Techniques for predicting leakage of a serial number

Patent metadata

Field	Value
Publication number	US-11995158-B2
Application number	US-202117193251-A
Country	US
Kind code	B2
Filing date	Mar 5, 2021
Priority date	Mar 5, 2021
Publication date	May 28, 2024
Grant date	May 28, 2024

Abstract

Techniques are provided herein for tracking activation events associated with a given serial number and using the data from the activation events to autonomously determine whether the serial number has been leaked. Numerous different characteristic parameters of activation events collected over a given time period for a serial number can be tracked and stored in a database. A plurality of different input variables can be generated based on the characteristic parameter data, which create the inputs that are used by a trained neural network to determine the leakage probability. If the leakage probability is determined to be above a certain threshold, an alert of some kind can be generated to indicate that the serial number has been leaked.

First claim

What is claimed is:

1. A method for identifying a leaked serial number associated with a software product, the method comprising:
determining one or more country affinity scores between a first country and one or more second countries by determining, for each of the one or more second countries, a total number of unique serial numbers used in both the first country and the second country, divided by a total number of unique serial numbers used in the first country but not in the second country;
receiving data characterizing a plurality of activation events, wherein each activation event corresponds to a software activation request using a particular serial number;
identifying a plurality of characteristic parameters for each of the activation events that occur over a period of time, wherein each of the characteristic parameters characterizes an aspect of one or more of the activation events;
identifying a threshold quantity of the plurality of activation events that are characterized by a particular characteristic parameter;
identifying a sparse subset of the plurality of activation events, wherein the sparse subset includes a quantity of infrequent activation events that (a) occur during the period of time, and (b) are characterized by the particular characteristic parameter, wherein the quantity of infrequent activation events in the sparse subset is less than the threshold quantity;
generating a plurality of input variables associated with the particular serial number, the plurality of input variables including
a direct feature input variable that includes a first count corresponding to a number of the plurality of activation events that occur during the period of time and that are characterized by a first one of the characteristic parameters, and
a sparse input variable that includes a second count corresponding to a number of the plurality of activation events in the sparse subset that occur during the period of time and that are characterized by a second one of the characteristic parameters;
providing the direct feature input variable and the sparse input variable as inputs to a neural network;
generating, using the neural network, a leakage probability for the particular serial number;
in response to the leakage probability being above a threshold probability, generating an alert indicating that the leakage probability is above the threshold probability; and
in response to the leakage probability being above the threshold probability, causing additional activation requests made using the particular serial number to be rejected.

2. The method of claim 1 , further comprising generating a report that includes at least the leakage probability and a date corresponding to when the leakage probability was generated.

3. The method of claim 1 , wherein the plurality of input variables includes one or more of:
a number of unique machines that received at least one of the plurality of activation events,
a number of unique cities where at least one of the plurality of activation events occurred,
a number of unique countries where at least one of the plurality of activation events occurred,
a number of unique IP addresses associated with at least one of the plurality of activation events, or
a number of machines on average per each of the unique IP addresses.

4. The method of claim 1 , further comprising identifying the sparse subset by identifying activation events occurring in a city where a total number of activation events from the city is less than a threshold percentage of a total number of the plurality of activation events.

5. The method of claim 1 , wherein generating the plurality of input variables comprises generating an unlikely country variable by:
identifying a plurality of countries where the activation events occurred; and
setting the unlikely country variable to a number of the one or more second countries having a country affinity score below an affinity threshold.

6. The method of claim 1 , wherein the plurality of input variables includes a total count of bad machine identifiers, and wherein generating the plurality of input variables comprises identifying the total count of bad machine identifiers, each of the bad machine identifiers representing a machine that is known to have been associated with a given number of other leaked serial numbers.

7. The method of claim 1 , wherein the plurality of activation events is a first plurality of activation events, the period of time is a first period of time, the plurality of input variables is a first plurality of input variables, and the leakage probability is a first leakage probability associated with the first period of time, the method further comprising:
identifying the plurality of characteristic parameters for the particular serial number for a second plurality of activation events that occur over a second period of time that is after, and does not overlap with, the first period of time;
generating a second plurality of input variables associated with the particular serial number, the second plurality of input variables including
a third input variable that includes a third count corresponding to a number of the second plurality of activation events that occur during the second period of time and that are characterized by a third one of the characteristic parameters, and
a fourth input variable that includes a fourth count corresponding to a number of the second plurality of activation events that occur during the second period of time and that are characterized by a fourth one of the characteristic parameters;
providing the first plurality of input variables and the second plurality of input variables to the neural network;
generating, using the neural network, a second leakage probability for the particular serial number; and
in response to a difference between the second leakage probability and the first leakage probability being above a difference threshold, generating an alert indicating that the difference between the second leakage probability and the first leakage probability is above the difference threshold.

8. A system configured to identify a leaked serial number associated with a software product, the system comprising:
a non-transitory computer readable medium;
at least one processor;
an event collection module, stored in the non-transitory computer readable medium, executable by the at least one processor, and configured to
receive data characterizing a plurality of activation events, wherein each activation event corresponds to a software activation request using a particular serial number, and
identify a plurality of characteristic parameters for each of the activation events that occur over a period of time, wherein each of the characteristic parameters characterizes an aspect of one or more of the activation events;
a variable generation module, stored in the non-transitory computer readable medium, executable by the at least one processor, and configured to
determine one or more country affinity scores between a first country and one or more second countries by determining, for each of the one or more second countries, a total number of unique serial numbers used in both the first country and the second country, divided by a total number of unique serial numbers used in the first country but not in the second country,
identify a threshold quantity of the plurality of activation events that are characterized by a particular characteristic parameter,
identify a sparse subset of the plurality of activation events, wherein the sparse subset includes a quantity of infrequent activation events that (a) occur during the period of time, and (b) are characterized by the particular characteristic parameter, wherein the quantity of infrequent ac

Assignees

• Adobe Inc

Inventors

• Goyal Sachin
• Agarwal Harsh
• Thomas Cyril

Classifications

• G06F21/12 Primary

  Protecting executable software · CPC title

• G06F21/16

  Program or content traceability, e.g. by watermarking · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• G06F21/107

  License processing; Key processing · CPC title