Network interaction monitoring appliance

Patent metadata

Field	Value
Publication number	US-9412111-B2
Application number	US-201514665723-A
Country	US
Kind code	B2
Filing date	Mar 23, 2015
Priority date	Dec 15, 2006
Publication date	Aug 9, 2016
Grant date	Aug 9, 2016

Abstract

An appliance for analyzing a network interaction is disclosed. The appliance includes an input to monitor network traffic that includes a network interaction without interfering with the network traffic. The appliance further includes a processor to analyze network traffic to derive information about the network interaction wherein the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, at an edge appliance, a network interaction model from a model server, wherein the edge appliance is configured to monitor network traffic corresponding to a server;
monitoring, at the edge appliance, the network traffic corresponding to the server;
capturing information associated with one or more network interactions corresponding to the server;
analyzing the information associated with the one or more network interactions using the network interaction model;
determining, at the edge appliance, a preliminary score of the one or more network interactions based on the analyzing; and
transmitting the preliminary score to an analytics server that is separate from the edge appliance, wherein the analytics server determines a final score of the one or more network interactions.

2. The method of claim 1 , wherein monitoring the network traffic corresponding to the server comprises sniffing network traffic packets.

3. The method of claim 1 , wherein monitoring the network traffic corresponding to the server comprises receiving the network traffic and forwarding the network traffic to the server.

4. The method of claim 1 , wherein monitoring the network traffic corresponding to the server comprises receiving the network traffic from the server and forwarding the network traffic.

5. The method of claim 1 , wherein transmitting the preliminary score to the analytics server comprises transmitting the preliminary score to the model server, whereby the model server forwards the preliminary score to the analytics server.

6. The method of claim 1 , wherein:
the edge appliance monitors network traffic on a local network that is separated from other networks by a firewall; and
the server is connected to the local network.

7. The method of claim 1 , wherein the network interaction model is used to determine an aggregation point, wherein the aggregation point is common to a plurality of network interactions.

8. The method of claim 1 , wherein the aggregation point is one of a group consisting of: a router; an internet protocol address; a network node; or an internet service provider.

9. The method of claim 1 , wherein the edge appliance is operated by a third party entity, wherein the third party entity is not affiliated with a web site corresponding to the network traffic, an advertising network corresponding to the network traffic, or an advertiser corresponding to the network traffic.

10. The method of claim 1 , wherein the analytics server determines the final score of the one or more network interactions using the preliminary score.

11. A system, comprising:
a processing system comprising one or more processors; and
a memory system comprising one or more computer-readable non-transitory media, wherein the one or more computer-readable non-transitory media contain instructions stored thereon that, when executed by the processing system, cause the processing system to perform operations comprising:
receiving, at an edge appliance, a network interaction model from a model server, wherein the edge appliance is configured to monitor network traffic corresponding to a server;
monitoring, at the edge appliance, the network traffic corresponding to the server;
capturing information associated with one or more network interactions corresponding to the server;
analyzing the information associated with the one or more network interactions using the network interaction model;
determining, at the edge appliance, a preliminary score of the one or more network interactions based on the analyzing; and
transmitting the preliminary score to an analytics server that is separate from the edge appliance, wherein the analytics server determines a final score of the one or more network interactions.

12. The system of claim 11 , wherein monitoring the network traffic corresponding to the server comprises sniffing network traffic packets.

13. The system of claim 11 , wherein monitoring the network traffic corresponding to the server comprises receiving the network traffic and forwarding the network traffic to the server.

14. The system of claim 11 , wherein monitoring the network traffic corresponding to the server comprises receiving the network traffic from the server and forwarding the network traffic.

15. The system of claim 11 , wherein transmitting the preliminary score to the analytics server comprises transmitting the preliminary score to the model server, whereby the model server forwards the preliminary score to the analytics server.

16. The system of claim 11 , wherein:
the edge appliance monitors network traffic on a local network that is separated from other networks by a firewall; and
the server is connected to the local network.

17. The system of claim 11 , wherein the network interaction model is used to determine an aggregation point, wherein the aggregation point is common to a plurality of network interactions.

18. The system of claim 11 , wherein the aggregation point is one of a group consisting of: a router; an internet protocol address; a network node; or an internet service provider.

19. The system of claim 11 , wherein the edge appliance is operated by a third party entity, wherein the third party entity is not affiliated with a web site corresponding to the network traffic, an advertising network corresponding to the network traffic, or an advertiser corresponding to the network traffic.

20. A non-transitory computer readable storage medium comprising instructions which, when executed, cause a processor to perform a method comprising:
receiving, at an edge appliance, a network interaction model from a model server, wherein the edge appliance is configured to monitor network traffic corresponding to a server;
monitoring, at the edge appliance, the network traffic corresponding to the server;
capturing information associated with one or more network interactions corresponding to the server;
analyzing the information associated with the one or more network interactions using the network interaction model;
determining, at the edge appliance, a preliminary score of the one or more network interactions based on the analyzing; and

transmitting the preliminary score to an analytics server that is separate from the edge appliance, wherein the analytics server determines a final score of the one or more network interactions.

Assignees

• Comscore Inc

Inventors

• Pitkow Jim
• Chelliah Raman
• Brown Marc

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06Q30/0185 Primary

  Product, service or business identity fraud · CPC title

• H04L43/00

  Arrangements for monitoring or testing data switching networks · CPC title

• H04L29/06

  Electricity · mapped topic

• H04L67/22

  Electricity · mapped topic