# US 2019/0173905 A1 · Method and apparatus for identifying fake traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173905 A1
- Document ID: US20190173905A1
- Status: Published application
- Kind: A1
- Application number: 16/271,654
- Filed: 2019-02-08
- Published: 2019-06-06
- Earliest claimed: 2016-08-08
- Assignees: Alibaba Group Holding Limited
- Applicants: Alibaba Group Holding Limited
- Inventors: Peng WANG; Zhongyao WANG; Xiaoxiao XU
- Web page: https://patentgrep.com/patent/US20190173905A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06N 20/00: Machine learning
- H04L 43/062: related to network traffic
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/102: {Entity profiles}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Embodiments of the disclosure provide methods and apparatuses for identifying fake traffic. The method can includes: collecting access traffic data of network traffic; generating feature data of the access traffic data; and sending the feature data to a server for identifying fake traffic in accordance with the feature data.

## Claims

### Claim 1

A method for identifying fake traffic, comprising:
collecting access traffic data of network traffic;
generating feature data of the access traffic data; and
sending the feature data to a server for identifying fake traffic in accordance with the feature data.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining a subset of feature data based on the feature data;
determining a rule corresponding to the subset of feature data;
obtaining a first identification result of the access traffic data according to the subset of feature data and the rule; and
performing an access traffic control on the network traffic in response to the first identification result indicating fake traffic.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving, from the server, a second identification result;
determining whether the second identification result indicates the access traffic is fake traffic; and
releasing the access traffic control of the access traffic in response to a determination of the access traffic not being fake traffic.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
adjusting the rule corresponding to the subset of feature data in response to a determination of the access traffic not being fake traffic.

### Claim 5 (depends on 2)

The method of claim 2, wherein the rule comprises: a threshold range corresponding to the subset of feature data and a feature parameter.

### Claim 6 (depends on 2)

The method of claim 2, further comprising:
sending the first identification result to the server in response to the first identification result indicating fake traffic.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
training a machine learning model off-line by using prior traffic data determined as fake traffic and feature data of the prior traffic data.

### Claim 8 (depends on 1)

The method of claim 1, wherein the collected access traffic data comprises at least one of contents of an accessed website, means utilized to access the website, or user access habit data.

### Claim 9 (depends on 8)

The method of claim 8, wherein
the contents of the accessed website by a user comprises at least one of a number of accessed pages and a number of page turning during a predetermined time period;
the means utilized to access the website comprises an IP (Internet Protocol) address, an MAC (Media Access Control) address, a WIFI (Wireless Fidelity) name, a WIFI MAC address, a Session identity (ID), or a login ID; and
the user access habit data comprises at least one of time periods during which the user accesses different types of pages, an average value of page access durations, and a variance of the page access durations.

### Claim at position 10

10-15. (canceled)

### Claim 16

An apparatus comprising:
a memory storing a set of instructions; and
at least one processor configured to execute the set of instructions to perform:
collecting access traffic data of network traffic;
generating feature data of the access traffic data; and
sending the feature data to a server for identifying fake traffic in accordance with the feature data.

### Claim 17

(canceled)

### Claim 18

A non-transitory computer readable medium that stores a set of instructions that is executable by at least one processor of a client terminal to cause the client terminal to perform a method for identifying fake traffic, the method comprising:
collecting access traffic data of access traffic;
generating feature data of the network access traffic data; and
sending the feature data to a server for identifying fake traffic in accordance with the feature data.

### Claim 19 (depends on 18)

The non-transitory computer readable medium of claim 18, wherein the set of instructions is executable by the at least one processor of the client terminal to cause the client terminal to further perform:
determining a subset of feature data based on the feature data;
determining a rule corresponding to the subset of feature data;
obtaining a first identification result of the access traffic data according to the subset of feature data and the rule; and
performing an access traffic control on the network traffic in response to the first identification result indicating fake traffic.

### Claim 20 (depends on 19)

The non-transitory computer readable medium of claim 19, wherein the set of instructions is executable by the at least one processor of the client terminal to cause the client terminal to further perform:
receiving, from the server, a second identification result;
determining whether the second identification result indicates the access traffic is fake traffic; and
releasing the access traffic control of the access traffic in response to a determination of the access traffic not being fake traffic.

### Claim 21 (depends on 20)

The non-transitory computer readable medium of claim 20, wherein in response to the determination of access traffic being not fake traffic, the set of instructions is executable by the at least one processor of the client terminal to cause the client terminal to further perform:
adjusting the rule corresponding to the subset of feature data.

### Claim 22 (depends on 19)

The non-transitory computer readable medium of claim 19, wherein the rule comprises: a threshold range corresponding to the subset of feature data and a feature parameter.

### Claim 23 (depends on 19)

The non-transitory computer readable medium of claim 19, wherein in response to the first identification result indicating fake traffic, the set of instructions is executable by the at least one processor of the client terminal to cause the client terminal to further perform:
sending the client identification result to the server.

### Claim 24 (depends on 20)

The non-transitory computer readable medium of claim 20, wherein the set of instructions is executable by the at least one processor of the client terminal to cause the client terminal to further perform:
training a machine learning model off-line by using prior traffic data determined as fake traffic and feature data of the prior traffic data.

### Claim 25 (depends on 18)

The non-transitory computer readable medium of claim 18, wherein the collected access traffic data comprises at least one of contents of an accessed website, means utilized to access the website, or user access habit data.

### Claim 26 (depends on 25)

The non-transitory computer readable medium of claim 25, wherein
the contents of the accessed website by a user comprises at least one of a number of accessed pages and a number of page turning during a predetermined time period;
the means utilized to access the website comprises an IP (Internet Protocol) address, an MAC (Media Access Control) address, a WIFI (Wireless Fidelity) name, a WIFI MAC address, a Session identity (ID), or a login ID; and
the user access habit data comprises at least one of time periods during which the user accesses different types of pages, an average value of page access durations, and a variance of the page access durations.

### Claim at position 22

27-32. (canceled)