Patent Grant
11057408
A portion of the disclosure of this patent document contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
The present disclosure relates generally to the field of data (for example, Internet data or other content) delivery over a network. More particularly, the present disclosure is related in one exemplary aspect to apparatus and methods for modifying services provided to a user or subscriber of a managed network based on online activity associated therewith.
Recent advances in digital information processing and technology have made a range of services and functions available for delivery to consumers at their premises for very reasonable prices or subscription fees. These services and functions include high-speed Internet access, provision of digital content or programming (movies, etc.), digital video-on-demand (VOD), Internet Protocol television (IPTV), and IP-based telephony (e.g., VoIP). Other services available to network users include access to, and recording of, digital music (e.g., MP3 files), as well as local area networking (including wire-line and wireless local area networks) for distributing these services throughout the user's premises, and beyond. Network-delivered or network-based gaming and applications (“apps”) have also each recently come to the forefront as popular content areas for users.
Currently, many of these services are provided and delivered to the users via a wide variety of different equipment environments including, inter alfa, cable modems, Wi-Fi® hubs, Ethernet hubs, gateways, switches and routers, computers, servers, cable or satellite networks and associated set-top boxes.
In providing access to content over digital information sources, a breach in security of a single device may threaten to or may cause actual harm to other devices in the system. One particularly acute problem relates to surreptitious use of so-called “bots” (robots) on client systems throughout a network. Different types of bots exist in data networks such as the Internet, and are often characterized by (unknowing) implantation on a user's device (e.g., PC, laptop, etc.), and subsequent activity under the direction of a remote “command and control” bot. Once implanted on the user's computer or other device (such as via the user opening a Trojan or similar virus file or clicking on a link which causes the download of malicious code), the bot can be subsequently activated by the command and control bot (or even autonomously), and used for surreptitious activity such as advertising fraud, distributed denial of service (DDoS) attacks, etc., all without the user's knowledge. In effect, a “network of bots” distributed across numerous user platforms is created, and when implemented can cause any number of undesirable effects on the network, third party users of the network (e.g., advertisers), and even the users (subscribers) themselves. Such bots are often undetectable via standard anti-virus software, and hence remediation (rather than prevention) is often employed for mitigating the effects of such activity.
One type of bot often seen is the so-called ad bot (advertising bot) that fraudulently activates or clicks on advertising without host (e.g., user computer) knowledge. This activity can, inter alfa, corrupt advertising revenue schemes put in place by the advertiser. For instance, if paying on a “per-click” basis for traffic from users of a given managed network or placement site, one or more bots repetitively clicking on an advertisement will not only skew the data regarding user interest or use in the advertisement, but also potentially cause the advertiser to pay more than they would otherwise due to the malicious activity. Such factors often give advertisers a negative opinion or rating of a given delivery platform (e.g., network), and hence they may avoid further use of that platform in the future. Advertisers need a level of assurance that customers of a given managed network (e.g., cable MSO network) and sites served by that network are free of fraud, since they are ostensibly spending significant sums to have their ads placed in various instances within content or sites operated by that network and accessed by the network's users. In that managed network operators generate significant revenue from third-party advertisers, losing such advertisers due to malicious bot or other infections can be devastating to revenue and profitability.
Likewise, users having computers or other devices connected to the network may experience degradation of performance (in that the bot, when running in the background, is consuming resources of the computer and communications bandwidth), as well as other undesirable effects such as frequent (false) pop-up windows, Internet browser “spoofing” or redirect attacks, and the like, all leading to greatly reduced customer satisfaction.
In that the level of sophistication of such malicious activity has increased over time, it is often not even the user's fault that their machine has become infected with a bot or other malicious code. The differences between legitimate and fraudulent websites, pop-ups, links, etc. are often (intentionally) quite subtle, and tend to spur the user into immediate action so as to ostensibly correct some “glaring” deficiency (e.g., “virus detected—click here to quarantine the virus!”).
Hence, it is a critical goal of service providers to defend themselves as well as their clients (both users and other third parties such as advertisers) against such harmful behavior.
As noted above, remediation of a given user's activity is often times required (e.g., electronically sequestration of their machine, removal of the malicious code, etc.), in that the infection or malicious activity is not detected until well after initial infection and implementation. Signature detection (e.g., classifying a PC or other device as having a bot infection based on evaluation of its activity) and remediation (e.g., communicating to customer that they have infection, and correction/prevention of security breach to enhance network security) are commonly used in such cases, and are known in the prior art. However, such mechanisms are largely reactive, and do little if anything to prevent or mitigate future infections.
Further, such remediation often consumes significant time and resources of the service provider, including potentially (human) technical support and even a “truck roll” (i.e., service call). Such consumption of resources necessarily reduces the service provider's profitability, especially when considered across the millions of users of a typical large managed (e.g., cable or satellite) content delivery network.
Moreover, any attempts at anticipatory or proactive remediation or corrective action under prior art “manual” processing would be so laborious as to make provision of the aforementioned functions practically impossible. Even if such analysis could be performed manually or semi-manually, speed of identification of fraudulent activity and processing (including remediation or implementation of other defensive or anticipatory corrective measures) is often critical, and hence any effective solution is necessarily incompatible with the long delays associated with the primarily manual processing used in the prior art.
Hence, what is needed is a complementary “proactive” approach to mitigating or preventing illicit online activity. Ideally, such methods would provide a dynamic mechanism that could be at least partly employed using computer and networking technologies, so as to enable substantially automated and real-time detection and pre-emptive/corrective action, as well as identification of repeat-offending users or computers (and treatment of such users in a manner commensurate with their potential for infection by malicious code).
The present disclosure addresses the foregoing needs by disclosing, inter alia, apparatus and methods for modifying services based on collected data relating to online activity.
In one aspect of the disclosure, a computerized system for, inter alia, managing network users is disclosed. In one embodiment, the system comprises a database or group of databases comprised of data drawn and aggregated from multiple sources, and one or more algorithms operative to run on a computerized platform (e.g., server) and configured to rate a particular device and/or user's security or trustworthiness.
In one variant, mechanisms are implemented to, based at least on the aforementioned rating, treat a given user or account in a manner differing from other users (e.g., by offering additional services to users and/or devices that have maintained responsible online activity, by causing users who have poor rating to be restricted to types of services that are more resilient to malicious attacks, or even termination of a user as a network subscriber).
In a second aspect, a computerized analytics “engine” is disclosed. In one embodiment, the engine comprises a plurality of computer algorithms operative to run on a computerized platform (e.g., server or server farm) and configured to utilize data from a multi-layer data structure to assess individual ones of users of a service provider network (as well as broader logical groups or aggregations of users). In one variant, the engine is disposed on one or more servers within a managed content delivery network and is operative to execute such that substantially real-time analysis and recommendations can be generated for numerous individual subscribers of the network in parallel.
In a further aspect, a data architecture and corresponding database is disclosed. In one embodiment, the data architecture comprises a multi-layered architecture having at least first, second, third, and fourth logical layers, each of which can both interface with a previous and/or successive logical layer, as well as with external processes or entities. In one variant, each of the layers can at least output information without subsequent processing, and/or pass data on to another layer for subsequent processing, and the first, second, third and fourth layers comprise raw data, data transformation, analytics, and distribution layers, respectively. Data in the raw (or “load”) layer is ingested from any number of data sources internal to the managed network infrastructure or external thereto. Transformation of this raw data (e.g., normalization of formatting, type, etc.) occurs in the subsequent transformation layer processing, while analysis and evaluation of the transformed data is subsequently performed in the analytics layer (e.g., by the aforementioned analytics engine).
In yet another aspect of the disclosure, a method of substantially automatically aggregating and processing data relating to user online activity are disclosed. In one embodiment, the method includes: obtaining data from a plurality of different data sources; pre-processing the data; analyzing the pre-processed data using one or more analytic routines to generate one or more categorizations (e.g., of subscribers within the aforementioned managed network); and post-processing the analyzed data to generate one or more outputs (products).
In one variant of the method, the pre-processing comprises data transformation and normalization, and the post-processing comprises aggregation of individual user data, and partitioning of all or portions of the aggregated data into subsets based on, e.g., geographic region or location, type of illicit online activity or threat, etc.
In a further aspect of the disclosure, a method of substantially automatically generating one or more logical structures relating to user online activity are disclosed. In one embodiment, the method includes: obtaining data from a plurality of different data sources; pre-processing the data; analyzing the pre-processed data using one or more analytic routines to generate one or more categorizations (e.g., of subscribers within the aforementioned managed network); utilizing the results of the analysis to implement one or more logical structures or management plans for pre-emptive or corrective action relating to one or more of the subscribers. In one variant, the logical structures comprise interactive voice response (IVR) and/or human customer service representative (CSR) instructions (the latter implemented e.g., via on-screen instructions provided to the CSR during interaction with a particular subscriber or class of subscriber.
In another variant, the logical structures comprise operational schemes or templates which can be applied to individual users (or classes of users) so as to treat them appropriately given prior (or even ongoing) behavior, such as e.g., modifying their available online services and/or feature set so as to reduce the chance of future undesirable behavior, or alternatively reward them for exemplary online behavior.
In another aspect of the disclosure, a method of operating a service provider network is disclosed. In one embodiment, the method is employed to maximize one or more financial attributes or metrics (e.g. revenue, profitability, etc.), and includes implementation of heterogeneous management plans with respect to respective individual users (or groups of users) served by the network. In one variant, the heterogeneous management plans include: (i) termination of subscription or services; (ii) modification of features or services (e.g., so as to reduce the probability of future undesirable behaviors including infection by malicious code elements); and (iii) rewards or enhancement of features/services for users (or groups of users) who exhibit desirable behavior with respect to online activity.
In yet a further aspect, a method for providing targeted advertising, promotions, or other content is disclosed. In one embodiment, the method includes: correlating network user activity to one or more behaviors; identifying advertising or other content contextually related to the one or more correlated behaviors; and providing the advertising via one or more electronic media to the relevant user(s). In one variant, the advertising is presented to the user in a similar context as the user activity has occurred or is occurring (e.g., online via browser). In another variant, the advertising is provided along with presentation of a user's monthly electronic invoice.
In another aspect of the disclosure, a computer readable apparatus comprising at least one computer program for modifying services based on collected data relating to online activity is disclosed.
In a further aspect, an activity manager collects, analyzes, and generates a plurality of data relating to the online activity of a plurality of client devices in communication therewith. In one embodiment, the activity manager collects raw data from different data sources, e.g., open sources connected to the internet, email services, customer care tools, etc. The activity manager normalizes the raw data to prepare the raw data for correlation with other additional data such as subscriber information. The activity manager may partition the correlated data based on variable partitioning criteria such as locations of subscribers, threat levels, customer types, service types, etc. The activity manager determines a level of illicit online activity associated with each of the plurality of client devices based on the data and enables remediation to be performed and/or alerts or information to be provided to the network, device, and/or user.
In another embodiment, a weighting factor is applied to the individual ones of the plurality of data, e.g., the correlated data. The weighting factor may be provided in advance by a managed network entity. An aggregate score for each user and/or device is generated based on the activity records collected therefrom when weighted using the appropriate weighting factors. In one variant, each user and/or device is associated with a single cumulative score derived from a profile which takes into account both positive and negative activity. Alternatively, each user and/or device may be associated with separate scores derived from a first profile indicative of positive activity and a second profile indicative of negative activity.
In another aspect of the present disclosure, a computer-readable apparatus including a non-transitory storage medium is disclosed. In one embodiment thereof, the non-transitory medium includes a plurality of instructions, the plurality of instructions configured to, when executed on a processing apparatus: pre-process first data, at least portion of the first data obtained from a plurality of different data sources and relating to Internet activity; obtain second data relating to one or more users of a service provider network; correlate at least portions of the second data to at least a portion of the first data in order to derive data representative of at least one metric indicative of a behavior of the one or more users; and generate at least a data structure relating to the at least one metric indicative of the behavior of the one or more users, the data structure relating to the at least one metric useful for automated management of online activity of the one or more users within the service provider network.
In another aspect of the present disclosure, a method performed by processing apparatus of an online service provider for modifying services based on collected data relating to online activity is disclosed. In one embodiment, the method includes: collecting data from a third-party data source; transforming the data into information that is indicative of online activity of a plurality of subscribers; correlating the transformed information with individual ones of the plurality of subscribers of the online service provider; and modifying the services provided to the individual ones of the plurality of subscribers.
In another aspect of the present disclosure, a system for detecting and remediating illicit online activity within a service provider network is disclosed. In one embodiment thereof, the system includes a plurality of client devices, and further includes: an activity manager in communication with the plurality of client devices via one or more service nodes of the network, the activity manager including processing apparatus configured to execute one or more computer programs; and storage apparatus in data communication with the activity manager and including at least one computer program, the at least one computer program configured to, when executed on the processing apparatus: collect first data relating to online activity; identify an illicit online activity associated with at least one of said plurality of client devices based on second data relating particularly to the at least one client device and the collected first data; and in response to said identification of said illicit online activity, cause at least selection and provision of secondary content that is contextually related to the identified activity.
These and other aspects of the disclosure shall become apparent when considered in light of the detailed description provided herein.
All Figures © Copyright 2014-2016 Time Warner Cable Enterprises LLC. All rights reserved.
Reference is now made to the drawings wherein like numerals refer to like parts throughout.
As used herein, the term “application” refers generally to a unit of executable software that implements a certain functionality or theme. The themes of applications vary broadly across any number of disciplines and functions (such as on-demand content management, e-commerce transactions, brokerage transactions, home entertainment, calculator etc.), and one application may have more than one theme. The unit of executable software generally runs in a predetermined environment; for example, the unit could comprise a downloadable Java Xlet™ that runs within the JavaTV™ environment.
As used herein, the term “client device” includes, but is not limited to, digital set-top boxes (e.g., DSTBs), personal computers (PCs), and minicomputers, whether desktop, laptop, or otherwise, and mobile devices such as handheld computers, tablets, personal digital assistants (PDAs), personal media devices (PMDs), and smartphones.
As used herein, the term “computer program” or “software” is meant to include any sequence or human or machine cognizable steps which perform a function. Such program may be rendered in virtually any programming language or environment including, for example, C/C++, Fortran, COBOL, PASCAL, assembly language, markup languages (e.g., HTML, SGML, XML, VoXML), and the like, as well as object-oriented environments such as the Common Object Request Broker Architecture (CORBA), Java™ (including J2ME, Java Beans, etc.), Binary Runtime Environment (e.g., BREW), C#, and the like.
The terms “consumer premises equipment” (CPE) and “consumer device” refer without limitation to any type of electronic equipment for use within a consumer's or user's premises and connected to a content distribution network. The term “consumer device” includes terminal devices that have access to digital television content via a satellite, cable, or terrestrial network. The term “consumer premises equipment” (CPE) includes such electronic equipment such as set-top boxes (e.g., DSTBs or IPTV devices), televisions, cable modems (CMs), embedded multimedia terminal adapters (eMTAs), whether stand-alone or integrated with other devices, digital video recorders (DVR), gateway storage devices, and ITV personal computers.
As used herein, the term “DOCSIS” refers to any of the existing or planned variants of the Data Over Cable Services Interface Specification, including for example DOCSIS versions 1.0, 1.1, 2.0 and 3.0. DOCSIS (version 1.0) is a standard and protocol for internet access using a “digital” cable network.
As used herein, the terms “Internet” and “internet” are used interchangeably to refer to inter-networks including, without limitation, the Internet.
As used herein, the terms “microprocessor” and “digital processor” are meant generally to include all types of digital processing devices including, without limitation, digital signal processors (DSPs), reduced instruction set computers (RISC), general-purpose complex instruction set computing (CISC) processors, microprocessors, gate arrays (e.g., FPGAs), PLDs, reconfigurable compute fabrics (RCFs), array processors, and application-specific integrated circuits (ASICs). Such digital processors may be contained on a single unitary IC die, or distributed across multiple components.
As used herein, the terms “MSO” or “multiple systems operator” refer to a cable, satellite, or terrestrial network provider having infrastructure required to deliver services including programming and data over those mediums.
As used herein, the terms “network” and “bearer network” refer generally to any type of telecommunications or data network including, without limitation, hybrid fiber coax (HFC) networks, satellite networks, telco networks, and data networks (including MANs, WANs, LANs, WLANs, internets, and intranets). Such networks or portions thereof may utilize any one or more different topologies (e.g., ring, bus, star, loop, etc.), transmission media (e.g., wired/RF cable, RF wireless, millimeter wave, optical, etc.) and/or communications or networking protocols (e.g., SONET, DOCSIS, IEEE Std. 802.3, ATM, X.25, Frame Relay, 3GPP, 3GPP2, WAP, SIP, UDP, FTP, RTP/RTCP, H.323, etc.).
As used herein, the term “network interface” refers to any signal, data, or software interface with a component, network or process including, without limitation, those of the FireWire (e.g., FW400, FW800, etc.), USB (e.g., USB2, USB 3.0), Ethernet (e.g., 10/100, 10/100/1000 (Gigabit Ethernet), 10-Gig-E, etc.), MoCA, Coaxsys (e.g., TVnet™), radio frequency tuner (e.g., in-band or OOB, cable modem, etc.), Wi-Fi (802.11), WiMAX (802.16), PAN (e.g., 802.15), cellular (e.g., LTE/LTE-A, 3GPP, 3GPP2, UMTS), or IrDA families.
As used herein, the terms “personal media device” and “PMD” refer to, without limitation, any device, whether portable or otherwise, capable of storing and/or rendering media.
As used herein, the term “server” refers to, without limitation, any computerized component, system or entity regardless of form which is adapted to provide data, files, applications, content, or other services to one or more other devices or entities on a computer network.
As used herein, the term “user interface” refers to, without limitation, any visual, graphical, tactile, audible, sensory, or other means of providing information to and/or receiving information from a user or other entity.
As used herein, the term “Wi-Fi” refers to, without limitation, any of the variants of IEEE-Std. 802.11 or related standards including 802.11 a/b/g/n/s/v/ac or 802.11-2012, as well as so-called “Wi-Fi Direct”, each of the foregoing incorporated herein by reference in its entirety.
As used herein, the term “wireless” means any wireless signal, data, communication, or other interface including without limitation Wi-Fi, Bluetooth, 3G (3GPP/3GPP2), HSDPA/HSUPA, TDMA, CDMA (e.g., IS-95A, WCDMA, etc.), FHSS, DSSS, GSM, PAN/802.15, WiMAX (802.16), 802.20, Zigbee, RFID/NFC, narrowband/FDMA, OFDM, PCS/DCS, LTE/LTE-A, analog cellular, CDPD, satellite systems, millimeter wave or microwave systems, acoustic, and infrared (i.e., IrDA).
In one salient aspect, the present disclosure provides apparatus and methods for collecting data relating to online behavior associated with a number of users of a service provider network, evaluating the data, and creating one or more management or action plans based thereon, so as to both avoid (or at least mitigate) the effects of malicious computer infections of the users within the network, and also engender the desired type of behavior within the network user population in the future. As discussed above, the prior art fails to provide a substantially real-time, preventive (versus reactive) approach to management and assessment of user online behavior in the context of large, multi-user service provider networks such as cable, satellite or similar networks. Such networks have millions of subscribers (and hence online users), and remediation of their online activity, “indiscretions” or carelessness can often place a significant cost and time burden on the network operator, as well as potentially comprising the integrity of the network for services such as advertising placement by third parties.
In one exemplary embodiment, the methods an apparatus disclosed herein leverage both a variety of available third-party data sources and products, as well as indigenously developed data relating to individual network subscribers (or larger subsets of the subscriber population) to, inter alia, correlate certain types of subscriber behavior to certain known “high risk” outcomes in a substantially automated and real-time fashion. This correlation enables timely generation and implementation of subscriber management plans for a multitude of subscribers within the network simultaneously, thereby providing a heretofore unavailable operational capability and visibility for the network operator.
Moreover, the foregoing analysis and correlation can be used as the basis for “products” that can be provided to other network operators, service providers, or entities (whether free or for consideration), including third party advertisers.
In one regard, the methods and apparatus of the present disclosure advantageously enable some degree of “subscriber shaping”, whether through (i) modification of extant subscriber behavior, (ii) elimination of extant subscribers (based on e.g., limited or negative return-on-investment or ROI given their constant need for remediation efforts), and/or (iii) attraction of new subscribers with more desirable qualities in terms of online behavior, risk profile, and hence ROI for the network operator.
Methodologies for characterizing user activity in e.g., data records, and for rating and remediation of particular users or groups of users, are also provided herein.
Exemplary embodiments of the apparatus and methods of the present disclosure are now described in detail. While these exemplary embodiments are described in the context of a managed content distribution network (e.g., hybrid fiber coax (HFC) cable) architecture having a multiple systems operator, digital networking capability, and plurality of client devices/CPE, and Internet delivery via e.g., RF QAM and DOCSIS cable modem, the general principles and advantages of the disclosure may be extended to other types of networks, architectures and applications, whether broadband, narrowband, wired or wireless, terrestrial or satellite, managed or unmanaged (or combinations thereof), or otherwise, the following therefore being merely exemplary in nature.
Also, while certain aspects are described primarily in the context of the well-known Internet Protocol (described in, inter alia, RFC 791 and 2460), it will be appreciated that the present disclosure may utilize other types of protocols (and in fact bearer networks to include other internets and intranets) to implement the described functionality.
It will also be recognized that while described primarily in the context of a relational database, the various aspects of the disclosure may be implemented using other types or constructs of databases, whether alone or in combination with a relational database.
Bearer Network—
The data/application origination point 102 comprises any medium that allows data and/or applications (such as a VOD-based or “Watch TV” application) to be transferred to a distribution server 104. This can include for example a third party data source, application vendor website, CD-ROM, external network interface, mass storage device (e.g., RAID system), etc. Such transference may be automatic, initiated upon the occurrence of one or more specified events (such as the receipt of a request packet or ACK), performed manually, or accomplished in any number of other modes readily recognized by those of ordinary skill. The application distribution server 104 comprises a computer system where such applications can enter the network system. Distribution servers are well known in the networking arts, and accordingly not described further herein.
The VOD server 105 comprises a computer system where on-demand content can be received from one or more of the aforementioned data sources 102 and enter the network system. These servers may generate the content locally, or alternatively act as a gateway or intermediary from a distant source.
The CPE 106 includes any equipment in the “customers' premises” (or other locations, whether local or remote to the distribution server 104) that can be accessed by a distribution server 104. CPE can include e.g., settop boxes, gateways, wireless access points, as well as any number of other configurations.
Content (e.g., audio, video, data, files, etc.) is provided to the client devices 106 in a given data format (e.g., MPEG-2, MPEG-4, etc.). To communicate with the headend or intermediary node (e.g., hub server), the CPE 106 may use the out-of-band (OOB) or DOCSIS channels and associated protocols. The OCAP 1.0, 2.0, 3.0 (and subsequent) specification provides for exemplary networking protocols both downstream and upstream, although the present disclosure is in no way limited to these approaches.
While the foregoing network architectures described herein can (and in fact do) carry packetized content (e.g., IP over MPEG for high-speed data or Internet TV, MPEG2 packet content over QAM for MPTS, IP over DOCSIS via a cable modem termination system (CMTS), etc.), they are often not optimized for such delivery. Hence, in accordance with another embodiment of the disclosure, a “packet optimized” delivery network is used for delivery of the packetized content (e.g., encoded content).
In another implementation, the network comprises both “managed” and “unmanaged” (or off-network) services, so that a network operator can utilize both its own and external infrastructure to provide content delivery to its subscribers in various locations and use cases. In one variant of this approach, network services are sent “over the top” of other provider's infrastructure, thereby making the service network substantially network-agnostic.
In another variant, a cooperative approach between providers is utilized, so that features or capabilities present in one provider's network (e.g., authentication of mobile devices) can be leveraged by another provider operating in cooperation therewith. Such a network provides, inter alia, significant enhancements in terms of common control of different services, implementation and management of content delivery sessions according to unicast or multicast models, etc.; however, it is appreciated that the various features of the present disclosure are in no way limited to this or any of the other foregoing architectures.
Notwithstanding the foregoing, it will be appreciated that the various aspects and functionalities of the present disclosure are effectively agnostic to the bearer network architecture or medium, and hence literally any type of delivery mechanism can be utilized consistent with the disclosure provided herein.
Illicit Activity Detection and Remediation Architecture—
The client devices 106 of
A service node 204 is provided as an intermediary between the network headend 150 and the client devices 106 in one embodiment. A particular service node 204 services several client devices 106 in communication therewith. However, it is appreciated that the foregoing disclosure may be utilized in a system which enables direct communication between the client devices 106 and the network 101. In addition, the network 101 may be configured to provide non-Internet (e.g., broadcast, on-demand, etc.) content to the client devices 106.
As the respective users of each of the client devices 106 interacts with Internet content, data regarding the activity is collected by an activity data collection entity 208. The user's interaction may include activity which is not harmful to other devices and/or the system. Additionally, the user's interaction, whether intentionally or unintentionally, may include activity which is harmful to other devices and/or to the system. The activity data collector 208 may comprise a headend MSO-operated entity or a third-party entity in communication with the MSO-operated headend 150. In another embodiment, more than one activity data collector 208 is provided; such as one MSO-operated and one third-party operated device.
The activity data collection entity 208 generates activity records for each activity performed at the CPE 106 (or other relevant location or process within the network). In one embodiment, to generate the activity records, the activity data collection entity 208 processes the collected data by, for example, validating, analyzing, and/or normalizing the data to prepare the data for correlation with additional data such as subscriber information. For example, the activity data collection entity 208 correlates the data with subscriber information based on categories of the collected data and security profiles of the subscribers to generate the activity records, as discussed in greater detail subsequently herein.
In one embodiment, the data records include a date and/or time stamp for the activity, an activity identifier, and a device, subscriber, or user identifier. Hence, in one embodiment, the activity data collection entity 208 is configured to, when an action is taken by the CPE 106 identify the CPE 106 (and/or a user thereof) and the type of action taken, then create a data record having an appropriate identifier of the action and a date/time stamp. An exemplary activity data record 220 is illustrated in
The collected activity data records 220 are then provided to the activity manager 202. In one variant, the activity data records 220 identify both the type of activity and the user (and/or device) associated with the record. For example, the data record may include a unique identifier associated with the subscriber and/or client device 106. Additionally, various shortened words or phrases may be utilized to identify particular types of activity.
The collected data, processed data, and the activity data records 220 may additionally be stored at a database located at the headend 150 (such as the profile database 210) or at a node (such as service node 204) or at a user premises. Additionally, the activity data collection entity 208 may partition the data and/or activity data records based on variable partitioning criteria such as locations of the subscribers, threat levels, customer types, service types, etc. The activity data collection entity 208 stores the partitioned data at the database along with the collected data, processed data, and the activity data records. By storing data with different levels of processing, the activity data collection entity 208 may provide data at any level of processing for reporting and analysis services.
The activity manager 202 comprises one or more applications which use the collected data to derive a “score” for each user and/or client device. The score is derived by categorizing each activity, then multiplying a value of each category of activity by a predetermined weighting factor for that type of activity. In this manner, more serious or detrimental activities more seriously impact a user's score. A total or aggregate score is then compiled for all activity of a particular device and/or user over a period of time such as via a device and/or user profile. Table 1 below is an exemplary weighting table which may be used to associate activities to specific weighting factors.
In one variant, each CPE 106 and/or user is assigned a template or starting profile. The starting profile is then adapted over time based on the types of activity performed by the device. An exemplary starting or template profile 230 is illustrated in
As noted, each CPE 106 and/or user may be assigned a single cumulative profile 231 which takes into account both positive and negative activity associated therewith as shown in
Hence, as the activity data records 220 are received, the activity manager 202 uses the data contained therein to access the appropriate user/device profile 231 and increment the appropriate activity 233 by an appropriate amount. The amount by which the activity is incremented is determined by the activity manager 202 via identification of the activity in a weighting table in one embodiment, see for example the values listed in Table 1 above.
In another alternative or in addition, multiple profiles similar to that of
For example, suppose that the user profile 231 of
Activity RecordUserA=[Activity D,User A,1.13.15.9.48]
As shown, the data record indicates that Activity D was performed by User A at 9:43 am on Jan. 13, 2015. It is noted that the user identifier may be obfuscated in order to protect the identity of the user and/or device. The activity manager 202 may then determine an appropriate value by which to increment the listed 0.0 of the user profile by reviewing the aforementioned weighting table. As shown in the sample table above, Activity D has a weighting value of −3.2; hence a single record for Activity D will cause the user profile value of Activity D to change to:
1×(−3.2)=−3.2
Suppose that additional data records 220 are received as follows:
Activity RecordUserA=[Activity A,User A,1.13.15.9.54]
Activity RecordUserA=[Activity A,User A,1.13.15.19.29]
Activity RecordUserA=[Activity C,User A,1.13.15.18.00]
Activity RecordUserA=[Activity E,User A,1.13.15.21.12]
Given Table 1 above, the activity manager 202 then performs the following calculations:
Activity A=(2×3.3)+3.3=6.6+3.3=9.9
Activity C=(1×−1.7)+−5.1)=(−1.7)+(−5.1)=−6.8
Activity E=(1×−1.0)+(−4.0)=(−1.0)+(−4.0)=−5.0
Next, the activity manager 202 updates the user profile to reflect the newly calculated data records 220 as follows:
An aggregate may be taken of the individual scores across all activities, in the example above, User A's cumulative score is therefore 0.9. Alternatively, two individual scores one for positive activities and one for negative activities may be taken; in one variant this may be accomplished using dedicated positive and negative profiles. According to this variant, the aggregate may more heavily weigh the detrimental activity as compared to the positive activity to ensure that appropriate protection from illicit online activity is provided (as opposed to taking a very strict cumulative score).
The activity manager 202 may be further provided with threshold values users may not pass. When the activity manager 202 detects negative activity outside of a predetermined threshold for that activity, remediation measures are taken as will be discussed below.
The foregoing weighted scoring system may also be applied to activity which is viewed as positive or indicative of a safe user. For example, a duration of time without any negative data collected regarding a particular user or device may cause a user and/or device's score to be affected in a positive way. That is, a user/device's overall or aggregate score may be positively influenced and negatively influenced irrespective of actual records received (such as when no negative data is collected).
In one variant, the user profiles are updated periodically such that a number of activity records 220 received during a time period are saved then provided at once to the activity manager 202, which then uses them to update the user profiles as discussed above.
User/device aggregate scores are stored at a profile database 210. The scores are listed in the database by a user identity and/or a device identity, which may in one embodiment be fully anonymized to protect the subscriber's identity (such as via a one-way cryptographic hash or the like) to address, e.g., privacy concerns regarding individual user's online behavior. This anonymization also enables the ability to transport or sell the data to third parties, since there is no possible “reverse engineering” of the data or portions thereof to identify individual users or premises/accounts.
In one embodiment, the profile database 210, is located at the headend 150. Alternatively, the database 210 may be located at a service node 204 and may store data relating only to activity of the client devices 106 in communication therewith. In yet another alternative, the database 210 may be located at the client devices 106 themselves, and processed or raw data collected therefrom provide to the activity manager 202.
The activity manager 202 periodically compares each user/device profile aggregate scores to a pre-determined threshold values. The threshold value to which each score is compared may vary based on the type of subscriber. For example, a business entity subscriber may be afforded a larger aggregate score than an individual subscriber.
Additionally, the thresholds may vary based on the number of devices associated to the profile in the instance a profile represents more than one device. In the instance a profile represents only a single device, it may further be of value to identify a device among the devices associated to a subscriber as the “principal” device to which activity of the “secondary” devices is reported. In this manner, a business owner may be alerted not only to the existence of illicit activity on his/her account, but also the exact device which has committed the activity (whether knowingly or unknowingly). The business owner can then take appropriate steps to remediate the problem and/or more closely monitor the user of the device in question.
Moreover, the threshold applicable to illicit behavior may be higher or lower than a threshold applicable to positive activity. In another alternative, a single cumulative threshold value may be given for each subscriber type.
The activity manager 202 is further in communication with at various network entities which are configured to: (i) perform a remediation process when it is determined that a particular device/user has exceeded a threshold limit of permissible illicit behavior, and/or (ii) enable enhanced services when it is determined that a particular device/user has exceeded a threshold level of positive behavior.
As will be discussed in greater detail elsewhere herein, the remediation processes which may be applied to a subscriber's account in the instance a threshold limit of permissible illicit behavior is reached may include one or more of: bandwidth adjustment, disabling service, disabling certain features, and routing services for more in-depth analysis. Additionally, one or more alerts may be provided to the subscriber or user of a device when a threshold limit of permissible illicit behavior is met. In another embodiment, when the threshold limit is reached, an identity of the subscriber is requested. In one variant, this may include requesting a login identification name and/or password. When an identity of the subscriber cannot be confirmed, in addition to the remediation mechanisms discussed above, a secondary alert may be provided via the use of alternate contact information. In this manner, the system is not only able to identify that illicit behavior is associated with a third party (i.e., not the subscriber him/herself), but can further notify the subscriber of the breach and remediate the problem.
As will be discussed in greater detail elsewhere herein, the processes which are applied to a subscriber's account in the instance a particular device/user has exceeded a threshold level of positive behavior may include one or more of: bandwidth adjustment, enabling advanced services, relaxed security measures (such as identification requirements), and routing services for faster service.
Methods by which the foregoing functionality is enabled are discussed in greater detail below.
Methodology—
Referring now to
As shown, per step 302, data relating to a subscriber and/or device's online activity is collected at an activity data collection entity 208. Online activity about which data is collected may include benign as well as harmful activity, including harmful activity which is intentional or unintentional. In one embodiment, the data collection entity 208 comprises a headend 150 or third party entity in communication with a headend activity manager 202.
The collected data is then used to generate a plurality of activity records 220 at step 304. In one embodiment, each activity record 220 comprises a date/time stamp, an activity identifier, and a user/device identifier (which may be obfuscated or otherwise anonymized). The data records 220 are provided from the data collection entity 208 to an activity manager 202. This may occur as a periodic push or pull, or in near-real time as the activity records 220 are generated.
Next, per step 306, the activity manager 202 applies a weighting factor to the collected data. As noted previously, different weights are applied based on the type of activity (positive or negative) and severity associated with the activity. In one embodiment, as noted previously, a pre-generated weighting table (such as that of Table 1 above) may be consulted in order to determine an appropriate weighting value to apply to an activity identified in each data record.
As is also noted above, in one exemplary embodiment, the collected data is processed into one or more user profiles. Several user profiles may also relate to one CPE 106, or user. The user profiles are, per step 308, updated based on the collected activity data. The updates may occur periodically and/or upon each instance of a positive and/or negative user activity. It is further recognized that other models may be used, such as where only certain classes of user actions, or those occurring during certain periods of time or dates, are recorded and used to update a user/device profile.
Once the user profiles are updated (based on the received activity records 220), the updated profiles are compared to pre-determined threshold values at step 310. The threshold values may apply to an aggregate score for both illicit and benign activity, or may comprise a value for each of these types of activities individually. The aggregate score may be compiled using the here described aggregate profile, or using multiple profiles representative of positive and negative behavior to which second weighting factors are applied. In other words, weighting factors are applied to each negative activity within a negative profile and an aggregate negative value is reached; this value is then further weighted and combined with a similar value for positive activity (i.e., weighting factors are applied to each positive activity within a positive profile and an aggregate positive value is reached, weighted, and combined with the negative value determined above).
When the comparison indicates that a user profile value is acceptable, step 312, the method continues. That is, when the updated user profile value is within the network operator determined threshold levels, the user/device may continue performing requested activities (and data records 220 will continue to be generated). Additionally, the processes discussed in
In one embodiment, the report or alert which is sent to the user/device discloses the profile value as well as other information which may be determined from the activity data. For example, the user/device may be alerted as to the dates and times of suspicious activity. In this manner, the user or subscriber may take necessary steps to remediate illicit online behavior. In addition, the user/device may be given precise information as to the types of activities which have occurred (i.e., their system has been hijacked by a spambot, etc.). Moreover, the user or subscriber may benefit from periodic updates regarding their current status.
It is further noted that the foregoing comparison step (step 312) may be performed at instances where the user requests to perform an action. When the threshold values of the profile are acceptable, the requested user action is permitted; and when the threshold values of the profile are not acceptable, the requested user action is not permitted and remediation (as discussed elsewhere herein) occurs.
Referring now to
Upon determination that the user/device has performed illicit activity in excess of an MSO determined threshold, at step 324 the subscriber's identity is confirmed. The subscriber's identity may be confirmed via a number of mechanisms. For example, the MSO may require a subscriber identity and password combination, entry of personal identification information, responses to “secret” questions, etc. The foregoing mechanisms enable an operator at the MSO to verify that any activity occurring at that device or alleged to be performed by that user are verifiably being performed by the subscriber in question.
When the subscriber's identity is confirmed (step 326), appropriate remediation procedures are implemented at step 328. Exemplary remediation measures include adjustment of bandwidth available to the subscriber. An amount of bandwidth which is taken away and/or remains available for use may be determined based on a number of factors including, the weight or severity of the subscriber's illicit activity, the frequency of illicit activity, the duration of time since the most recent illicit activity incident was reported, etc. Other remediation processes may include disabling service or disabling certain features for a given period of time and/or indefinitely based on the severity and frequency of the illicit activity. In addition, the MSO may determine that certain patterns of illicit activity and/or types of activity warrant closer inspection. Accordingly, services for a particular subscriber and/or device may be routed to a headend evaluation entity. An MSO operator or other entity may then more closely monitor activity of subscriber and/or device for a period of time and determine further measures which should be taken accordingly (such as disabling service, sending notifications, etc.).
It is appreciated that more than one of the remediation procedures discussed above may be applied simultaneously. Moreover, the foregoing patterns of behavior, frequency, duration, and time periods may be determined via an examination of date/timestamps within the activity data records 220 discussed elsewhere herein.
When the subscriber's identity is not confirmed (step 326), secondary alerts are provided at step 330. That is, because it cannot be confirmed that the user of a device is a subscriber of the network, alternative means of contacting the appropriate subscriber are used. For example, secondary email addresses, contact telephone numbers, etc. are used to notify the subscriber of the illicit activity occurring on the device associated with that subscriber account. The aforementioned remediation processes as well as advanced remediation processes may then be implemented (step 332). Advanced remediation processes include strict denial of service, however, any of the foregoing remediation steps (such as those of step 328) may be performed as well.
Referring now to
The determined duration is then evaluated at step 346 to illicit whether a threshold therefor is met and/or exceeded. In one embodiment, the threshold duration is determined and provided by an operator at the MSO. Additionally, the MSO operator may determine whether the threshold value must merely be met, or whether it must be exceeded at step 346.
When the threshold is met and/or exceeded, advanced features are enabled at step 348. For example, a greater amount of bandwidth may be provided to those users/devices which have exhibited safe online practices for the required duration. In another variant, such bandwidth increases may be tiered based on the duration of positive activity. In this manner, users/devices which have exhibited positive behavior longest will be afforded the most bandwidth. In another example, advanced services may be provided to only those users/devices which satisfy the safe use policy or threshold.
In addition, relaxed security measures may be implemented in the instance a user/device has met and/or exceeded the threshold value. For instance, the user/device may be subjected to fewer interruptions to request password, personal identification, etc. and instead, the user/device's authentication is extended automatically.
In yet another example, the advanced features enabled at step 348 may include actively routing services for the users/devices which have met and/or exceeded the threshold duration for acceptable activity to ensure faster service thereto. According to this embodiment, the MSO actively monitors various network pathways to determine speed of possible service. With this information, one or more levels of service speed may be created and provided to users/devices such as based on the duration during which each has exhibited only positive behavior. In other words, users/devices which have shown a longer duration of positive online activity so as to meet and/or exceed the threshold (step 346) will be given access to the highest speeds available.
In the instance that a user/device has not met and/or exceeded the threshold duration listed in step 346, the method continues and additional data is gathered and evaluated.
Activity Manager—
Referring now to
The network interface 402 enables two way communication between the activity manager 202 and other portions of the managed (MSO) network 101 and other network entities (such as e.g., the activity data collection entity 208 and the profile database 210). The Internet interface 406 enables two way communication with other entities including e.g., content sources 206 via the Internet 111. The activity manager 202 itself may be located at a network headend 150 (see
The activity manager 202, as noted above, further comprises a digital processor 404, which, in one embodiment, is configured to run one or more computer programs (stored at the storage apparatus 408), including a data analysis application 410, a management application 412, and a message generation application 414. It is further noted that the functionality of the foregoing applications may be accomplished via any number of discrete applications run on across any number of entities whether located at the headend 150 or in communication therewith.
The data analysis application 410 comprises a plurality of instructions which, when executed by the processor 404, cause the activity manager 202 to analyze data collected via the network interface 402. The raw data records 220 relating to online activities of the client devices 106 are received from the data collection entity 208. This may occur as a periodic push or pull, or in near-real time as the activity records 220 are generated. The analysis of the data comprises derivation of a “score” for each user and/or client device. In one embodiment, this is accomplished via the data analysis application 410 generating a profile for each CPE 106 and/or user. In one variant, the profiles are derived using a template or starting profile which is adapted over time based on the types of activity performed by the device. Each CPE 106 and/or user may be assigned a single cumulative profile which takes into account both positive and negative activity associated therewith (see
The management application 412 comprises a plurality of instructions which when executed by the processor 404 cause the activity manager 202 to manage a plurality of threshold values and compare the profiles thereto. In other words, the management application 412 periodically compares each user/device profile aggregate scores to a pre-determined threshold values. For example, the management application 412 determines whether a client device and/or user's negative activity is outside of a predetermined threshold for that activity. In this instance, remediation measures are taken as discussed elsewhere herein. The threshold value to which each score is compared may vary based on the type of subscriber.
The message generation application 414 comprises a plurality of instructions which when executed by the processor 404 cause the activity manager 202 to communicate to the various network entities one or more messages relating to a status of the client devices and/or users. Specifically, the message generation application 414 generates messages to the various network entities which are configured to: (i) perform a remediation process when it is determined that a particular device/user has exceeded a threshold limit of permissible illicit behavior, and/or (ii) enable enhanced services when it is determined that a particular device/user has exceeded a threshold level of positive behavior. Additional messages are also generated by the message generation application 414.
Activity Data Collection Entity—
In the illustrated implementation, the server functionality is based on an exemplary Microsoft® SQL Server® Enterprise suite, although it will be appreciated that other configurations may be used consistent with the present disclosure. The exemplary SQL Server Enterprise suite provides, inter alia, high levels of speed/performance, encryption, local and “cloud” database access, and policy-based management. Specifically, SQL Server Reporting Services (SSRS) and SQL Server Analysis Services (SSAS) are two salient features of SQL Server that enable the exemplary SQL Server to provide the desired functionality in the exemplary embodiments, as well as enhanced data partitioning functionality, and so-called “Dimension” and “Fact” table management.
As is well known, data warehouses are typically built using dimensional data models which include fact and dimension tables. Dimension tables are used to describe dimensions; they contain e.g., dimension keys, values and attributes. As but one example, an exemplary “time” dimension might contain chronological increments or references (e.g., hour, day, month, etc.). An exemplary product or service dimension could contain a name and description of products or services the MSO provides, their incremental price, and other attributes as applicable.
Dimension tables are often small; however, in the exemplary embodiment described herein, the dimension tables may grow to literally millions of entries or rows; e.g., one for each subscriber, CPE, and/or account, etc.
Data warehouses may have multiple time dimensions as well. Since the warehouse may be used for finding and examining trends, it is often important to understand when each event has occurred; e.g., prior infections of subscriber computers, prior contact of a CSR, visitations to certain domains or websites, etc. A common time dimension is calendar time.
Fact tables may contain e.g., keys to dimension tables, as well as measurable facts useful to implementing the various algorithms described herein. For example, in one embodiment, the MSO might maintain a fact table recording provision of a service or data “product” to a given subscriber, or records of the subscribers use of their DOCSIS modem to access certain proscribed Internet websites.
Similar to data warehouses, such fact tables can grow very large, with millions or even billions of rows in the exemplary context of a nationwide MSO with millions of subscribers. This underscores some of the advantageous aspects of the present disclosure; i.e., efficient accumulation, storage, management, and utilization of possibly hundreds or thousands of entries (e.g., events) for millions of subscribers is not only arduous, but effectively impossible using any manual processes, especially if the analysis and corrective action is to be implemented in a timely fashion (i.e., such that infections, distribution of malware, etc. are “nipped in the bud”).
It will be appreciated from the foregoing that various levels of “granularity” may be used in constructing the aforementioned data structures, depending on factors such as (i) availability of data (e.g., data may only be available in certain time increments, certain performance variables, etc.); (ii) desired frequency of review or analysis; (iii) desired end result or subscriber metrics, etc. Thus, the present disclosure contemplates using the aforementioned data structures both at varying levels of granularity, and dynamically (i.e., granularity in a given area potentially be modified, or alternating between levels of granularity based on e.g., occurrence of certain events such as a subscriber infection).
The activity data collector 208 may comprise a headend MSO-operated entity or a third-party entity in communication with the MSO-operated headend 150. In another embodiment, more than one activity data collector 208 is provided; such as one MSO-operated and one third-party operated device.
The network interface 502 enables two way communication between the activity data collection entity 208 and the HFC network 101 and other network entities (such as e.g., the activity manager 202 and the profile database 210). The Internet interface 506 enables two way communication with other entities including e.g., content sources 206 via the Internet 111. The activity data collection entity 208 itself may be located at a network headend 150 (see
The activity data collection entity 208, as noted above, further comprises a digital processor 504, which, in one embodiment, is configured to run one or more computer programs (which may be stored in memory in data communication with the processor, or at the storage apparatus 508), including a data collection application 510 and a data processing application 512. It is further noted that the functionality of the foregoing applications may be accomplished via any number of discrete applications run on across any number of entities whether located at the headend 150, or located elsewhere and in communication therewith. The collection and processing applications operate collectively to implement a data architecture (see
The data collection application 510 comprises a plurality of instructions which when executed by the processor 504 cause the activity data collection entity 208 to collect data regarding the activity of respective users of each of the client devices 106 with Internet content. The activity data collection entity 208 collects data from various sources for subsequent use within the data architecture (
The data collection application 510 may be implemented using suitable push/pull technologies, e.g., Microsoft.net technologies, for collecting data from data sources. The collected data is stored in the storage device 508 in raw format. As noted elsewhere herein, the user's interaction may include activity which is not harmful to other devices and/or the system. Additionally, the user's interaction, whether intentionally or unintentionally, may include activity which is harmful to other devices and/or to the system.
The data processing application 512 comprises one or more computer programs with a plurality of instructions which when executed by the processor 504, cause the activity data collection entity 208 to process the collected data and generate activity records for each activity performed at the CPE 106, or other data output as described further below. The data processing application 512 may utilize as part of its operation a database engine (such as the aforementioned Microsoft SQL Server or similar technology). In one implementation, the application computer program is rendered in a C# (“C Sharp”) object-oriented programming language (C# was chosen in the exemplary embodiment for use of the .NET Framework, which provides large libraries with built in capabilities and methods useful in the context of the present disclosure), although it will be appreciated that other languages may be used consistent with the present disclosure. The activity data collection entity 208 processes the collected data by, for example, validating, analyzing, and/or normalizing the collected data to generate a database of user and activity information. The activity data collection entity 208 normalizes the data by, for example, extracting information from the data and organizing the extracted information into a predefined format. The extracted information may include e.g., a user identifier, an activity identifier, and a data and time stamp for the activity. Processing the collected data prepares the data for correlation with other additional data, such as subscriber information obtained from the MSO network. The activity data collection entity 208 stores the processed data in a mass storage device; e.g., the local storage device 508 shown in
In one implementation, the activity data collection entity 208 looks up individual subscriber information from the service provider's database, and correlates the processed (ingested) data with the accessed subscriber information based on, for example, categorization of the processed data and security profiles of the subscriber. For instance, the ingested data may include one or more signatures or profiles indicative of certain types of undesired behavior (e.g., accessing risky or blacklisted websites, failure to utilize certain protective measures such as anti-virus software, failure to enable a firewall, etc.).
Activity of the selected subscriber that correlates to any such profiles is ostensibly indicative of the user's “risk” or propensity for future infections, security breaches or the like, and hence is a significant determinant in how that subscriber will be managed going forward. In one embodiment, the data records include a date and/or time stamp for the activity, an activity identifier, and a device, subscriber, or user identifier. Hence, in one embodiment, the data processing application 512 is configured to, when an action is taken by the CPE 106 identify the CPE 106 (and/or a user thereof) and the type of action taken, then create a data record having an appropriate identifier of the action and a date/time stamp.
The data records 220 are provided from the data collection entity 208 to an activity manager 202 in one embodiment via the network interface 502. This may occur as a periodic push or pull, or in near-real time as the activity records 220 are generated.
In one embodiment, the activity data collection entity 208 processes the foregoing correlation (activity) records to generate an aggregated database that can be partitioned based on any number of different partitioning criteria, such as geographic locations of subscribers, threat levels, customer types, service types, etc. The activity data collection entity 208 stores the partitioned data in the local mass storage device 508, or other storage such as cloud storage so as to make the data available to multiple disparate entities which may have need for it, such as customer care centers or CSRs.
The partitioned data is configured to facilitate manageability and availability of the data. For example, a service provider (e.g., CSR of the MSO) may query the partitioned data based on one or more criteria (e.g., for a specific subscriber, such as by account number), and utilize the data in terms of subscriber management going forward. Moreover, the database may be queried for other purposes, such as to perform statistical or other analysis on the retrieved data to determine, for example, a percentage of subscribers in a zip code affected by a particular security threat. The service provider may use such information to provide customize services for the subscribers in that area (either individually, or as a whole). For example, a service provider may customize phone trees and interactive voice response (IVR) systems based on the statistical information derived from the partitioned database to create an efficient approach for handling customer service inquiries so as to e.g., mitigate or pre-empt future undesired behavior from a subscriber or group of subscribers.
One attribute of the illustrated architecture 520 is the accessibility of each of the discrete “layers” by e.g., a querying entity. Specifically, “raw” data ingested from the various data sources is stored, and accessible (with appropriate permissions) in that form. Likewise, after pre-processing (e.g., normalization, formatting, etc. at the data transformation layer), such pre-processed data is available to querying entities. Similar logic applies to the analytics layer and the distribution layer. This capability enhances the utility of the database, in that data can be accessed at these discrete points during its processing, such as for use in alternate types of analyses, as a product to be distributed to one or more third parties, etc. The data can also propagate down through the layers of the data architecture 520 sequentially, with the distribution or “mart” layer (discussed) below being the repository for the finally processed data (at least within the illustrated architecture).
In the illustrated embodiment of
The Transform layer contains collected data that has been pre-processed; e.g., into data sets (e.g., Data Set A, Data Set B, to Data Set N+). The processing of the collected data may include one or more of validation (e.g., does the data meet certain criteria as to type, constituency, etc.), filtration (e.g., elimination of inappropriate or other undesired data), normalization (e.g., formatting into a common format or scheme to enable subsequent manipulation), and/or extraction (e.g., to extract and organize information from the collected data into data sets). For instance, in one embodiment, the aforementioned Transform layer would include “cleansed” source data from the Load layer, such cleansing including e.g., deduplication, non-MSO owned IP addresses segregated, and elimination of formatting issues or inconsistencies.
The Correlation layer contains processed data that has been correlated with subscriber information (e.g., using the aforementioned applications of the data collection entity) and organized into useful data sets. For instance, one organizational scheme comprises organization by subscriber (or accounts associated with the subscriber) into subscriber data sets (e.g., Subscriber Data Set A, Subscriber Data Set B, to Subscriber Data Set N+). A subscriber data set may contain for example the activity records for the corresponding subscriber (and/or account). In one embodiment, the activity records include a date and/or time stamp for the activity, an activity identifier, and a device, subscriber, or user identifier. It will also be appreciated that individual accounts may have multiple different users, each of which may use a different client device associated with the account, and/or may have different levels and types of activity online (e.g., “profiles”). Hence, to be effective, the network operator may need to distinguish between such individual users associated with a single account, including in the processing and organization of the correlated data.
The exemplary “Mart” layer contains subscriber data that has been partitioned based on one or more variable partitioning criteria, such as locations of subscribers, threat levels, customer types, service types, etc. Various data “products” can be obtained from this layer by e.g., MSO personnel or third-party users (such as advertisers who are placing ads within the MSO network).
Referring now to
As shown, per step 602, data is collected or ingested from different data sources. The data sources include third-party data sources and/or the service provider's internal data sources (e.g., MSO analytics relating to Internet activity, consumed bandwidth, and the like). The collected data includes, inter alia, user information and activity information pushed or pulled from the data sources. For example, user and activity information may be collected from third-party content providers or warehouses, third-party email service providers, customer care tools, etc.
At step 604, the collected data is stored in raw format. The collected data is organized in the storage repository, such as by the data source that provided the data.
Per step 606, the collected raw data is transformed into data sets by pre-processing the raw data. The pre-processing may be performed on the raw data collected from the data sources (directly), or on the collected raw data stored per step 604. The pre-processing of the raw data includes e.g., validating, filtering, extracting, and/or normalizing the raw data as previously described. The pre-processed data sets are stored at step 608.
Per step 610, the pre-processed (transformed) data is analyzed to identify useful relationships or metrics. In the exemplary embodiment, this analysis comprises correlation of the transformed data with network subscriber information. The correlating may be performed on the transformed data before, during, or after the storage of the transformed data per step 608. The transformed data is also organized by subscriber into subscriber data sets. A subscriber data set may contain for example the activity records for the corresponding subscriber. In one embodiment, the activity records include a date and/or time stamp for the activity, an activity identifier, and a device, subscriber, or user identifier. The subscriber data sets are stored per step 612.
Per step 614, the subscriber data is post-processed (e.g., partitioned) based on variable criteria. Such criteria may relate for example to geographic or network locations of subscribers, threat levels or types, customer types, service types (e.g., service level provided to the user within the MSO network), etc. The partitioning may be performed on the subscriber data before, during, or after the storage of the subscriber data per step 612. The partitioned data is stored per step 616.
Based on that subscriber's history, an algorithm is applied so as to assess or “rate them”. For instance, in one embodiment, the algorithm utilizes data on the number and severity of the threats associated with that subscriber so as to generate an overall rating (or series of sub-ratings for different attributes, such as (i) propensity for infection (e.g., based on types of machines, number of different users, past history of visiting “risky” sites or URLs), (ii) profitability (e.g., are they a basic subscriber or high-tier subscriber generating significant income or profit for the MSO), (iii) regularity of use (e.g., are they a frequent user, or more episodic, and which can be indicative of propensity for infection or the spread of an infection), (iv) consumption habits, and so forth), which can be applied to that subscriber subsequently. Based on the subscriber's rating, information will be made available to e.g., MSO or third party services (e.g., EROC/Abuse agents) to understand the details and take appropriate action.
Management of Network Users
As previously indicated, one of the primary attributes of the computerized system of the present disclosure relates to its ability to timely act pre-emptively or proactively with respect to online activities of “problem” subscribers within a network. Another attribute is the ability for the system to help automatically “shape” the subscriber pool; i.e., help identify subscribers whose activity cause significant remediation or other corrective action so as to reduce any ROI by the service provider for servicing that customer. Numerous possible use cases exist for implementing such attributes, examples of which are now described:
1. Customer Service Representative (CSR) Information—In a first use case, the foregoing data generated by the data collection and management entities 202, 208 (see
2. Interactive Voice Response (IVR) Information—In a second use case, the foregoing data generated by the data collection and management entities 202, 208 (see
The foregoing tree logic can be adaptive as well; i.e., adapted to that specific user's fact pattern or behavior, in that all ad bot infections (or subscribers causing the infection/possessing the infected computer) may not be treated the same. For example, if the current call is for a fourth bot infection within the last month for that same user, the logic of the tree will be dynamically adapted to present the user with alternatives or actions not presented to others on say, their first bot infection, and may include more austere compensatory mechanisms such as automatically implementing a “blacklist” of certain websites or URLs for that user, restricting their services, etc.
3. Automated or Substantially Automated Modification of Services—In a third use case, the foregoing data generated by the data collection and management entities 202, 208 (see
In this fashion, the network operator can, inter alia, (i) automatically and in real time invoke mitigating or preventive measures to curb deleterious user activity; (ii) provide some degree of “negative feedback” to a user (i.e., that their activity has consequences); of (iii) provide “positive feedback” to the user (i.e., good job on staying infection-free or avoiding potentially compromising activities). These actions may also be implemented incrementally (e.g., data throttling occurring at a progressively higher rate over time or as the deleterious behavior is not curbed), and manually verified (e.g., by a CSR familiar with the user) before implementation.
In extreme cases, the user's service can be completely terminated (e.g., after repeat offenses, or when highly threatening infections are detected), and the user pruned from the service provider's network.
4. Targeted Advertisement Generation—In a fourth use case, the foregoing data generated by the data collection and management entities 202, 208 (see
It will be recognized that while certain aspects of the disclosure are described in terms of a specific sequence of steps of a method, these descriptions are only illustrative of the broader methods of the disclosure, and may be modified as required by the particular application. Certain steps may be rendered unnecessary or optional under certain circumstances. Additionally, certain steps or functionality may be added to the disclosed embodiments, or the order of performance of two or more steps permuted. All such variations are considered to be encompassed within the disclosure disclosed and claimed herein.
While the above detailed description has shown, described, and pointed out novel features of the disclosure as applied to various embodiments, it will be understood that various omissions, substitutions, and changes in the form and details of the device or process illustrated may be made by those skilled in the art without departing from the disclosure. The foregoing description is of the best mode presently contemplated of carrying out the disclosure. This description is in no way meant to be limiting, but rather should be taken as illustrative of the general principles of the disclosure. The scope of the disclosure should be determined with reference to the claims.
It will be appreciated that while certain steps and aspects of the various methods and apparatus described herein may be performed by a human being, the disclosed aspects and individual methods and apparatus are generally computerized/computer-implemented. Computerized apparatus and methods are necessary to fully implement these aspects for any number of reasons including, without limitation, commercial viability, practicality, and even feasibility (i.e., certain steps/processes simply cannot be performed by a human being in any viable fashion).
This application is a divisional of and claims the benefit of priority to commonly owned U.S. patent application Ser. No. 15/045,043 of the same title filed Feb. 16, 2016 issuing as U.S. Pat. No. 10,116,676, which claims the benefit of priority to commonly owned U.S. Provisional Patent Application Ser. No. 62/116,212, titled “APPARATUS AND METHODS FOR DETECTION AND REMEDIATION OF ILLICIT ONLINE ACTIVITY”, filed on Feb. 13, 2015, each of which is incorporated herein by reference in its entirety.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4677501 | Saltzman et al. | Jun 1987 | A |
| 5253066 | Vogel et al. | Oct 1993 | A |
| 5285272 | Bradley et al. | Feb 1994 | A |
| 5335277 | Harvey et al. | Aug 1994 | A |
| 5357276 | Banker et al. | Oct 1994 | A |
| 5371551 | Logan et al. | Dec 1994 | A |
| 5410344 | Graves et al. | Apr 1995 | A |
| 5436917 | Karasawa | Jul 1995 | A |
| 5477263 | O'Callaghan et al. | Dec 1995 | A |
| 5517257 | Dunn et al. | May 1996 | A |
| 5528282 | Voeten et al. | Jun 1996 | A |
| 5528284 | Iwami et al. | Jun 1996 | A |
| 5534911 | Levitan | Jul 1996 | A |
| 5543927 | Herz | Aug 1996 | A |
| 5550640 | Tsuboi et al. | Aug 1996 | A |
| 5557319 | Gurusami et al. | Sep 1996 | A |
| 5579183 | Van et al. | Nov 1996 | A |
| 5606726 | Yoshinobu | Feb 1997 | A |
| 5619247 | Russo | Apr 1997 | A |
| 5628284 | Sheen et al. | May 1997 | A |
| 5671386 | Blair et al. | Sep 1997 | A |
| 5682597 | Ganek et al. | Oct 1997 | A |
| 5687275 | Lane et al. | Nov 1997 | A |
| 5699360 | Nishida et al. | Dec 1997 | A |
| 5708961 | Hylton et al. | Jan 1998 | A |
| 5710970 | Walters et al. | Jan 1998 | A |
| 5721878 | Ottesen et al. | Feb 1998 | A |
| 5727113 | Shimoda | Mar 1998 | A |
| 5729280 | Inoue et al. | Mar 1998 | A |
| 5729648 | Boyce et al. | Mar 1998 | A |
| 5745837 | Fuhrmann | Apr 1998 | A |
| 5748254 | Harrison et al. | May 1998 | A |
| 5758257 | Herz et al. | May 1998 | A |
| 5778187 | Monteiro et al. | Jul 1998 | A |
| 5793971 | Fujita et al. | Aug 1998 | A |
| 5794217 | Allen | Aug 1998 | A |
| 5798785 | Hendricks et al. | Aug 1998 | A |
| 5808608 | Young et al. | Sep 1998 | A |
| 5818438 | Howe et al. | Oct 1998 | A |
| 5818510 | Cobbley et al. | Oct 1998 | A |
| 5822493 | Uehara et al. | Oct 1998 | A |
| 5822530 | Brown | Oct 1998 | A |
| 5838921 | Speeter | Nov 1998 | A |
| 5844552 | Gaughan et al. | Dec 1998 | A |
| 5850218 | Lajoie et al. | Dec 1998 | A |
| 5861881 | Freeman et al. | Jan 1999 | A |
| 5887243 | Harvey et al. | Mar 1999 | A |
| 5897635 | Torres et al. | Apr 1999 | A |
| 5915068 | Levine | Jun 1999 | A |
| 5917538 | Asamizuya | Jun 1999 | A |
| 5940738 | Rao | Aug 1999 | A |
| 5999525 | Krishnaswamy et al. | Dec 1999 | A |
| 5999535 | Wang et al. | Dec 1999 | A |
| 6005603 | Flavin | Dec 1999 | A |
| 6016316 | Moura et al. | Jan 2000 | A |
| 6026211 | Nakamura et al. | Feb 2000 | A |
| 6046760 | Jun | Apr 2000 | A |
| 6047327 | Tso et al. | Apr 2000 | A |
| 6052588 | Mo et al. | Apr 2000 | A |
| 6055358 | Traxlmayr | Apr 2000 | A |
| 6065050 | Demoney | May 2000 | A |
| 6108002 | Ishizaki | Aug 2000 | A |
| 6115532 | Saeki | Sep 2000 | A |
| 6118472 | Dureau et al. | Sep 2000 | A |
| 6118922 | Van et al. | Sep 2000 | A |
| 6125397 | Yoshimura et al. | Sep 2000 | A |
| 6154766 | Yost et al. | Nov 2000 | A |
| 6167432 | Jiang | Dec 2000 | A |
| 6172712 | Beard | Jan 2001 | B1 |
| 6177931 | Alexander et al. | Jan 2001 | B1 |
| 6181697 | Nurenberg et al. | Jan 2001 | B1 |
| 6219710 | Gray et al. | Apr 2001 | B1 |
| 6233389 | Barton et al. | May 2001 | B1 |
| 6253375 | Gordon et al. | Jun 2001 | B1 |
| 6259701 | Shur et al. | Jul 2001 | B1 |
| 6286049 | Rajakarunanayake et al. | Sep 2001 | B1 |
| 6314572 | Larocca et al. | Nov 2001 | B1 |
| 6317884 | Eames et al. | Nov 2001 | B1 |
| 6324338 | Wood et al. | Nov 2001 | B1 |
| 6345038 | Selinger | Feb 2002 | B1 |
| 6389538 | Gruse et al. | May 2002 | B1 |
| 6396531 | Gerszberg et al. | May 2002 | B1 |
| 6442328 | Elliott et al. | Aug 2002 | B1 |
| 6442332 | Knudson et al. | Aug 2002 | B1 |
| 6473793 | Dillon et al. | Oct 2002 | B1 |
| 6519062 | Yoo | Feb 2003 | B1 |
| 6523696 | Saito et al. | Feb 2003 | B1 |
| 6532593 | Moroney | Mar 2003 | B1 |
| 6543053 | Li et al. | Apr 2003 | B1 |
| 6546016 | Gerszberg et al. | Apr 2003 | B1 |
| 6564381 | Hodge et al. | May 2003 | B1 |
| 6581207 | Sumita et al. | Jun 2003 | B1 |
| 6609253 | Swix et al. | Aug 2003 | B1 |
| 6640145 | Hoffberg et al. | Oct 2003 | B2 |
| 6642938 | Gilboy | Nov 2003 | B1 |
| 6642939 | Vallone et al. | Nov 2003 | B1 |
| 6643262 | Larsson et al. | Nov 2003 | B1 |
| 6694145 | Riikonen et al. | Feb 2004 | B2 |
| 6711742 | Kishi et al. | Mar 2004 | B1 |
| 6718552 | Goode | Apr 2004 | B1 |
| 6721789 | Demoney | Apr 2004 | B1 |
| 6748395 | Picker et al. | Jun 2004 | B1 |
| 6754904 | Cooper et al. | Jun 2004 | B1 |
| 6757906 | Look et al. | Jun 2004 | B1 |
| 6769127 | Bonomi et al. | Jul 2004 | B1 |
| 6774926 | Ellis et al. | Aug 2004 | B1 |
| 6788676 | Partanen et al. | Sep 2004 | B2 |
| 6847778 | Vallone et al. | Jan 2005 | B1 |
| 6865746 | Herrington et al. | Mar 2005 | B1 |
| 6909726 | Sheeran | Jun 2005 | B1 |
| 6917614 | Laubach et al. | Jul 2005 | B1 |
| 6917641 | Kotzin et al. | Jul 2005 | B2 |
| 6918131 | Rautila et al. | Jul 2005 | B1 |
| 6925257 | Yoo | Aug 2005 | B2 |
| 6931018 | Fisher | Aug 2005 | B1 |
| 6931657 | Marsh | Aug 2005 | B1 |
| 6934964 | Schaffer et al. | Aug 2005 | B1 |
| 6944150 | McConnell et al. | Sep 2005 | B1 |
| 6978474 | Sheppard et al. | Dec 2005 | B1 |
| 6981045 | Brooks | Dec 2005 | B1 |
| 7003670 | Heaven et al. | Feb 2006 | B2 |
| 7006881 | Hoffberg et al. | Feb 2006 | B1 |
| 7009972 | Maher et al. | Mar 2006 | B2 |
| 7013290 | Ananian | Mar 2006 | B2 |
| 7020652 | Matz et al. | Mar 2006 | B2 |
| 7027460 | Iyer et al. | Apr 2006 | B2 |
| 7039048 | Monta et al. | May 2006 | B1 |
| 7051352 | Schaffer | May 2006 | B1 |
| 7054902 | Toporek et al. | May 2006 | B2 |
| 7055031 | Platt | May 2006 | B2 |
| 7055165 | Connelly | May 2006 | B2 |
| 7068639 | Varma et al. | Jun 2006 | B1 |
| 7096483 | Johnson | Aug 2006 | B2 |
| 7099308 | Merrill et al. | Aug 2006 | B2 |
| 7100183 | Kunkel et al. | Aug 2006 | B2 |
| 7103905 | Novak | Sep 2006 | B2 |
| 7106382 | Shiotsu | Sep 2006 | B2 |
| 7146627 | Ismail et al. | Dec 2006 | B1 |
| 7149772 | Kalavade | Dec 2006 | B1 |
| 7167895 | Connelly | Jan 2007 | B1 |
| 7174126 | McElhatten et al. | Feb 2007 | B2 |
| 7174127 | Otten et al. | Feb 2007 | B2 |
| 7174385 | Li | Feb 2007 | B2 |
| 7185355 | Ellis et al. | Feb 2007 | B1 |
| 7197708 | Frendo et al. | Mar 2007 | B1 |
| 7206775 | Kaiser et al. | Apr 2007 | B2 |
| 7207055 | Hendricks et al. | Apr 2007 | B1 |
| 7209458 | Ahvonen et al. | Apr 2007 | B2 |
| 7213036 | Apparao et al. | May 2007 | B2 |
| 7228556 | Beach et al. | Jun 2007 | B2 |
| 7228656 | Mitchell et al. | Jun 2007 | B2 |
| 7240359 | Sie et al. | Jul 2007 | B1 |
| 7242960 | Van et al. | Jul 2007 | B2 |
| 7242988 | Hoffberg et al. | Jul 2007 | B1 |
| 7254608 | Yeager et al. | Aug 2007 | B2 |
| 7257106 | Chen et al. | Aug 2007 | B2 |
| 7260823 | Schlack et al. | Aug 2007 | B2 |
| 7265927 | Sugiyama et al. | Sep 2007 | B2 |
| 7293276 | Phillips et al. | Nov 2007 | B2 |
| 7312391 | Kaiser et al. | Dec 2007 | B2 |
| 7325043 | Rosenberg et al. | Jan 2008 | B1 |
| 7325073 | Shao et al. | Jan 2008 | B2 |
| 7330483 | Peters, Jr. et al. | Feb 2008 | B1 |
| 7330510 | Castillo et al. | Feb 2008 | B2 |
| 7333483 | Zhao et al. | Feb 2008 | B2 |
| 7336787 | Unger et al. | Feb 2008 | B2 |
| 7337458 | Michelitsch et al. | Feb 2008 | B2 |
| 7340759 | Rodriguez | Mar 2008 | B1 |
| 7340762 | Kim | Mar 2008 | B2 |
| 7359375 | Lipsanen et al. | Apr 2008 | B2 |
| 7363643 | Drake et al. | Apr 2008 | B2 |
| 7376386 | Phillips et al. | May 2008 | B2 |
| 7382786 | Chen et al. | Jun 2008 | B2 |
| 7406515 | Joyce et al. | Jul 2008 | B1 |
| 7444655 | Sardera | Oct 2008 | B2 |
| 7457520 | Rosetti et al. | Nov 2008 | B2 |
| 7486869 | Alexander et al. | Feb 2009 | B2 |
| 7487523 | Hendricks | Feb 2009 | B1 |
| 7532712 | Gonder et al. | May 2009 | B2 |
| 7543322 | Bhogal et al. | Jun 2009 | B1 |
| 7548562 | Ward et al. | Jun 2009 | B2 |
| 7567983 | Pickelsimer et al. | Jul 2009 | B2 |
| 7571452 | Gutta | Aug 2009 | B2 |
| 7592912 | Hasek et al. | Sep 2009 | B2 |
| 7602820 | Helms et al. | Oct 2009 | B2 |
| 7609637 | Doshi et al. | Oct 2009 | B2 |
| 7624337 | Sull et al. | Nov 2009 | B2 |
| 7650319 | Hoffberg et al. | Jan 2010 | B2 |
| 7690020 | Lebar | Mar 2010 | B2 |
| 7693171 | Gould | Apr 2010 | B2 |
| 7721314 | Sincaglia et al. | May 2010 | B2 |
| 7725553 | Rang et al. | May 2010 | B2 |
| 7742074 | Minatogawa | Jun 2010 | B2 |
| 7763360 | Paul et al. | Jul 2010 | B2 |
| 7770200 | Brooks et al. | Aug 2010 | B2 |
| 7787539 | Chen | Aug 2010 | B2 |
| 7809942 | Baran et al. | Oct 2010 | B2 |
| 7889765 | Brooks et al. | Feb 2011 | B2 |
| 7893171 | Le et al. | Feb 2011 | B2 |
| 7900052 | Jonas et al. | Mar 2011 | B2 |
| 7908626 | Williamson et al. | Mar 2011 | B2 |
| 7916755 | Hasek et al. | Mar 2011 | B2 |
| 7924451 | Hirooka | Apr 2011 | B2 |
| 7936775 | Iwamura | May 2011 | B2 |
| 7937725 | Schaffer et al. | May 2011 | B1 |
| 7954131 | Cholas et al. | May 2011 | B2 |
| 7975283 | Bedingfield, Sr. et al. | Jul 2011 | B2 |
| 7987491 | Reisman | Jul 2011 | B2 |
| 8015306 | Bowman | Sep 2011 | B2 |
| 8024762 | Britt | Sep 2011 | B2 |
| 8032914 | Rodriguez | Oct 2011 | B2 |
| 8042054 | White et al. | Oct 2011 | B2 |
| 8046836 | Isokawa | Oct 2011 | B2 |
| 8056103 | Candelore | Nov 2011 | B2 |
| 8073460 | Scofield et al. | Dec 2011 | B1 |
| 8078696 | Lajoie et al. | Dec 2011 | B2 |
| 8090014 | Cheung et al. | Jan 2012 | B2 |
| 8090104 | Wajs et al. | Jan 2012 | B2 |
| 8095610 | Gould et al. | Jan 2012 | B2 |
| 8099757 | Riedl et al. | Jan 2012 | B2 |
| 8151194 | Chan et al. | Apr 2012 | B1 |
| 8151294 | Carlucci et al. | Apr 2012 | B2 |
| 8166126 | Bristow et al. | Apr 2012 | B2 |
| 8170065 | Hasek et al. | May 2012 | B2 |
| 8181209 | Hasek et al. | May 2012 | B2 |
| 8196201 | Repasi | Jun 2012 | B2 |
| 8214256 | Riedl et al. | Jul 2012 | B2 |
| 8219134 | Maharajh et al. | Jul 2012 | B2 |
| 8249497 | Ingrassia et al. | Aug 2012 | B2 |
| 8280833 | Miltonberger | Oct 2012 | B2 |
| 8280982 | La et al. | Oct 2012 | B2 |
| 8281352 | Brooks et al. | Oct 2012 | B2 |
| 8290811 | Robinson et al. | Oct 2012 | B1 |
| 8341242 | Dillon et al. | Dec 2012 | B2 |
| 8347341 | Markley et al. | Jan 2013 | B2 |
| 8396055 | Patel et al. | Mar 2013 | B2 |
| 8429702 | Yasrebi et al. | Apr 2013 | B2 |
| 8472371 | Bari et al. | Jun 2013 | B1 |
| 8479251 | Feinleib et al. | Jul 2013 | B2 |
| 8484511 | Engel et al. | Jul 2013 | B2 |
| 8516529 | Lajoie et al. | Aug 2013 | B2 |
| 8520850 | Helms et al. | Aug 2013 | B2 |
| 8549013 | Sarma et al. | Oct 2013 | B1 |
| 8561103 | Begeja et al. | Oct 2013 | B2 |
| 8561116 | Hasek | Oct 2013 | B2 |
| 8677431 | Smith | Mar 2014 | B2 |
| 8713623 | Brooks | Apr 2014 | B2 |
| 8731053 | Karegoudar | May 2014 | B2 |
| 8738607 | Dettinger et al. | May 2014 | B2 |
| 8750490 | Murtagh et al. | Jun 2014 | B2 |
| 8750909 | Fan et al. | Jun 2014 | B2 |
| 8805270 | Maharajh et al. | Aug 2014 | B2 |
| 8813122 | Montie et al. | Aug 2014 | B1 |
| 8838149 | Hasek | Sep 2014 | B2 |
| 8949919 | Cholas et al. | Feb 2015 | B2 |
| 8995815 | Maharajh et al. | Mar 2015 | B2 |
| 9021566 | Panayotopoulos et al. | Apr 2015 | B1 |
| 9043431 | Chappell et al. | May 2015 | B2 |
| 9124608 | Jin et al. | Sep 2015 | B2 |
| 9124650 | Maharajh et al. | Sep 2015 | B2 |
| 9215423 | Kimble et al. | Dec 2015 | B2 |
| 9473730 | Roy et al. | Oct 2016 | B1 |
| 9906838 | Cronk et al. | Feb 2018 | B2 |
| 20010004768 | Hodge et al. | Jun 2001 | A1 |
| 20010043613 | Wibowo et al. | Nov 2001 | A1 |
| 20010047516 | Swain et al. | Nov 2001 | A1 |
| 20010050924 | Herrmann et al. | Dec 2001 | A1 |
| 20010050945 | Lindsey | Dec 2001 | A1 |
| 20020002688 | Gregg et al. | Jan 2002 | A1 |
| 20020024943 | Karaul et al. | Feb 2002 | A1 |
| 20020026645 | Son et al. | Feb 2002 | A1 |
| 20020027883 | Belaiche | Mar 2002 | A1 |
| 20020027894 | Arrakoski et al. | Mar 2002 | A1 |
| 20020031120 | Rakib | Mar 2002 | A1 |
| 20020032754 | Logston et al. | Mar 2002 | A1 |
| 20020042914 | Walker et al. | Apr 2002 | A1 |
| 20020042921 | Ellis | Apr 2002 | A1 |
| 20020049755 | Koike | Apr 2002 | A1 |
| 20020053076 | Landesmann | May 2002 | A1 |
| 20020056087 | Berezowski et al. | May 2002 | A1 |
| 20020056125 | Hodge et al. | May 2002 | A1 |
| 20020059218 | August et al. | May 2002 | A1 |
| 20020059619 | Lebar | May 2002 | A1 |
| 20020066033 | Dobbins et al. | May 2002 | A1 |
| 20020083451 | Gill et al. | Jun 2002 | A1 |
| 20020087995 | Pedlow et al. | Jul 2002 | A1 |
| 20020100059 | Buehl et al. | Jul 2002 | A1 |
| 20020123931 | Splaver et al. | Sep 2002 | A1 |
| 20020131511 | Zenoni | Sep 2002 | A1 |
| 20020133815 | Mizutome et al. | Sep 2002 | A1 |
| 20020143607 | Connelly | Oct 2002 | A1 |
| 20020144267 | Gutta et al. | Oct 2002 | A1 |
| 20020147771 | Traversat et al. | Oct 2002 | A1 |
| 20020152091 | Nagaoka et al. | Oct 2002 | A1 |
| 20020152299 | Traversat et al. | Oct 2002 | A1 |
| 20020152474 | Dudkiewicz | Oct 2002 | A1 |
| 20020174430 | Ellis et al. | Nov 2002 | A1 |
| 20020174433 | Baumgartner et al. | Nov 2002 | A1 |
| 20020178444 | Trajkovic et al. | Nov 2002 | A1 |
| 20020188744 | Mani | Dec 2002 | A1 |
| 20020188869 | Patrick | Dec 2002 | A1 |
| 20020188947 | Wang et al. | Dec 2002 | A1 |
| 20020188949 | Wang et al. | Dec 2002 | A1 |
| 20020191950 | Wang | Dec 2002 | A1 |
| 20020194595 | Miller et al. | Dec 2002 | A1 |
| 20030005453 | Rodriguez et al. | Jan 2003 | A1 |
| 20030005457 | Faibish et al. | Jan 2003 | A1 |
| 20030028451 | Ananian | Feb 2003 | A1 |
| 20030028873 | Lemmons | Feb 2003 | A1 |
| 20030046704 | Laksono et al. | Mar 2003 | A1 |
| 20030056217 | Brooks | Mar 2003 | A1 |
| 20030061618 | Horiuchi et al. | Mar 2003 | A1 |
| 20030086422 | Klinker et al. | May 2003 | A1 |
| 20030093790 | Logan et al. | May 2003 | A1 |
| 20030093794 | Thomas et al. | May 2003 | A1 |
| 20030097574 | Upton | May 2003 | A1 |
| 20030115267 | Hinton et al. | Jun 2003 | A1 |
| 20030118014 | Iyer et al. | Jun 2003 | A1 |
| 20030120817 | Ott et al. | Jun 2003 | A1 |
| 20030123465 | Donahue | Jul 2003 | A1 |
| 20030135628 | Fletcher et al. | Jul 2003 | A1 |
| 20030135860 | Dureau | Jul 2003 | A1 |
| 20030163443 | Wang | Aug 2003 | A1 |
| 20030165241 | Fransdonk | Sep 2003 | A1 |
| 20030166401 | Combes et al. | Sep 2003 | A1 |
| 20030188317 | Liew et al. | Oct 2003 | A1 |
| 20030200548 | Baran et al. | Oct 2003 | A1 |
| 20030208767 | Williamson et al. | Nov 2003 | A1 |
| 20030217137 | Roese et al. | Nov 2003 | A1 |
| 20030217365 | Caputo | Nov 2003 | A1 |
| 20030220100 | McElhatten et al. | Nov 2003 | A1 |
| 20040015986 | Carver et al. | Jan 2004 | A1 |
| 20040019913 | Wong et al. | Jan 2004 | A1 |
| 20040031058 | Reisman | Feb 2004 | A1 |
| 20040034677 | Davey et al. | Feb 2004 | A1 |
| 20040034877 | Nogues | Feb 2004 | A1 |
| 20040045032 | Cummings et al. | Mar 2004 | A1 |
| 20040045035 | Cummings et al. | Mar 2004 | A1 |
| 20040045037 | Cummings et al. | Mar 2004 | A1 |
| 20040049694 | Candelore | Mar 2004 | A1 |
| 20040057457 | Ahn et al. | Mar 2004 | A1 |
| 20040083177 | Chen et al. | Apr 2004 | A1 |
| 20040117254 | Nemirofsky et al. | Jun 2004 | A1 |
| 20040117838 | Karaoguz et al. | Jun 2004 | A1 |
| 20040117855 | Nakamura | Jun 2004 | A1 |
| 20040133923 | Watson et al. | Jul 2004 | A1 |
| 20040137918 | Varonen et al. | Jul 2004 | A1 |
| 20040158870 | Paxton et al. | Aug 2004 | A1 |
| 20040166832 | Portman et al. | Aug 2004 | A1 |
| 20040216158 | Blas | Oct 2004 | A1 |
| 20040230994 | Urdang et al. | Nov 2004 | A1 |
| 20040250273 | Swix et al. | Dec 2004 | A1 |
| 20040268398 | Fano et al. | Dec 2004 | A1 |
| 20040268403 | Krieger et al. | Dec 2004 | A1 |
| 20050002418 | Yang et al. | Jan 2005 | A1 |
| 20050002638 | Putterman et al. | Jan 2005 | A1 |
| 20050005308 | Logan et al. | Jan 2005 | A1 |
| 20050028208 | Ellis et al. | Feb 2005 | A1 |
| 20050034171 | Benya | Feb 2005 | A1 |
| 20050047501 | Yoshida et al. | Mar 2005 | A1 |
| 20050049886 | Grannan et al. | Mar 2005 | A1 |
| 20050050579 | Dietz et al. | Mar 2005 | A1 |
| 20050055220 | Lee et al. | Mar 2005 | A1 |
| 20050055729 | Atad et al. | Mar 2005 | A1 |
| 20050071882 | Rodriguez et al. | Mar 2005 | A1 |
| 20050083921 | McDermott, III | Apr 2005 | A1 |
| 20050086334 | Aaltonen et al. | Apr 2005 | A1 |
| 20050086683 | Meyerson | Apr 2005 | A1 |
| 20050097599 | Plotnick et al. | May 2005 | A1 |
| 20050108763 | Baran et al. | May 2005 | A1 |
| 20050114701 | Atkins et al. | May 2005 | A1 |
| 20050114900 | Ladd et al. | May 2005 | A1 |
| 20050157731 | Peters | Jul 2005 | A1 |
| 20050165899 | Mazzola | Jul 2005 | A1 |
| 20050177855 | Maynard et al. | Aug 2005 | A1 |
| 20050188415 | Riley | Aug 2005 | A1 |
| 20050223097 | Ramsayer et al. | Oct 2005 | A1 |
| 20050228725 | Rao et al. | Oct 2005 | A1 |
| 20050289616 | Horiuchi et al. | Dec 2005 | A1 |
| 20050289618 | Hardin | Dec 2005 | A1 |
| 20060020786 | Helms et al. | Jan 2006 | A1 |
| 20060021004 | Moran et al. | Jan 2006 | A1 |
| 20060021019 | Hinton et al. | Jan 2006 | A1 |
| 20060041905 | Wasilewski | Feb 2006 | A1 |
| 20060041915 | Dimitrova et al. | Feb 2006 | A1 |
| 20060047957 | Helms et al. | Mar 2006 | A1 |
| 20060053463 | Choi | Mar 2006 | A1 |
| 20060059532 | Dugan et al. | Mar 2006 | A1 |
| 20060061682 | Bradley et al. | Mar 2006 | A1 |
| 20060090186 | Santangelo et al. | Apr 2006 | A1 |
| 20060095940 | Yearwood | May 2006 | A1 |
| 20060117379 | Bennett et al. | Jun 2006 | A1 |
| 20060128397 | Choti et al. | Jun 2006 | A1 |
| 20060130099 | Rooyen | Jun 2006 | A1 |
| 20060130101 | Wessel et al. | Jun 2006 | A1 |
| 20060130107 | Gonder et al. | Jun 2006 | A1 |
| 20060130113 | Carlucci et al. | Jun 2006 | A1 |
| 20060136964 | Diez et al. | Jun 2006 | A1 |
| 20060136968 | Han et al. | Jun 2006 | A1 |
| 20060139379 | Toma et al. | Jun 2006 | A1 |
| 20060149850 | Bowman | Jul 2006 | A1 |
| 20060156392 | Baugher et al. | Jul 2006 | A1 |
| 20060161635 | Lamkin et al. | Jul 2006 | A1 |
| 20060165082 | Pfeffer et al. | Jul 2006 | A1 |
| 20060165173 | Kim et al. | Jul 2006 | A1 |
| 20060171423 | Helms et al. | Aug 2006 | A1 |
| 20060187900 | Akbar | Aug 2006 | A1 |
| 20060206712 | Dillaway et al. | Sep 2006 | A1 |
| 20060209799 | Gallagher et al. | Sep 2006 | A1 |
| 20060218601 | Michel | Sep 2006 | A1 |
| 20060218604 | Riedl et al. | Sep 2006 | A1 |
| 20060221246 | Yoo | Oct 2006 | A1 |
| 20060224690 | Falkenburg et al. | Oct 2006 | A1 |
| 20060236358 | Liu et al. | Oct 2006 | A1 |
| 20060238656 | Chen et al. | Oct 2006 | A1 |
| 20060248553 | Mikkelson et al. | Nov 2006 | A1 |
| 20060259927 | Acharya et al. | Nov 2006 | A1 |
| 20060288366 | Boylan, III | Dec 2006 | A1 |
| 20060291506 | Cain | Dec 2006 | A1 |
| 20070014293 | Filsfils et al. | Jan 2007 | A1 |
| 20070019645 | Menon | Jan 2007 | A1 |
| 20070022459 | Gaebel et al. | Jan 2007 | A1 |
| 20070022469 | Cooper et al. | Jan 2007 | A1 |
| 20070025372 | Brenes et al. | Feb 2007 | A1 |
| 20070033282 | Mao et al. | Feb 2007 | A1 |
| 20070033531 | Marsh | Feb 2007 | A1 |
| 20070038671 | Holm et al. | Feb 2007 | A1 |
| 20070049245 | Lipman | Mar 2007 | A1 |
| 20070050822 | Stevens et al. | Mar 2007 | A1 |
| 20070053513 | Hoffberg et al. | Mar 2007 | A1 |
| 20070061023 | Hoffberg et al. | Mar 2007 | A1 |
| 20070067851 | Fernando et al. | Mar 2007 | A1 |
| 20070073704 | Bowden et al. | Mar 2007 | A1 |
| 20070076728 | Rieger et al. | Apr 2007 | A1 |
| 20070081537 | Wheelock | Apr 2007 | A1 |
| 20070094691 | Gazdzinski | Apr 2007 | A1 |
| 20070113246 | Xiong | May 2007 | A1 |
| 20070118848 | Schwesinger et al. | May 2007 | A1 |
| 20070121578 | Annadata et al. | May 2007 | A1 |
| 20070121678 | Brooks et al. | May 2007 | A1 |
| 20070124488 | Baum et al. | May 2007 | A1 |
| 20070127519 | Hasek et al. | Jun 2007 | A1 |
| 20070136777 | Hasek et al. | Jun 2007 | A1 |
| 20070153820 | Gould | Jul 2007 | A1 |
| 20070154041 | Beauchamp | Jul 2007 | A1 |
| 20070157228 | Bayer et al. | Jul 2007 | A1 |
| 20070157234 | Walker | Jul 2007 | A1 |
| 20070157262 | Ramaswamy et al. | Jul 2007 | A1 |
| 20070180230 | Cortez | Aug 2007 | A1 |
| 20070192103 | Sato et al. | Aug 2007 | A1 |
| 20070199019 | Angiolillo et al. | Aug 2007 | A1 |
| 20070204300 | Markley et al. | Aug 2007 | A1 |
| 20070204308 | Nicholas et al. | Aug 2007 | A1 |
| 20070204314 | Hasek et al. | Aug 2007 | A1 |
| 20070209054 | Cassanova | Sep 2007 | A1 |
| 20070209059 | Moore et al. | Sep 2007 | A1 |
| 20070217436 | Markley et al. | Sep 2007 | A1 |
| 20070219910 | Martinez | Sep 2007 | A1 |
| 20070226365 | Hildreth et al. | Sep 2007 | A1 |
| 20070245376 | Svendsen | Oct 2007 | A1 |
| 20070250880 | Hainline | Oct 2007 | A1 |
| 20070261089 | Aaby et al. | Nov 2007 | A1 |
| 20070261116 | Prafullchandra et al. | Nov 2007 | A1 |
| 20070276925 | La et al. | Nov 2007 | A1 |
| 20070276926 | Lajoie et al. | Nov 2007 | A1 |
| 20070280298 | Hearn et al. | Dec 2007 | A1 |
| 20070288637 | Layton et al. | Dec 2007 | A1 |
| 20070288715 | Boswell et al. | Dec 2007 | A1 |
| 20070294717 | Hill et al. | Dec 2007 | A1 |
| 20070294738 | Kuo et al. | Dec 2007 | A1 |
| 20070299728 | Nemirofsky et al. | Dec 2007 | A1 |
| 20080021836 | Lao | Jan 2008 | A1 |
| 20080022012 | Wang | Jan 2008 | A1 |
| 20080027801 | Walter et al. | Jan 2008 | A1 |
| 20080036917 | Pascarella et al. | Feb 2008 | A1 |
| 20080059804 | Shah et al. | Mar 2008 | A1 |
| 20080066095 | Reinoso | Mar 2008 | A1 |
| 20080066112 | Bailey et al. | Mar 2008 | A1 |
| 20080085750 | Yoshizawa | Apr 2008 | A1 |
| 20080086750 | Yasrebi et al. | Apr 2008 | A1 |
| 20080091805 | Malaby et al. | Apr 2008 | A1 |
| 20080091807 | Strub et al. | Apr 2008 | A1 |
| 20080092058 | Afergan et al. | Apr 2008 | A1 |
| 20080092181 | Britt | Apr 2008 | A1 |
| 20080098212 | Helms et al. | Apr 2008 | A1 |
| 20080098241 | Cheshire | Apr 2008 | A1 |
| 20080098450 | Wu et al. | Apr 2008 | A1 |
| 20080101460 | Rodriguez | May 2008 | A1 |
| 20080101763 | Bhogal et al. | May 2008 | A1 |
| 20080109853 | Einarsson et al. | May 2008 | A1 |
| 20080112405 | Cholas et al. | May 2008 | A1 |
| 20080133551 | Wensley et al. | Jun 2008 | A1 |
| 20080134043 | Georgis et al. | Jun 2008 | A1 |
| 20080134165 | Anderson et al. | Jun 2008 | A1 |
| 20080137541 | Agarwal et al. | Jun 2008 | A1 |
| 20080137740 | Thoreau et al. | Jun 2008 | A1 |
| 20080155059 | Hardin et al. | Jun 2008 | A1 |
| 20080155614 | Cooper et al. | Jun 2008 | A1 |
| 20080162353 | Tom et al. | Jul 2008 | A1 |
| 20080168487 | Chow et al. | Jul 2008 | A1 |
| 20080170530 | Connors et al. | Jul 2008 | A1 |
| 20080170551 | Zaks | Jul 2008 | A1 |
| 20080172696 | Furusawa et al. | Jul 2008 | A1 |
| 20080177998 | Apsangi et al. | Jul 2008 | A1 |
| 20080178225 | Jost | Jul 2008 | A1 |
| 20080184344 | Hernacki et al. | Jul 2008 | A1 |
| 20080189617 | Covell et al. | Aug 2008 | A1 |
| 20080192820 | Brooks et al. | Aug 2008 | A1 |
| 20080198780 | Sato | Aug 2008 | A1 |
| 20080200154 | Maharajh et al. | Aug 2008 | A1 |
| 20080201386 | Maharajh et al. | Aug 2008 | A1 |
| 20080201736 | Gordon et al. | Aug 2008 | A1 |
| 20080201748 | Hasek et al. | Aug 2008 | A1 |
| 20080215755 | Farber et al. | Sep 2008 | A1 |
| 20080222684 | Mukraj et al. | Sep 2008 | A1 |
| 20080229379 | Akhter | Sep 2008 | A1 |
| 20080235746 | Peters et al. | Sep 2008 | A1 |
| 20080244667 | Osborne | Oct 2008 | A1 |
| 20080256615 | Schlacht et al. | Oct 2008 | A1 |
| 20080273591 | Brooks et al. | Nov 2008 | A1 |
| 20080279534 | Buttars | Nov 2008 | A1 |
| 20080281971 | Leppanen et al. | Nov 2008 | A1 |
| 20080282299 | Koat et al. | Nov 2008 | A1 |
| 20080294713 | Saylor et al. | Nov 2008 | A1 |
| 20080297669 | Zalewski et al. | Dec 2008 | A1 |
| 20080306903 | Larson et al. | Dec 2008 | A1 |
| 20080320523 | Morris et al. | Dec 2008 | A1 |
| 20080320528 | Kim et al. | Dec 2008 | A1 |
| 20080320540 | Brooks et al. | Dec 2008 | A1 |
| 20090006211 | Perry et al. | Jan 2009 | A1 |
| 20090019488 | Ruiz-Velasco et al. | Jan 2009 | A1 |
| 20090025027 | Craner | Jan 2009 | A1 |
| 20090030802 | Plotnick et al. | Jan 2009 | A1 |
| 20090031335 | Hendricks et al. | Jan 2009 | A1 |
| 20090064221 | Stevens | Mar 2009 | A1 |
| 20090070842 | Corson et al. | Mar 2009 | A1 |
| 20090076898 | Wang et al. | Mar 2009 | A1 |
| 20090077583 | Sugiyama et al. | Mar 2009 | A1 |
| 20090083279 | Hasek et al. | Mar 2009 | A1 |
| 20090083811 | Dolce et al. | Mar 2009 | A1 |
| 20090083813 | Dolce et al. | Mar 2009 | A1 |
| 20090086643 | Kotrla et al. | Apr 2009 | A1 |
| 20090094347 | Ting et al. | Apr 2009 | A1 |
| 20090098861 | Kalliola et al. | Apr 2009 | A1 |
| 20090100459 | Riedl et al. | Apr 2009 | A1 |
| 20090100493 | Jones et al. | Apr 2009 | A1 |
| 20090119703 | Piepenbrink et al. | May 2009 | A1 |
| 20090132347 | Anderson et al. | May 2009 | A1 |
| 20090133048 | Gibbs et al. | May 2009 | A1 |
| 20090133090 | Busse | May 2009 | A1 |
| 20090141696 | Chou et al. | Jun 2009 | A1 |
| 20090150210 | Athsani et al. | Jun 2009 | A1 |
| 20090150917 | Huffman et al. | Jun 2009 | A1 |
| 20090151006 | Saeki et al. | Jun 2009 | A1 |
| 20090158311 | Hon et al. | Jun 2009 | A1 |
| 20090172776 | Makagon et al. | Jul 2009 | A1 |
| 20090175218 | Song et al. | Jul 2009 | A1 |
| 20090178089 | Picco et al. | Jul 2009 | A1 |
| 20090185576 | Kisel et al. | Jul 2009 | A1 |
| 20090187939 | Lajoie | Jul 2009 | A1 |
| 20090187944 | White et al. | Jul 2009 | A1 |
| 20090193097 | Gassewitz et al. | Jul 2009 | A1 |
| 20090193486 | Patel et al. | Jul 2009 | A1 |
| 20090201917 | Maes et al. | Aug 2009 | A1 |
| 20090210899 | Lawrence-Apfelbaum et al. | Aug 2009 | A1 |
| 20090210912 | Cholas et al. | Aug 2009 | A1 |
| 20090225760 | Foti | Sep 2009 | A1 |
| 20090228941 | Russell et al. | Sep 2009 | A1 |
| 20090235308 | Ehlers et al. | Sep 2009 | A1 |
| 20090248794 | Helms et al. | Oct 2009 | A1 |
| 20090282241 | Prafullchandra et al. | Nov 2009 | A1 |
| 20090282449 | Lee | Nov 2009 | A1 |
| 20090293101 | Carter et al. | Nov 2009 | A1 |
| 20090296621 | Park et al. | Dec 2009 | A1 |
| 20090307318 | Chappell et al. | Dec 2009 | A1 |
| 20090327057 | Redlich | Dec 2009 | A1 |
| 20090328105 | Craner et al. | Dec 2009 | A1 |
| 20100011388 | Bull et al. | Jan 2010 | A1 |
| 20100012568 | Fujisawa et al. | Jan 2010 | A1 |
| 20100027560 | Yang et al. | Feb 2010 | A1 |
| 20100027787 | Benkert et al. | Feb 2010 | A1 |
| 20100030578 | Siddique et al. | Feb 2010 | A1 |
| 20100031299 | Harrang et al. | Feb 2010 | A1 |
| 20100036720 | Jain et al. | Feb 2010 | A1 |
| 20100042478 | Reisman | Feb 2010 | A1 |
| 20100043030 | White | Feb 2010 | A1 |
| 20100046927 | Manthoulis et al. | Feb 2010 | A1 |
| 20100082635 | Elsner et al. | Apr 2010 | A1 |
| 20100083329 | Joyce et al. | Apr 2010 | A1 |
| 20100083362 | Francisco et al. | Apr 2010 | A1 |
| 20100086020 | Schlack | Apr 2010 | A1 |
| 20100106846 | Noldus et al. | Apr 2010 | A1 |
| 20100115091 | Park et al. | May 2010 | A1 |
| 20100115113 | Short et al. | May 2010 | A1 |
| 20100115540 | Fan et al. | May 2010 | A1 |
| 20100121936 | Liu et al. | May 2010 | A1 |
| 20100122274 | Gillies et al. | May 2010 | A1 |
| 20100122276 | Chen | May 2010 | A1 |
| 20100125658 | Strasters | May 2010 | A1 |
| 20100131973 | Dillon et al. | May 2010 | A1 |
| 20100132003 | Bennett et al. | May 2010 | A1 |
| 20100135646 | Bang et al. | Jun 2010 | A1 |
| 20100138900 | Peterka et al. | Jun 2010 | A1 |
| 20100145917 | Bone et al. | Jun 2010 | A1 |
| 20100146541 | Velazquez | Jun 2010 | A1 |
| 20100162367 | Lajoie et al. | Jun 2010 | A1 |
| 20100169503 | Kollmansberger et al. | Jul 2010 | A1 |
| 20100169977 | Dasher et al. | Jul 2010 | A1 |
| 20100186029 | Kim et al. | Jul 2010 | A1 |
| 20100198655 | Ketchum et al. | Aug 2010 | A1 |
| 20100199299 | Chang et al. | Aug 2010 | A1 |
| 20100199312 | Chang et al. | Aug 2010 | A1 |
| 20100217613 | Kelly | Aug 2010 | A1 |
| 20100218231 | Frink et al. | Aug 2010 | A1 |
| 20100219613 | Zaloom et al. | Sep 2010 | A1 |
| 20100251304 | Donoghue et al. | Sep 2010 | A1 |
| 20100251305 | Kimble et al. | Sep 2010 | A1 |
| 20100262461 | Bohannon | Oct 2010 | A1 |
| 20100262999 | Curran | Oct 2010 | A1 |
| 20100269144 | Forsman et al. | Oct 2010 | A1 |
| 20100280641 | Harkness et al. | Nov 2010 | A1 |
| 20100287588 | Cox et al. | Nov 2010 | A1 |
| 20100287609 | Gonzalez et al. | Nov 2010 | A1 |
| 20100293494 | Schmidt | Nov 2010 | A1 |
| 20100312826 | Sarosi et al. | Dec 2010 | A1 |
| 20100313225 | Cholas et al. | Dec 2010 | A1 |
| 20100325547 | Keng et al. | Dec 2010 | A1 |
| 20100333137 | Hamano et al. | Dec 2010 | A1 |
| 20110015989 | Tidwell et al. | Jan 2011 | A1 |
| 20110016479 | Tidwell et al. | Jan 2011 | A1 |
| 20110016482 | Tidwell et al. | Jan 2011 | A1 |
| 20110055866 | Piepenbrink et al. | Mar 2011 | A1 |
| 20110058675 | Brueck et al. | Mar 2011 | A1 |
| 20110071841 | Fomenko et al. | Mar 2011 | A1 |
| 20110078001 | Archer et al. | Mar 2011 | A1 |
| 20110078005 | Klappert | Mar 2011 | A1 |
| 20110078731 | Nishimura | Mar 2011 | A1 |
| 20110083069 | Paul et al. | Apr 2011 | A1 |
| 20110083144 | Bocharov et al. | Apr 2011 | A1 |
| 20110090898 | Patel et al. | Apr 2011 | A1 |
| 20110093900 | Patel et al. | Apr 2011 | A1 |
| 20110099017 | Ure | Apr 2011 | A1 |
| 20110102600 | Todd | May 2011 | A1 |
| 20110103374 | Lajoie et al. | May 2011 | A1 |
| 20110107364 | Lajoie et al. | May 2011 | A1 |
| 20110107379 | Lajoie et al. | May 2011 | A1 |
| 20110110515 | Tidwell et al. | May 2011 | A1 |
| 20110126018 | Narsinh et al. | May 2011 | A1 |
| 20110126244 | Hasek | May 2011 | A1 |
| 20110126246 | Thomas et al. | May 2011 | A1 |
| 20110138064 | Rieger et al. | Jun 2011 | A1 |
| 20110145049 | Hertel et al. | Jun 2011 | A1 |
| 20110154383 | Hao et al. | Jun 2011 | A1 |
| 20110166932 | Smith et al. | Jul 2011 | A1 |
| 20110173053 | Aaltonen et al. | Jul 2011 | A1 |
| 20110173095 | Kassaei et al. | Jul 2011 | A1 |
| 20110178943 | Motahari et al. | Jul 2011 | A1 |
| 20110191801 | Vytheeswaran | Aug 2011 | A1 |
| 20110212756 | Packard et al. | Sep 2011 | A1 |
| 20110213688 | Santos et al. | Sep 2011 | A1 |
| 20110219229 | Cholas et al. | Sep 2011 | A1 |
| 20110219411 | Smith | Sep 2011 | A1 |
| 20110223944 | Gosselin | Sep 2011 | A1 |
| 20110231660 | Kanungo | Sep 2011 | A1 |
| 20110239253 | West et al. | Sep 2011 | A1 |
| 20110246616 | Ronca et al. | Oct 2011 | A1 |
| 20110258049 | Ramer et al. | Oct 2011 | A1 |
| 20110264530 | Santangelo et al. | Oct 2011 | A1 |
| 20110265116 | Stern et al. | Oct 2011 | A1 |
| 20110276881 | Keng et al. | Nov 2011 | A1 |
| 20110277008 | Smith | Nov 2011 | A1 |
| 20110302624 | Chen et al. | Dec 2011 | A1 |
| 20120005527 | Engel et al. | Jan 2012 | A1 |
| 20120008786 | Cronk et al. | Jan 2012 | A1 |
| 20120011567 | Cronk et al. | Jan 2012 | A1 |
| 20120023535 | Brooks et al. | Jan 2012 | A1 |
| 20120030363 | Conrad | Feb 2012 | A1 |
| 20120072526 | Kling et al. | Mar 2012 | A1 |
| 20120076015 | Pfeffer | Mar 2012 | A1 |
| 20120079523 | Trimper et al. | Mar 2012 | A1 |
| 20120089699 | Cholas | Apr 2012 | A1 |
| 20120096106 | Blumofe et al. | Apr 2012 | A1 |
| 20120124149 | Gross et al. | May 2012 | A1 |
| 20120124606 | Tidwell et al. | May 2012 | A1 |
| 20120124612 | Adimatyam et al. | May 2012 | A1 |
| 20120131139 | Siripurapu et al. | May 2012 | A1 |
| 20120137332 | Kumar | May 2012 | A1 |
| 20120144195 | Nair et al. | Jun 2012 | A1 |
| 20120144416 | Wetzer et al. | Jun 2012 | A1 |
| 20120151077 | Finster | Jun 2012 | A1 |
| 20120166530 | Tseng et al. | Jun 2012 | A1 |
| 20120167132 | Mathews et al. | Jun 2012 | A1 |
| 20120170544 | Cheng et al. | Jul 2012 | A1 |
| 20120170741 | Chen et al. | Jul 2012 | A1 |
| 20120173746 | Salinger et al. | Jul 2012 | A1 |
| 20120185693 | Chen et al. | Jul 2012 | A1 |
| 20120185899 | Riedl et al. | Jul 2012 | A1 |
| 20120191844 | Boyns et al. | Jul 2012 | A1 |
| 20120197980 | Terleski et al. | Aug 2012 | A1 |
| 20120215878 | Kidron | Aug 2012 | A1 |
| 20120215903 | Fleischman et al. | Aug 2012 | A1 |
| 20120246462 | Moroney et al. | Sep 2012 | A1 |
| 20120278833 | Tam et al. | Nov 2012 | A1 |
| 20120284804 | Lindquist et al. | Nov 2012 | A1 |
| 20120308071 | Ramsdell et al. | Dec 2012 | A1 |
| 20120324552 | Padala et al. | Dec 2012 | A1 |
| 20130014140 | Ye et al. | Jan 2013 | A1 |
| 20130014171 | Sansom et al. | Jan 2013 | A1 |
| 20130024888 | Sivertsen | Jan 2013 | A1 |
| 20130024891 | Elend et al. | Jan 2013 | A1 |
| 20130024901 | Sharif-Ahmadi et al. | Jan 2013 | A1 |
| 20130031578 | Zhu et al. | Jan 2013 | A1 |
| 20130039338 | Suzuki et al. | Feb 2013 | A1 |
| 20130046849 | Wolf et al. | Feb 2013 | A1 |
| 20130067039 | Hartzler | Mar 2013 | A1 |
| 20130073400 | Heath | Mar 2013 | A1 |
| 20130097647 | Brooks et al. | Apr 2013 | A1 |
| 20130117692 | Padmanabhan et al. | May 2013 | A1 |
| 20130132986 | Mack et al. | May 2013 | A1 |
| 20130133010 | Chen | May 2013 | A1 |
| 20130166906 | Swaminathan et al. | Jun 2013 | A1 |
| 20130173745 | Biderman | Jul 2013 | A1 |
| 20130174271 | Handal et al. | Jul 2013 | A1 |
| 20130179588 | McCarthy et al. | Jul 2013 | A1 |
| 20130198770 | Xiong et al. | Aug 2013 | A1 |
| 20130219178 | Xiques et al. | Aug 2013 | A1 |
| 20130227283 | Williamson et al. | Aug 2013 | A1 |
| 20130227284 | Pfeffer et al. | Aug 2013 | A1 |
| 20130311464 | Nix et al. | Nov 2013 | A1 |
| 20140012843 | Soon-Shiong | Jan 2014 | A1 |
| 20140074855 | Zhao et al. | Mar 2014 | A1 |
| 20140201799 | Smith | Jul 2014 | A1 |
| 20140230003 | Ma et al. | Aug 2014 | A1 |
| 20140245341 | Mack et al. | Aug 2014 | A1 |
| 20140259182 | Mershon | Sep 2014 | A1 |
| 20140351437 | Madani | Nov 2014 | A1 |
| 20150020126 | Kegel et al. | Jan 2015 | A1 |
| 20150040176 | Hybertson et al. | Feb 2015 | A1 |
| 20150095932 | Ren | Apr 2015 | A1 |
| 20150109122 | Stern et al. | Apr 2015 | A1 |
| 20150161386 | Gupta et al. | Jun 2015 | A1 |
| 20150163540 | Masterson | Jun 2015 | A1 |
| 20160241617 | Jelley et al. | Aug 2016 | A1 |
| 20170048357 | Pfeffer et al. | Feb 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 1087619 | Mar 2001 | EP |
| 1821459 | Aug 2007 | EP |
| 2001275090 | Oct 2001 | JP |
| 2005519365 | Jun 2005 | JP |
| 2005519501 | Jun 2005 | JP |
| 2005339093 | Dec 2005 | JP |
| 2008015936 | Jan 2008 | JP |
| 2009211632 | Sep 2009 | JP |
| 2010502109 | Jan 2010 | JP |
| 2010079902 | Apr 2010 | JP |
| 2012505436 | Mar 2012 | JP |
| 2012523614 | Oct 2012 | JP |
| WO-0011871 | Mar 2000 | WO |
| WO-0052928 | Sep 2000 | WO |
| WO-0110125 | Feb 2001 | WO |
| WO-0139505 | May 2001 | WO |
| WO-0156285 | Aug 2001 | WO |
| WO-0195610 | Dec 2001 | WO |
| WO-0195621 | Dec 2001 | WO |
| WO-2005015422 | Feb 2005 | WO |
| WO-2005031524 | Apr 2005 | WO |
| WO-2007060451 | May 2007 | WO |
| WO-2010008487 | Jan 2010 | WO |
| WO-2011035443 | Mar 2011 | WO |
| WO-2011053858 | May 2011 | WO |
| WO-2012021245 | Feb 2012 | WO |
| WO-2012114140 | Aug 2012 | WO |
| Entry |
|---|
| US 6,940,674 B2, 09/2005, Sugiyama et al. (withdrawn) |
| Apple Inc., HTTP Live Streaming Overview, Apr. 1, 2011. |
| Buss, “Ultra TV”, Brandmarketing, Sep. 1999, vol. VI, No. 9, p. 74, ISSN 1091-6962, 1999 Responsive Database Services, Inc. Business and Industry; 1999 Fairchild Publications. |
| Cantor, et al., Bindings for the Oasis Security Assertion Markup Language (SAML) V2.0, Oasis Standard, Mar. 2005, Document ID saml-bindings-2.0-os ,(http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf). |
| DLNA (Digital Living Network Alliance) protocols described in DLNA Networked Device Interoperability Guidelines Expanded, Mar. 2006 and subsequent expanded version dated Oct. 2006. |
| DOCSIS 3.0 Management Features Differences Technical Report CM-TR-MGMTv3 0-DIFF-V01-071228, pp. 1-62. |
| DOCSIS 3.0 OSSI Configuration Management Technical Report CM-TR-OSSIv3 0-CM-V01-080936 pp. 1-84. |
| Extended European Search Report for Application No. EP13155950, dated Jun. 14, 2013, 6 pages. |
| Flynn, et al., “Interactive TV, CNNFn”, transcipt #00081407FN-111 interview Josh Bernoff, Digital Jam, Aug. 14, 2000. |
| Furchgott, “Don't want people to control their T.V.s?”, The New York Times, Aug. 24, 2000, Section G, p. 1, col. 2, Circuits, 2000 The New York Times Company. |
| Future VOD role of studios vs. other companies debated, Video Week, Apr. 10, 2000, section: This Week's News, 2000 Warren Publishing, Inc. |
| Gopikrishnan, et al., Scaling of the distribution of fluctuations of financial market indices, Physical Review E. vol. 60 No. 5, Nov. 1999. |
| Gunther, et al.,“When technology attacks!; Your T.V. is looking weird. Network executives are getting flustered. Viewing choices are exploding. That's what happens . . . ”, Fortune, Mar. 6, 2000, section: Features/Television, p. 152, 2000 Time Inc. |
| “Independent study shows TiVo service increases enjoyment and changes people's attitudes towards T.V.”, PR Newswire, May 2, 2000, 2000 FT Asia Intelligence Wire; 2000 PR Newswire. |
| Kale, RFC 1180“A TCP/1P tutorial”, Jan. 1991, Spider Systems Limited, Section 4 “ARP”. |
| Larsen, Peter Thal, “Inside Track: TV viewers can box clever: Technology Video Recorders: personal video reorders will be a godsend for viewers. But what about the schedulers”, Financial Times London Ed., Jun. 23, 2000, p. 18, ISSN 0307-1766, 2000 Responsive Database Services, Inc. Business and Industry; 2000 Financial Times Ltd. |
| Lowry, Television, as you like it; Today's gadgetry is smart enough to let viewers choose camera angles, or kick back and rewind as the action unfolds live. Watch it, and it watches back, Los Angeles Times, Feb. 13, 2000, section: Calendar, p. 8, Calendar Desk, 2000 Times Mirror Company. |
| “More ‘convergence’ digital video recorders emerge”, Video Week, Jun. 19, 2000, section: This Week's News, 2000 Warren Publishing, Inc. |
| MPEG Headers Quick Reference, http://dvd.sourceforge.net/dvdinfo/mpeghdrs.html, Mar. 6, 2006. |
| OpenCable, Enhanced TV Binary Interchange, Format 1.0 OC-SP-ERV-BIF1.0-104-070921 Date: Sep. 21, 2007, 420 pages. |
| OpenCable Specifications, Alternate Content, Real-Time Event Signaling and Management API, OC-SP-ESAM-API-I01-120910 (2012). |
| OpenCable Specifications, Tuning Resolver Interface Specification, OS-SP-TRIF-I01-080130, Jan. 30, 2008, pp. 1-50. |
| “PVR copyright concerns raised”, Audio Week, Aug. 23, 1999, section: This Week's News, 1999 Warren Publishing, Inc. |
| Ramakrishnan, et al., Operating System Support for a Video-On-Demand File Service, Digital Equipment Corporation, 1995, p. 4 (“CMFAP”). |
| Redux screenshot from http://www.redux.com, “Select a channel to start watching” © 2014 Redux, Inc.014 Redux, Inc. All rights reserved; http://www.redux.com/; 2 pages. |
| Sabga, et al., “TiVo—CEO, CNNfn”, transcript # 000901 10FN-107 interview Michael Ramsay, The N.E.W. Show, Sep. 1, 2000, Fri. 5:18 p.m. EST, 2000 Cable News Network. |
| Schonfeld, “Thuuz tells sports fans if a game is worth watching”, Oct. 7, 2010, TC News from http://techcrunch.com/2010/10/07/thuuz, 2 pages. |
| SCTE American National Standard ANSI/SCTE 118-2 2007. |
| SCTE American National Standard ANSI/SCTE 130-1 2008. |
| SCTE, American National Standard, ANSI/SCTE 35 2012. |
| Siebenlist F., et al., “Global Grid Forum Specification Roadmap towards a Secure OGSA,” Jul. 2002, pp. 1-22. |
| Snoddy, “The TiVo—T.V.'s nemesis?”, Times Newspapers Ltd., Sep. 1, 2000, section: Features, 2000 Times Newspapers Limited (the Times London). |
| “TiVo and replay sign cable deals to boost PVR distribution”, Warren's Cable Regulation Monitor, Aug. 21, 2000, section: This Week's News, 2000 Warren Publishing, Inc. |
| UTF-32, IBM, retrieved from http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=%2Fnls%2Frbagsutf32.htm on Aug. 28, 2013. |
| Zarnbelli, The Apparatus and Methods of HS Smooth Streaming Technical Overview, Mar. 2009. |
| Florin L., et al., “Content Delivery and Management in Networked MPEG-4 System,” 2000 10th European Signal Processing Conference, IEEE, Sep. 4, 2000 (Sep. 4, 2000), pp. 1-4, XP032755920, ISBN: 978-952-15-0443-3 [retrieved on Mar. 31, 2015]. |
| Pantjiaros C.A. P., et al., “Broadband Service Delivery: CY.T.A. ADSL Field Trial Experience”, Electrotechnical Conference, 2000 MELECON, 2000 10th Mediterranean, May 29-31, 2000, Piscataway, NJ, USA,IEEE, vol. 1, May 29, 2000 (May 29, 2000), pp. 221-224, XP010518859, ISBN: 978-0-7803-6290-1. |
| Number | Date | Country | |
|---|---|---|---|
| 20190075128 A1 | Mar 2019 | US |
| Number | Date | Country | |
|---|---|---|---|
| 62116212 | Feb 2015 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 15045043 | Feb 2016 | US |
| Child | 16173996 | US |
