad network server. In 1112, the ad network provides a redirect to the user to an advertiser server corresponding to the clicked on advertisement. In 1114, the user is navigated to the advertiser server. In 1116, the user receives the advertiser's page.
[0047] Figure 12 is a flow diagram illustrating an embodiment of a process for analyzing a network interaction. In some embodiments, the process of Figure 12 is used to analyze network interactions of the system of Figure 10. In the example shown, in 1200 a network interaction is detected at an advertising network. In some embodiments, the network interaction at the advertising network comprises one of the following: a click received at a publisher that directs a user to the advertising network or a redirect from a publisher to an advertiser's site corresponding to the advertisement clicked on at the publisher. In 1202, a network interaction is detected at an advertiser. In some embodiments, the network interaction at the advertiser comprises navigating to the advertiser's site. In 1204, the network interaction at the advertising network is correlated with the network interaction at the advertiser. In some embodiments, the correlation is based at least in part on a time of the network interaction at the advertising network and a time of the network interaction at the advertiser. In various embodiments, the correlation is used for one of the following: to assess if the network interaction at the advertising network is legitimate, to assess if the network interaction at the advertiser is legitimate, and/or to assess if a network interaction at a publisher is legitimate.
[0048] In various embodiments, the advertising network is one of a plurality of advertising networks being analyzed, the advertiser is one of a plurality of advertisers being analyzed, and/or the network interaction analysis is performed by a third party that is not affiliated with the advertising network or the advertiser.
[0049] In some embodiments, the correlation is performed in one of the following: real-time, quasi-real-time, or batch mode. In various embodiments, detecting a network interaction at the advertising network uses an appliance or detecting the network interaction at the advertiser uses an appliance. For example, an appliance capable of real-time, quasi-real-time, or batch analysis of a network interaction is placed such that network traffic is monitored by the appliance on a local network at an advertiser or at an advertising network. In some embodiments, the appliance is able to probe the network - for example, IP addresses, routes in the network, or any other useful probe for determining network interaction legitimacy.
[0050] Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.
[0051] WHAT IS CLAIMED IS :

Claims

1. An appliance for analyzing a network interaction, comprising: an input to monitor network traffic that includes a network interaction without interfering with the network traffic; and
5 a processor to analyze network traffic to derive information about the network interaction wherein the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user.
2. An appliance as in claim 1, wherein the network interaction comprises a click. io
3. An appliance as in claim 1, wherein the input to monitor network traffic passively monitors network traffic.
4. An appliance as in claim 1, wherein the input to monitor network traffic passively monitors network traffic by sniffing network traffic packets.
5. An appliance as in claim 1, wherein the input to monitor network traffic i5 receives network traffic and forwards network traffic.
6. An appliance as in claim 1, wherein the input to monitor network traffic receives network traffic and forwards network traffic, wherein the receiving and forwarding of network traffic delay does not substantially affect the network traffic.
7. An appliance as in claim 1, wherein the input to monitor network traffic0 receives network traffic and forwards network traffic, wherein the receiving and forwarding of network traffic delay does not substantially affect a transaction involving the network traffic.
8. An appliance as in claim 1, wherein the input to monitor network traffic receives network traffic and forwards network traffic, wherein the receiving and5 forwarding of network traffic does not delay the network traffic more than 2 milliseconds.
9. An appliance as in claim 1, wherein the input to monitor network traffic is a hardware detector of network interactions.
10. An appliance as in claim 1, wherein the appliance monitors network traffic on a local network that is separated from other networks by a firewall.
11. An appliance as in claim 1, wherein the appliance receives network traffic from a local network and transmits the network traffic to a web server.
5 12. An appliance as in claim 1, wherein the appliance receives network traffic from a local network that also transmits the network traffic to a web server.
13. An appliance as in claim 1, wherein the information derived comprises a page download metric.
14. An appliance as in claim 1, wherein the information derived comprises a I0 download connection transfer rate.
15. An appliance as in claim 1, wherein the information derived is based at least in part on time information included with network traffic.
16. An appliance as in claim 1, wherein the information derived comprises a network route traversed. is
17. An appliance as in claim 1, wherein the information derived comprises a network route location.
18. An appliance as in claim 1, wherein the information derived is based at least in part on address information included with network traffic.
19. An appliance as in claim 1, wherein the information derived is based at least in 20 part layer 3 through layer 7 information included with network traffic.
20. An appliance as in claim 1, wherein a model received from the model server is used to determine an aggregation point, wherein the aggregation point is common to a plurality of network interactions.
21. An appliance as in claim 20, wherein the aggregation point comprises a router.
25 22. An appliance as in claim 20, wherein the aggregation point comprises an internet protocol address.
23. An appliance as in claim 20, wherein the aggregation point comprises a network node.
24. An appliance as in claim 20, wherein the aggregation point comprises an internet service provider.
25. An appliance as in claim 1, wherein a model received from the model server is used to infer a legitimate network interaction.
5 26. An appliance as in claim 25, wherein the legitimate network interaction is used to estimate a network interaction level.
27. An appliance as in claim 1, wherein a model on an analytic server is used to infer a fraudulent network interaction.
28. An appliance as in claim 27, wherein the fraudulent network interaction is io used to estimate a network interaction level.
29. An appliance as in claim 1, wherein the appliance is operated by a third party entity, wherein the third party entity is not affiliated with a web site whose traffic is being monitored or an advertising network that brokered the publishing of an advertisement on a page of the web site. is
30. An appliance as in claim 1, further comprising an output to send click information to a model server.
31. An appliance as in claim 1, wherein the processor further provides real-time or quasi-real-time preliminary scoring information to a user.
32. An appliance as in claim 1, further comprising an input to receive model 20 information from a model server.
33. 33. A system for analyzing a network interaction, comprising: a processor; and a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to: 25 monitor traffic including the network interaction, wherein monitoring includes monitoring at least one of TCP, HTTP, or IP layer information; and analyze the network interaction is based at least in part on a source of a transaction determined from the layer information.
34. A system as in claim 33, wherein the network interaction comprises a click. 30
35. A system as in claim 33, wherein the network interaction comprises a cookie.
36. A system as in claim 33, wherein the network interaction comprises a simple mail transfer protocol interaction.
37. A system as in claim 33, wherein the network interaction comprises a file transfer protocol interaction.
38. A system as in claim 33, wherein the network interaction comprises a hypertext transfer protocol interaction.
39. A system as in claim 33, wherein the network interaction comprises a telnet interaction.
40. A system as in claim 33, wherein the monitoring comprises monitoring of Ethernet traffic.
41. A system as in claim 33, wherein the source of the transaction comprises a router.
42. A system as in claim 33, wherein the source of the transaction comprises an internet protocol address.
43. A system as in claim 33, wherein the source of the transaction comprises a network node.
44. A system as in claim 33, wherein the source of the transaction comprises an internet service provider.
45. A system as in claim 33, wherein the layer information includes information of a network route traversed.
46. A system as in claim 33, wherein the layer information comprises layer 3 through layer 7 information associated the network interaction.
47. A system as in claim 33, wherein analyzing the network interaction is based at least in part on a time associated with a transaction determined from the layer information.
48. A system as in claim 33, wherein analyzing the network interaction is based at least in part on a time associated with a transaction determined from the layer information, and wherein the time is used to determine a connection bandwidth.
49. A system as in claim 33, wherein analyzing the network interaction includes probing network to check a route back.
50. A system as in claim 33, wherein analyzing the network interaction includes real-time probing network to check a route back.
51. A system as in claim 33, wherein analyzing the network interaction includes detecting onion routing.
52. A system as in claim 33, wherein analyzing the network interaction includes detecting use of bot networks.
53. A system as in claim 33, wherein the layer information is used to distinguish whether the network interaction is a qualified network interaction with a user.
54. A method of analyzing a network interaction, comprising: monitoring traffic including the network interaction, wherein monitoring includes monitoring at least one of TCP, HTTP, or IP layer information; and analyzing the network interaction is based at least in part on a source of a transaction determined from the layer information.
55. A method as in claim 54, wherein the network interaction comprises a click.
56. A method as in claim 54, wherein the network interaction comprises a cookie.
57. A method as in claim 54, wherein the network interaction comprises a simple mail transfer protocol interaction.
58. A method as in claim 54, wherein the network interaction comprises a file transfer protocol interaction.
59. A method as in claim 54, wherein the network interaction comprises a hypertext transfer protocol interaction.
60. A method as in claim 54, wherein the network interaction comprises a telnet interaction.
61. A method as in claim 54, wherein the monitoring comprises monitoring of Ethernet traffic.
62. A method as in claim 54, wherein the layer information includes information of a network route traversed.
63. A method as in claim 54, wherein the layer information comprises layer 3 through layer 7 information associated the network interaction.
64. A method as in claim 54, wherein analyzing the network interaction is based at least in part on a time associated with a transaction determined from the layer information.
65. A method as in claim 54, wherein analyzing the network interaction is based at least in part on a time associated with a transaction determined from the layer information, and wherein the time is used to determine a connection bandwidth.
66. A method as in claim 54, wherein analyzing the network interaction includes probing network to check a route back.
67. A method as in claim 54, wherein analyzing the network interaction includes real-time probing network to check a route back.
68. A method as in claim 52, wherein analyzing the network interaction includes detecting onion routing.
69. A method as in claim 54, wherein analyzing the network interaction includes detecting use of bot networks.
70. A computer program product for analyzing a network interaction, the computer program product being embodied in a computer readable medium and comprising computer instructions for: monitoring traffic including the network interaction, wherein monitoring includes monitoring at least one of TCP, HTTP, or IP layer information; and analyzing the network interaction is based at least in part on a source of a transaction determined from the layer information.
71. A method of correlating a network interaction, comprising: detecting a network interaction at an advertising network; detecting a network interaction at an advertiser; correlating the network interaction at the advertising network with the network interaction at the advertiser, wherein the network interaction correlation is performed by a third party that is not affiliated with the advertising network or the advertiser.
72. A method as in claim 71, wherein correlating the network interaction at the advertising network with the network interaction at the advertiser is based at least in part on a time of the network interaction at the advertising network and a time of the network interaction at the advertiser.
73. A method as in claim 71, wherein network interaction at the advertiser comprises navigating to the advertiser's site.
74. A method as in claim 71, wherein network interaction at the advertising network comprises a click received at a publisher site that directs a user to the advertising network.
75. A method as in claim 71, wherein network interaction at the advertising 5 network comprises a redirect from a publisher to the advertiser's site.
76. A method as in claim 75, wherein the advertiser's site corresponds to an advertisement clicked on at the publisher.
77. A method as in claim 71, wherein the advertising network is one of a plurality of advertising networks being correlated. o
78. A method as in claim 71, wherein the advertiser is one of a plurality of advertisers being correlated.
79. A method as in claim 71, further comprising using the correlation to assess if the network interaction at the advertising network is legitimate.
80. A method as in claim 71, further comprising using the correlation to assess ifs the network interaction at the advertiser is legitimate.
81. A method as in claim 71, further comprising using the correlation to assess if a network interaction at a publisher is legitimate.
82. A method as in claim 71, wherein the correlation is used to distinguish whether the network interaction at the advertiser is a qualified network interactiono with a user.
83. A method as in claim 71, wherein the correlation is performed in one of the following: real-time, quasi-real-time, or batch mode.
84. A method as in claim 71, wherein detecting the network interaction at the advertising network uses an appliance. 5
85. A method as in claim 71, wherein detecting the network interaction at the advertiser uses an appliance.
86. A computer program product for analyzing a network interaction, the computer program product being embodied in a computer readable medium and comprising computer instructions for: detecting a network interaction at an advertising network; detecting a network interaction at an advertiser; correlating the network interaction at the advertising network with the network interaction at the advertiser, wherein the network interaction correlation is performed by a third party that is not affiliated with the advertising network or the advertiser.
87. A system for analyzing a network interaction, comprising: a detector for detecting a network interaction at an advertising network; a detector for detecting a network interaction at an advertiser; a correlator for correlating the network interaction at the advertising network with the network interaction at the advertiser, wherein the network interaction correlation is performed by a third party that is not affiliated with the advertising network or the advertiser.
PCT/US2007/025133 2006-12-15 2007-12-07 A network interaction monitoring appliance WO2008076234A1 (en)

Applications Claiming Priority (8)

Application Number Priority Date Filing Date Title
US791506P 2006-12-15 2006-12-15
US11/640,125 US10402832B2 (en) 2006-12-15 2006-12-15 Network interaction correlation
US11/640,441 US7685275B2 (en) 2006-12-15 2006-12-15 Network interaction analysis
US11/640,441 2006-12-15
US11/640,125 2006-12-15
US61/007,915 2006-12-15
US11/986,311 2007-11-19
US11/986,311 US8990379B2 (en) 2006-12-15 2007-11-19 Network interaction monitoring appliance

Publications (1)

Publication Number Publication Date
WO2008076234A1 true WO2008076234A1 (en) 2008-06-26

Family

ID=39536611

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2007/025133 WO2008076234A1 (en) 2006-12-15 2007-12-07 A network interaction monitoring appliance

Country Status (1)

Country Link
WO (1) WO2008076234A1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012127042A1 (en) * 2011-03-23 2012-09-27 Spidercrunch Limited Fast device classification
EP3091692A1 (en) * 2015-05-06 2016-11-09 General Electric Technology GmbH A network connection monitoring assembly for an industrial control system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030195960A1 (en) * 1999-05-12 2003-10-16 Merriam Greg Elliot System, method, and program for measuring performance in a network system
WO2005053226A1 (en) * 2003-11-27 2005-06-09 Telecom Italia S.P.A. Method, system, network and computer program product for securing administrative transactions over a network
US20060004633A1 (en) * 2004-07-02 2006-01-05 Douglas Ashbaugh Multinode traffic architecture and network for the exchange of internet advertising traffic
US20060026067A1 (en) * 2002-06-14 2006-02-02 Nicholas Frank C Method and system for providing network based target advertising and encapsulation

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030195960A1 (en) * 1999-05-12 2003-10-16 Merriam Greg Elliot System, method, and program for measuring performance in a network system
US20060026067A1 (en) * 2002-06-14 2006-02-02 Nicholas Frank C Method and system for providing network based target advertising and encapsulation
WO2005053226A1 (en) * 2003-11-27 2005-06-09 Telecom Italia S.P.A. Method, system, network and computer program product for securing administrative transactions over a network
US20060004633A1 (en) * 2004-07-02 2006-01-05 Douglas Ashbaugh Multinode traffic architecture and network for the exchange of internet advertising traffic

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012127042A1 (en) * 2011-03-23 2012-09-27 Spidercrunch Limited Fast device classification
US8799456B2 (en) 2011-03-23 2014-08-05 Spidercrunch Limited Fast device classification
EP3104294A1 (en) * 2011-03-23 2016-12-14 Google, Inc. Fast device classification
EP3091692A1 (en) * 2015-05-06 2016-11-09 General Electric Technology GmbH A network connection monitoring assembly for an industrial control system
WO2016177855A1 (en) * 2015-05-06 2016-11-10 General Electric Technology Gmbh A monitoring assembly for an industrial control system
JP2018515027A (en) * 2015-05-06 2018-06-07 ゼネラル エレクトリック テクノロジー ゲゼルシャフト ミット ベシュレンクテル ハフツングＧｅｎｅｒａｌ Ｅｌｅｃｔｒｉｃ Ｔｅｃｈｎｏｌｏｇｙ ＧｍｂＨ Surveillance assembly for industrial control systems
US10630775B2 (en) 2015-05-06 2020-04-21 General Electric Technology Gmbh Monitoring assembly for an industrial control system

Similar Documents

Publication Publication Date Title
US7685275B2 (en) Network interaction analysis
US9412111B2 (en) Network interaction monitoring appliance
US7801985B1 (en) Data transfer for network interaction fraudulence detection
US9444835B2 (en) Method for tracking machines on a network using multivariable fingerprinting of passively available information
US10284516B2 (en) System and method of determining geographic locations using DNS services
US7933951B2 (en) Systems and methods for discerning and controlling communication traffic
US10193908B2 (en) Data transfer for network interaction fraudulence detection
US7277938B2 (en) Method and system for managing performance of data transfers for a data access system
US8122082B2 (en) System and method for detecting a proxy between a client and a server
US20090126014A1 (en) Methods and systems for analyzing security events
WO2017019419A1 (en) Methods and systems for preventing advertisements from being delivered to untrustworthy client devices
WO2007123760A2 (en) Network device for monitoring and modifying network traffic between an end user and a content provider
US20180324064A1 (en) Unobtrusive methods and systems for collecting information transmitted over a network
CN100401696C (en) Method for detecting number of computer users in inner compute network
Pujol et al. Back-office web traffic on the internet
US10402832B2 (en) Network interaction correlation
WO2008076234A1 (en) A network interaction monitoring appliance
Han et al. Sliding-mode observers for real-time DDoS detection
KR20080001886A (en) Apparatus and method for managing customer network
Pujol Gil Web content delivery, monetization, and search
Pujol Gil Web content delivery, monetization, and search: back-office and advertisement traffic on the Internet
Gil Web content delivery, monetization, and search: Back-office and advertisement traffic on the Internet
US10235677B1 (en) Determination and application of click quality
JP5865185B2 (en) Communication apparatus and URL evaluation system
d'Auriol et al. A Computation-Communication Sequencing Model for Intrusion Detection Systems.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07862666

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: COMMUNICATION UNDER RULE 112(1) EPC, EPO FORM 1205A DATED 24/09/09

122 Ep: pct application non-entry in european phase

Ref document number: 07862666

Country of ref document: EP

Kind code of ref document: A1