Data transfer for network interaction fraudulence detection

Patent metadata

Field	Value
Publication number	US-9729563-B2
Application number	US-201614987169-A
Country	US
Kind code	B2
Filing date	Jan 4, 2016
Priority date	Mar 22, 2007
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

Transferring metadata is disclosed. Information about a network interaction is processed to generate metadata describing the network interaction. Based on the metadata it is determined whether the metadata is to be transferred to an aggregator. In the event that the metadata is to be transferred, one or more aggregators are determined to which the metadata is to be transferred. The metadata is transferred to the one or more aggregators.

First claim

What is claimed is:

1. A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to perform operations comprising:
processing information about a network interaction to generate metadata describing the network interaction;
detecting a fraudulent interaction corresponding to the network interaction based on determining the metadata indicates at least one of:
a source internet protocol (IP) address has been involved with spam;
a source IP address is not available for tracing;
a session user visited a predetermined number of sites without a conversion;
a spacing between clicks has the same timing;
a source IP address has recently sent a predetermined number of spam or phishing emails;
a source IP address cannot be located with a probe within a predetermined amount of time; or
a predetermined number of network interactions within a predetermined amount of time have the same source IP address;

determining to transfer the metadata to an aggregator based on detecting the fraudulent interaction; and
transferring the metadata to the aggregator.

2. The system of claim 1 , wherein the aggregator is a first aggregator in a first layer of a tiered set of aggregators.

3. The system of claim 2 , wherein the aggregator is one or more of a local aggregator, a regional aggregator, a country aggregator, an organizational aggregator, or a segment aggregator.

4. The system of claim 2 , wherein the aggregator aggregates metadata received from a plurality of user computer devices.

5. The system of claim 4 , wherein the aggregator transmits aggregated metadata to an aggregator in a second layer of the tiered set of aggregators.

6. The system of claim 5 , wherein the aggregator in the second layer is a centralized aggregator.

7. The system of claim 4 , wherein the aggregator transmits aggregated metadata to a peer aggregator in the first layer of the tiered set of aggregators.

8. The system of claim 1 , wherein the aggregator calculates a red alert based at least on the metadata that is transferred.

9. A method, comprising:
processing information about a network interaction to generate metadata describing the network interaction;
detecting a fraudulent interaction corresponding to the network interaction based on determining the metadata indicates at least one of:
a source internet protocol (IP) address has been involved with spam;
a source IP address is not available for tracing;
a session user visited a predetermined number of sites without a conversion;
a spacing between clicks has the same timing;
a source IP address has recently sent a predetermined number of spam or phishing emails;
a source IP address cannot be located with a probe within a predetermined amount of time; or
a predetermined number of network interactions within a predetermined amount of time have the same source IP address;

determining to transfer the metadata to an aggregator based on detecting the fraudulent interaction; and
transferring the metadata to the aggregator.

10. The method of claim 9 , wherein the aggregator is a first aggregator in a first layer of a tiered set of aggregators.

11. The method of claim 10 , wherein the aggregator is one or more of a local aggregator, a regional aggregator, a country aggregator, an organizational aggregator, or a segment aggregator.

12. The method of claim 10 , wherein the aggregator aggregates metadata received from a plurality of user computer devices.

13. The method of claim 12 , wherein the aggregator transmits aggregated metadata to an aggregator in a second layer of the tiered set of aggregators.

14. The method of claim 13 , wherein the aggregator in the second layer is a centralized aggregator.

15. The method of claim 12 , wherein the aggregator transmits aggregated metadata to a peer aggregator in the first layer of the tiered set of aggregators.

16. The method of claim 9 , wherein the aggregator calculates a red alert based at least on the metadata that is transferred.

17. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor of a computing system, cause the computing system to perform a method, comprising:
processing information about a network interaction to generate metadata describing the network interaction;
detecting a fraudulent interaction corresponding to the network interaction based on determining the metadata indicates at least one of:
a source internet protocol (IP) address has been involved with spam;
a source IP address is not available for tracing;
a session user visited a predetermined number of sites without a conversion;
a spacing between clicks has the same timing;
a source IP address has recently sent a predetermined number of spam or phishing emails;
a source IP address cannot be located with a probe within a predetermined amount of time; or
a predetermined number of network interactions within a predetermined amount of time have the same source IP address;

determining to transfer the metadata to an aggregator based on detecting the fraudulent interaction; and
transferring the metadata to the aggregator.

18. The non-transitory computer-readable medium of claim 17 , wherein the aggregator is a first aggregator in a first layer of a tiered set of aggregators.

19. The non-transitory computer-readable medium of claim 18 , wherein the aggregator transmits aggregated metadata to a centralized aggregator in a second layer of the tiered set of aggregators.

20. The non-transitory computer-readable medium of claim 17 , wherein the aggregator calculates a red alert based at least on the metadata that is transferred.

Assignees

• Comscore Inc

Inventors

• Pitkow Jim
• Chelliah Raman
• Brown Marc

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title