# US 10,375,194 B2 · Methods and apparatus to prevent illicit proxy communications from affecting a monitoring result > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,194 B2 - Document ID: US10375194B2 - Status: Granted - Kind: B2 - Application number: 14/928,610 - Filed: 2015-10-30 - Published: 2017-05-04 - Granted: 2019-08-06 - Earliest claimed: 2015-10-30 - Assignees: The Nielsen Company (US), LLC - Applicants: The Nielsen Company (US), LLC - Inventors: Susan Cimino; Achilleas Papakostas - Web page: https://patentgrep.com/patent/US10375194B2 ## CPC - H04L 67/563: Data redirection of data network streams - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 2101/695: using masks or ranges of addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, apparatus, systems and articles of manufacture to prevent illicit proxy communications from affecting a monitoring result are disclosed. An example method includes accessing a log of communications from a proxy. A subnet represented in the log of communications is identified. The subnet is identified as having originated an illicit network communication if the log of communications does not include at least one record matching a signature of a mobile device heartbeat originating from the subnet. A blacklist of subnets not to be serviced by the proxy is generated, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication. The blacklist is provided to the proxy. The blacklist is to prevent a subnet that originated the illicit network communication from affecting the monitoring result. ## Claims ### Claim 1 A method to prevent illicit network communications from affecting a monitoring result of an audience measurement entity, the method comprising: accessing, at the audience measurement entity, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider; identifying a subnet represented in the log of communications; identifying, with a processor, the subnet as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device; generating a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication; and providing the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting the monitoring result of the audience measurement entity. ### Claim 2 (depends on 1) The method as disclosed in claim 1, wherein the identifying of the subnet as having originated the illicit network communication includes identifying that there are at least a threshold number of records originating from the subnet in the log of communications. ### Claim 3 (depends on 1) The method as disclosed in claim 1, further including: determining whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet; and alerting an administrator of the subnet for manual inclusion in the blacklist. ### Claim 4 (depends on 1) The method as disclosed in claim 1, further including: determining whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet; and alerting an administrator of the subnet for manual inclusion in the blacklist. ### Claim 5 (depends on 1) The method as disclosed in claim 1, further including: excluding, with the processor, records from the log of communications associated with the subnet to form a log of legitimate communications; and processing the log of legitimate communications to credit usage of mobile computing devices. ### Claim 6 (depends on 1) The method as disclosed in claim 1, wherein the log of communications is a current log of communications, and the blacklist includes the subnet when the subnet was identified as having originated illicit network communications in a prior log of communications from the proxy. ### Claim 7 (depends on 6) The method as disclosed in claim 6, wherein the prior log of communications corresponds to a first period of time immediately preceding a second period of time corresponding to the current log of communications from the proxy. ### Claim 8 (depends on 1) The method as disclosed in claim 1, wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time. ### Claim 9 An apparatus to prevent illicit network communications from affecting a monitoring result of an audience measurement entity, the apparatus comprising: a hardware logic circuit; a proxy log filterer to access, at the audience measurement entity, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider; a heartbeat detector to identify a subnet within the log of communications as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device; and a blacklist generator to generate a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication, the blacklist generator to provide the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting the monitoring result of the audience measurement entity, wherein at least one of the proxy log filterer, the heartbeat detector, or the blacklist generator is implemented via the hardware logic circuit. ### Claim 10 (depends on 9) The apparatus as disclosed in claim 9, further including a crediting processor to generate the monitoring result using a subsequent log of communications created by the proxy, the subsequent log of communications excluding communications from the subnet identified in the blacklist. ### Claim 11 (depends on 9) The apparatus as disclosed in claim 9, further including a proxy log parser to determine whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet, the proxy log parser to identify the subnet to an administrator when there are less than the threshold number of unique user agents identified by the records of the log of communications associated with the subnet. ### Claim 12 (depends on 9) The apparatus as disclosed in claim 9, further including a proxy log parser to determine whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet, the proxy log parser to identify the subnet to an administrator when there are greater than the threshold number of ports identified by the records of the log of communications associated with the subnet. ### Claim 13 (depends on 9) The apparatus as disclosed in claim 9, wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time. ### Claim 14 A non-transitory computer-readable medium comprising instructions which, when executed, cause a central facility of an audience measurement entity to at least: access, at the central facility, a log of communications from a proxy, the proxy to transmit a communication between a requesting device and a media provider; identify a subnet represented in the log of communications; identify the subnet as having a first address that originated an illicit network communication if the log of communications does not include at least one signature of a heartbeat message having a second address within the subnet, the heartbeat message identified by at least one of (1) comparing a user agent field of a record associated with the heartbeat message to user agent fields indicative of the record originating from a mobile device or (2) comparing a uniform resource locator field of the record to uniform resource locator fields indicative of the record originating from a mobile device, the heartbeat message associated with communication between the mobile device and a software provider, the illicit network communication indicating the record originated from a non-mobile device; generate a blacklist of subnets not to be serviced by the proxy, the blacklist including the subnet when the subnet is identified as having originated the illicit network communication; and provide the blacklist to the proxy, the blacklist to prevent a subnet that originated the illicit network communication from affecting a monitoring result of the audience measurement entity. ### Claim 15 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the instructions, when executed, further cause the central facility to identify that there are at least a threshold number of records in the log of communications. ### Claim 16 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the instructions, when executed, further cause the central facility to at least: determine whether there are less than a threshold number of unique user agents identified by records of the log of communications associated with the subnet; and alert an administrator of the subnet for manual inclusion in the blacklist. ### Claim 17 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the instructions, when executed, further cause the central facility to at least: determine whether there are greater than a threshold number of ports identified by records of the log of communications associated with the subnet; and alert an administrator of the subnet for manual inclusion in the blacklist. ### Claim 18 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the instructions, when executed, further cause the central facility to at least: exclude records from the log of communications associated with the subnet to form a log of legitimate communications; and process the log of legitimate communications to credit usage of mobile computing devices. ### Claim 19 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the log of communications is a current log of communications, and the blacklist includes the subnet when the subnet was identified as having originated illicit network communications in a prior log of communications from the proxy. ### Claim 20 (depends on 19) The non-transitory computer-readable medium as disclosed in claim 19, wherein the prior log of communications corresponds to a first period of time immediately preceding a second period of time corresponding to the current log of communications from the proxy. ### Claim 21 (depends on 14) The non-transitory computer-readable medium as disclosed in claim 14, wherein the blacklist does not include the subnet when the subnet has not been identified as having originated the illicit network communication for more than a threshold period of time.