US 2016/0366168 A1 · ABUSIVE TRAFFIC DETECTION

Abstract

Aspects of an abuse detection system for a web service include an abuse detection engine executing on a server. The abuse detection engine includes a pre-processing module for aggregating a data set for processing and analysis; a suspiciousness test module for identifying suspicious content owners and suspicious users; a graphing module for finding connections between suspicious content owners and suspicious users; an analysis module for determining which groups are constituted of fraudulent or abusive accounts; and a notification generation and output module for generating a list of abusive entities and a notification for output to at least one of: the abusive entity, a digital content distribution company associated with the abusive entity, and a legal department or other entity for further investigation or action. Additionally, royalties for content consumptions associated with abusive accounts may be held. Aspects of an abusive traffic detection method enable multi-account and multi-content owner fraud detection.

Claims20

Dependent claims

A method of detecting abusive traffic on a web service, the method comprising:

aggregating a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records associated with consumption of digital content via the web service, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;
identifying one or more suspicious content owners, wherein the content owners are owners of digital content accessible via the web service;
identifying one or more suspicious content users, wherein the content users are consumers of digital content via the web service;
grouping at least one of the one or more suspicious content owners and at least one of the one or more suspicious content users into a group;
analyzing the group for determining whether the at least one suspicious content owner and the at least one suspicious content user constitute an abusive entity;
and
in response to a positive determination, generating a notification including the at least one suspicious content owner and the at least one suspicious content user.

4 more elements

A computing device for detecting abusive traffic on a web service, the computing device comprising:

a processor, a memory, and an output device for presenting a visual output to a user, the visual output comprising the user interface of an application, the computing device operable to:
aggregate a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records associated with consumption of digital content via the web service within a predetermined time period, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;
identify one or more suspicious content owners, wherein the content owners are owners of digital content accessible via the web service;
identify one or more suspicious content users, wherein the content users are consumers of digital content via the web service;
group at least one of the one or more suspicious content owners and at least one of the one or more suspicious content users into a group;
analyze the group for determining whether the at least one suspicious content owner and the at least one suspicious content user constitute an abusive entity;
and
in response to a positive determination, generating a notification including the at least one suspicious content owner and the at least one suspicious content user.

5 more elements

A computer readable medium containing computer executable instructions which, when executed by a computer, perform a method for detecting abusive traffic on a web service, the method comprising:

aggregating a set of consumption data, the aggregated set of consumption data including a list of one or more consumption records associated with consumption of digital content via the web service within a defined time period, the one or more consumption records comprising a content owner, a content user, and a date of the consumption;
identifying one or more suspicious content owners, wherein the content owners are owners of digital content accessible via the web service and wherein identifying one or more suspicious content owners comprises:
generating a list of a plurality of top users of the web service from the aggregated set of consumption data;
identifying a plurality of content owners associated with content consumed by the plurality of top users;
for each of the plurality of content owners associated with content consumed by the plurality of top users, computing a ratio comparing consumption of content associated with the content owner by the plurality of top users to consumption of content associated with the content owner by all users in the aggregated set of consumption data;
determining whether the ratio is above a threshold value;
and
in response to a positive determination, determining the content owner is a suspicious content owner;
identifying one or more suspicious content users, wherein the content users are consumers of digital content via the web service and wherein identifying one or more suspicious content users comprises:
generating a list of active users from the aggregated set of consumption data;
for each active user in the list, identifying a predetermined number of top content owners, wherein the predetermined number of top content owners are the content owners associated with content most consumed by the active user;
determining whether the predetermined number of top content owners includes a suspicious content owner of the one or more suspicious content owners;
in response to a positive determination, identifying a number of consumptions of content associated with the suspicious content owner;
determining whether the number of consumptions is above a threshold value;
and
in response to a positive determination, determining the content user is a suspicious content user;
grouping at least one of the one or more suspicious content owners and at least one of the one or more suspicious content users into a group;
analyzing the group for determining whether the at least one suspicious content owner and the at least one suspicious content user constitute an abusive entity;
and
in response to a positive determination, generating a notification including the at least one suspicious content owner and the at least one suspicious content user.

17 more elements

Dependencies are inferred from the claim text.

Abusive traffic detection

Life of this patent

Abusive traffic detection

Life of this patent

Abstract

Claims20