# US 11,444,972 B2 · Systems and methods for analyzing network data to identify human and non-human users in network communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,972 B2 - Document ID: US11444972B2 - Status: Granted - Kind: B2 - Application number: 16/740,098 - Filed: 2020-01-10 - Published: 2020-05-14 - Granted: 2022-09-13 - Earliest claimed: 2017-05-24 - Assignees: Yahoo Assets LLC - Applicants: Yahoo Assets LLC - Inventors: Donald J. McQueen; Lachlan A. Maxwell; William C. Wakefield, III - Web page: https://patentgrep.com/patent/US11444972B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 2221/2133: Verifying human interaction, e.g., Captcha - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are disclosed for identifying human users on a network. One method includes receiving network data comprising data transmitted over a network over predetermined time period, the network data comprising a plurality of usernames and a plurality of events, wherein each of the plurality of events is associated with at least one of the plurality of usernames; determining a plurality of pairs, each pair of the plurality of pairs comprising a username of the plurality of usernames and an associated event of the plurality of events; determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more predetermined event frequency thresholds; determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more predetermined event frequency thresholds; generating at least one distribution associated with the qualifying pairs and non-qualifying pairs; and based on the at least one distribution, determining if at least one username of the plurality of usernames is associated with a human user or a non-human user. ## Claims ### Claim 1 A computer-implemented method for identifying human users on a network, comprising: receiving network data comprising data transmitted over a network over a predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events; determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of the plurality of user-initiated events and an associated network address of the plurality of network addresses; determining one or more event frequency thresholds, the frequency thresholds based on the user-initiated events and the plurality of network addresses providing an indicia that a user is human; determining one or more consistency thresholds based on success and failure rates of the user-initiated events and the plurality of network addresses; determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more event frequency thresholds or one or more consistency thresholds; determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more event frequency thresholds or one or more consistency thresholds; generating at least a first distribution associated with the qualifying pairs and a second distribution associated with the non-qualifying pairs; based on at least the first distribution and the second distribution, determining if at least one user-initiated event of the plurality of user-initiated events is associated with a human user or a non-human user; and based on an indicia that at least one user-initiated event of the plurality of user-initiated events is associated with a non-human user, but should be associated with a human user, adjusting the event frequency threshold. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of network addresses comprises a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event of the plurality of user-initiated events, and further comprising: determine if the at least one user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the plurality of user-initiated events. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining an indicia that a user is human is based on a user's address book. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving additional network data associated with a plurality of known human users; and determining at least one of the event frequency thresholds based, at least in part, on the plurality of known human users. ### Claim 5 (depends on 1) The method of claim 1, further comprising: associating, for the plurality of user-initiated events, a plurality of booleans with the one or more event frequency thresholds; determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more event frequency thresholds are met or exceeded; and determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon at least the first and second distributions. ### Claim 6 (depends on 5) The method of claim 5, further comprising: determining at least one uncertain user-initiated event of the plurality of user-initiated events that neither meets criteria for being associated with a human user or a non-human user; adjusting the one or more event frequency thresholds; and determining if the at least one uncertain user-initiated event is associated with a human user or a non-human user based upon the adjusted event frequency thresholds. ### Claim 7 (depends on 1) The method of claim 1, further comprising: generating pairs of user-initiated events from the plurality of user-initiated events; determining communications between user-initiated events associated with each of the pairs of user-initiated events; and labeling the plurality of user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events. ### Claim 8 A system for identifying human users on a network, the system including: a data storage device that stores instructions for identifying human users on a network; and a processor configured to execute the instructions to perform a method including: receiving network data comprising data transmitted over a network over a predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events; determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of the plurality of user-initiated events and an associated network address of the plurality of network addresses; determining one or more event frequency thresholds, the frequency thresholds based on the user-initiated events and the plurality of network addresses providing an indicia that a user is human; determining one or more consistency thresholds based on success and failure rates of the user-initiated events and the plurality of network addresses; determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more event frequency thresholds or one or more consistency thresholds; determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more event frequency thresholds or one or more consistency thresholds; generating at least a first distribution associated with the qualifying pairs and a second distribution associated with the non-qualifying pairs; based on at least the first distribution and the second distribution, determining if at least one user-initiated event of the plurality of user-initiated events is associated with a human user or a non-human user; and based on an indicia that at least one user-initiated event of the plurality of user-initiated events is associated with a non-human user, but should be associated with a human user, adjusting the event frequency threshold. ### Claim 9 (depends on 8) The system of claim 8, wherein the plurality of network addresses comprises a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event of the plurality of user-initiated events, and the method further comprising: determine if the at least one user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the plurality of user-initiated events. ### Claim 10 (depends on 8) The system of claim 8, the method further comprising: determining an indicia that a user is human is at based on a user's address book. ### Claim 11 (depends on 8) The system of claim 8, the method further comprising: receiving additional network data associated with a plurality of known human users; and determining at least one of the event frequency thresholds based, at least in part, on the plurality of known human users. ### Claim 12 (depends on 8) The system of claim 8, the method further comprising: associating, for the plurality of user-initiated events, a plurality of booleans with the one or more event frequency thresholds; determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more event frequency thresholds are met or exceeded; and determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon at least the first and second distributions. ### Claim 13 (depends on 12) The system of claim 12, the method further comprising: determining at least one uncertain user-initiated event of the plurality of user-initiated events that neither meets criteria for being associated with a human user or a non-human user; adjusting the one or more event frequency thresholds; and determining if the at least one uncertain user-initiated event is associated with a human user or a non-human user based upon the adjusted event frequency thresholds. ### Claim 14 (depends on 8) The system of claim 8, the method further comprising: generating pairs of user-initiated events from the plurality of user-initiated events; determining communications between user-initiated events associated with each of the pairs of user-initiated events; and labeling the plurality of user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events. ### Claim 15 A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for identifying human users on a network, the method including: receiving network data comprising data transmitted over a network over a predetermined time period, the network data comprising a plurality of user-initiated events and a plurality of network addresses, wherein each of the plurality of network addresses is associated with at least one of the plurality of user-initiated events; determining a plurality of pairs, each pair of the plurality of pairs comprising a user-initiated event of the plurality of user-initiated events and an associated network address of the plurality of network addresses; determining one or more event frequency thresholds, the frequency thresholds based on the user-initiated events and the plurality of network addresses providing an indicia that a user is human; determining one or more consistency thresholds based on success and failure rates of the user-initiated events and the plurality of network addresses; determining qualifying pairs of the plurality of pairs, the qualifying pairs corresponding to a subset of the plurality of pairs that meet or exceed one or more event frequency thresholds or one or more consistency thresholds; determining non-qualifying pairs of the plurality of pairs, the non-qualifying pairs corresponding to the subset of the plurality of pairs that do not meet or exceed one or more event frequency thresholds or one or more consistency thresholds; generating at least a first distribution associated with the qualifying pairs and a second distribution associated with the non-qualifying pairs; based on at least the first distribution and the second distribution, determining if at least one user-initiated event of the plurality of user-initiated events is associated with a human user or a non-human user; and based on an indicia that at least one user-initiated event of the plurality of user-initiated events is associated with a non-human user, but should be associated with a human user, adjusting the event frequency threshold. ### Claim 16 (depends on 15) The computer-readable medium of claim 15, wherein the plurality of network addresses comprises a number of successful login attempts and/or a number of failed login attempts associated with each user-initiated event of the plurality of user-initiated events, and the method further comprising: determine if the at least one user-initiated event is associated with a human user or a non-human user based upon the number of successful login attempts and the number of failed login attempts for each of the plurality of user-initiated events. ### Claim 17 (depends on 15) The computer-readable medium of claim 15, the method further comprising: receiving additional network data associated with a plurality of known human users; and determining at least one of the event frequency thresholds based, at least in part, on the plurality of known human users. ### Claim 18 (depends on 15) The computer-readable medium of claim 15, the method further comprising: associating, for the plurality of user-initiated events, a plurality of booleans with the one or more event frequency thresholds; determining, for each of the plurality of user-initiated events, whether at least one of the plurality of booleans is true or false based upon whether any of the one or more event frequency thresholds are met or exceeded; and determining if each of the plurality of user-initiated events is associated with a human user or a non-human user based upon whether each of the plurality of booleans is true or false and based upon at least the first and second distributions. ### Claim 19 (depends on 18) The computer-readable medium of claim 18, the method further comprising: determining at least one uncertain user-initiated event of the plurality of user-initiated events that neither meets criteria for being associated with a human user or a non-human user; adjusting the one or more event frequency thresholds; and determining if the at least one uncertain user-initiated event is associated with a human user or a non-human user based upon the adjusted event frequency thresholds. ### Claim 20 (depends on 15) The computer-readable medium of claim 15, the method further comprising: generating pairs of user-initiated events from the plurality of user-initiated events; determining communications between user-initiated events associated with each of the pairs of user-initiated events; and labeling the plurality of user-initiated events as trusted or untrusted based upon the communications between user-initiated events associated with each of the pairs of user-initiated events.