As the number of users viewing information and purchasing items electronically increases, there is a corresponding increase in the amount of revenue spent in electronic environments. In some cases, content is targeted to specific users or to specific web pages or other interfaces. In many instances, the provider of the content (such as a webpage or mobile application) will receive some compensation, where the amount of the compensation is related to the amount of users viewing or otherwise interacting with the content. A provider who wants to increase revenue will sometimes perform actions that fraudulently or at least impermissibly increases the amount of compensation to be received based on traffic that appears to be associated with unique users, but instead is the result of automated processes that replicate such traffic. In many instances, it can be difficult to distinguish between legitimate traffic and traffic that is automatically generated for the purpose of increasing revenue.
Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:
Systems and methods in accordance with various embodiments of the present disclosure may overcome one or more of the aforementioned and other deficiencies experienced in conventional approaches to providing electronic content in a networked environment. In particular, various embodiments provide mechanisms for determining whether network traffic corresponds to human users or automated processes, often referred to as robots or “bots,” which can enable the automated processes to be blocked, improving network performance and ensuring that user traffic and views of specific content such as advertising is tracked accurately. Such an approach also can help to detect publishers of content who are using automated processes to increase the traffic numbers for their content, which in some cases can result in an improper amount of compensation being provided to the publisher. Remedial actions for the publishers can be taken, such as to withhold compensation or block further publishing of content associated with the publisher, among other such actions.
Content such as advertising is often monitored for purposes of performance and compensating the publisher providing such content. In the case of advertising, an ad will typically result in a user either not viewing the ad, viewing the ad (resulting in a view or an impression in some embodiments), clicking on the ad (resulting in a “click”), or consuming content, a service, or an item related to the ad (resulting in a conversion). Publishers are often compensated for including advertising with their content, where the compensation is based upon factors such as the number of ad impressions, clicks, and/or conversions. For this reason, some publishers are motivated to utilize automated processes to improperly increase the apparently legitimate traffic to the content, which can increase the determined number of views or clicks, for example, thereby increasing the compensation due to the publisher. At least because this fraudulent network traffic consumes additional resources and costs the advertising entities money for ads that are never seen by a human user, it is desirable to detect and block this traffic.
As mentioned, it can be difficult to distinguish an individual request received from a human user from a request received from an automated process. Because converting content such as ads generally perform within a certain performance range, such as a range of percentages of conversions when displayed to human users, one metric for determining the presence of robotic traffic is to analyze the performance of ads displayed with content from a particular publisher, or ads displayed to a particular user or group of users, to determine whether the performance is significantly outside the expected range. For example, if an ad generally converts 1% of the time, with a range of 0.5% to 1.5%, a performance of an order of magnitude less, such as a rate less than 0.05%, may be indicative of robotic traffic that is causing the content to be displayed, and potentially simulating a click, but not providing any value and unnecessarily utilizing resources.
While such an approach is useful for high volume publishers with a lot of network traffic or usage data, it can be more difficult for publishers with few data points. For example, if a website gets only around one hundred hits over a period of time it can be difficult to determine with sufficient accuracy whether the ads re performing poorly, particularly when the conversion rate range is on the order of 1% or less. Further, some ad placements on a page or interface will perform better than others, with ads prominently placed at the top of a webpage typically performing better than ads placed elsewhere on the page, although typically only on the order of about three times better in some examples. Thus, publishers with a large number of low volume sites or robotic processes that spread hits across a large number of sites can often go undetected because there is not enough data for any of these sites, applications, or other such presentations of content. For applications, this can include a large number of emulators running the application in order to give the appearance of multiple devices running the application and receiving convertible content, such as new ads every few seconds.
Accordingly, approaches in accordance with various embodiments attempt to identify suspicious users, publishers, and/or user/publisher combinations based on factors such as ad performance. A number of instances of high conversion rate content, such as high conversion ads, can be presented in order to better determine whether traffic is human or robotic, as higher conversion rate content will require fewer data points for such a determination. It can be important to look at both users and publishers, as some publishers might use robotic processes to improve traffic but might still be within an expected range. In such cases it can be important to identify robotic users that may be fraudulently submitting requests to multiple sites associated with that publisher, etc. If the conversion rate or other metric is still unacceptably low for the high conversion rate ad, the user and/or publisher can be determined to be at least somewhat fraudulent and can be blocked in the system or otherwise managed accordingly.
Various other functions and advantages are described and suggested below as may be provided in accordance with the various embodiments.
For various types of electronic content, such as Web content or mobile application content, the obtaining, hosting, and/or providing of that content can be at least partially funded through the use of electronic content such as advertising that is placed in, or associated with, that content. The advertisements, or advertising, will often be associated with a party offering products or service for consumption (i.e., purchase, rent, lease, or download) by a user viewing the associated content. This advertising can be provided by the advertising party, a provider of the content, or a third party advertising service, among other such entities. The advertising in many instances will take the form of a banner ad or sponsored link, for example, although various other types of electronic advertising can be used as well within the scope of the various embodiments. As known in the art, “sponsored links” or “sponsored ads” are typically used with electronic interfaces or content such as Web sites, search engines, applications, mobile applications, online games, etc., wherein an advertiser provides a navigational element such as a hypertext link and associated text, graphics, and/or video to be displayed in the electronic interface, that enable a user to select or otherwise access the navigational element to be directed to a page or other location provided by the advertiser. The advertiser typically will pay a provider of the electronic interface and/or content (either directly or via the advertising service) based upon an aspect of each sponsored ad, such as the number of times users select the navigational element included therein or the number of times that an advertisement is displayed to users. Other factors can be considered as well, such as the number of conversions that resulted from displaying the ad, where a “conversion” can be defined as any obtaining or consuming (such as purchasing) of an object, service, or content associated with the advertising. Metrics such as the average number of clicks per view or average number of conversions per view can be used to determine performance of the advertising, or the placement of the advertising within the electronic interface, and a total number of views, clicks, conversions, and/or other such metrics can be used to determine the amount of compensation to the provider of the electronic interface. An advertiser might cause ads to be placed on multiple instances of electronic content from multiple providers, where each provider will receive an appropriate amount of compensation for providing the advertising. As known for electronic advertising, the ads displayed will generally not be fixed to the content but provided for certain users or views, or rotated with other content, among other such possibilities.
As an example,
As mentioned, the providing of electronic content such as electronic or “online” advertising is plagued by a significant percentage of automated or “robotic” traffic. Current estimates but the percentage of this automated traffic at between 30% and 40% of total network traffic. Since compensation is provided based at least in part upon the amount of traffic accessing an advertisement, this extra traffic can cause significant overpayment by the advertiser for views, clicks, or other actions that did not correspond to actual, unique human users. A significant challenge in the detection of such traffic or activity, however, resides in the fact that it is difficult to determine which traffic originated from a human user and which traffic originated from a robot or other automated process or component. Conventional pattern detection algorithms and approaches have not been able to obtain a straightforward method of detecting robot traffic. In practice, an advertiser or other such entity often resorts to detecting traffic patterns that correlate with very poor ad performance, and associating these low performing ad placements with robot traffic. For example, a user with a very high frequency of requests is likely to be robotic if the user displays very poor performance with respect to the average interaction with ads. For example, if an average user clicks on ads 1% to 3% of the time, and this user clicks on ads less than 0.01% of the time, then this order of magnitude difference may be sufficient for a provider to designate this user as a robot. Even if the provider is incorrect, this particular user may generate so little revenue that the provider may not care about inadvertently losing a few of these users if the process catches and stops many of the robots. Some providers, however, find it unacceptable, or at least undesirable, to block legitimate users, particularly where conversions may be infrequent for that user but highly lucrative.
Performance correlation-based techniques generally are only effective and/or accurate, however, if there is enough data (i.e., a sufficient number of ad click/conversion events) to confidently estimate various user-level performance metrics. For example, if a user only has a couple of data points over a long period, it will be tough to infer the frequency of conversion with any level of precision. Because it is difficult to detect robot traffic with such low activity, various robot providers cause a large number of robots to each perform a relatively low number of actions, such that none of the individual robots is likely to be detected but the overall effect in aggregate can still be sufficient. If typical display ad click rates are in the range of 0.3% for brand advertising and ˜1% for retargeting, for example, an advertiser would need to serve each of these entities a large number of ad impressions (or views or displays of that advertising) before being able to determine a high-confidence estimate of performance. This is an expensive and error prone process which places inherent limits on the precision and recall of robot detection algorithms.
Accordingly, approaches in accordance with various embodiments attempt to determine suspicious users, publishers/providers, or other such entities and provide advertisements or other content that is associated with a high conversion rate among human users. For such high-conversion content, the descriptive or “creative” portion of the advertisement can indicate something that is highly likely to be of interest to a significant number of human users, such as to provide free items, large discounts, or other compensation for a user selecting the advertisements. In this way, the conversions for a user with even a relatively small number of impressions or views of the advertisement can be more accurately determined, as the ad will have a significantly high average conversion rate. While it might take at least 100 impressions to determine whether a user demonstrates an average conversion for a type of ad with a 1% conversion rate, it may take only three or four impressions to perform a similar calculation for a type of ad with a 30% conversion rate. Thus, the number of impressions needed to make such a determination can be significantly reduced. Further, since a high conversion rate ad will likely offer some type of compensation as attraction to the user, it can be beneficial that the expected conversion rate be relatively high such that a relatively few number of ads need to be displayed. There can be a trade-off and balancing point, however, as an ad for a $5 gift card might have approximately the same conversion rate as an ad for a $100 gift card, but the cost to the advertiser can be much higher, so it can be important to select an ad with the minimum cost to obtain a desired conversion rate. As discussed later herein, a score can be generated that is indicative of the number of impressions to expect for a given user, and the conversion rate needed to make a decision on that user may be determined at least in part using the expected and/or observed number of impressions over a period of time for that user.
It should be pointed out, however, that providing high conversion rate content may be insufficient to distinguish between human and robotic users. For example, various robots are able to cause advertisements to be selected, or appear to have been selected, such that a “click” event can be simulated and/or triggered by a robotic process. Accordingly, an authentication aspect to the high conversion rate content can be advantageous in further distinguishing the type of user. For example, in
A CAPTCHA-style ad process can have other business-specific advantages as well. For example, such a process can help to identify the quality of the traffic being encountered, as users that are robotic can be identified with high confidence by citing their low conversion rate for high conversion rate content. For instance, a user who has been shown a few such ad impressions and has converted on none of those ads may be marked robotic. This can be contrasted with the conventional approach of showing a few thousand ad impressions and measuring their conversion rate before marking a user as robotic. Further, such a process can help to determine the quality of a specific publisher. By aggregating the conversion rate for high conversion rate content across all placements of the publisher, the overall quality of the publisher can be determined. For instance, a publisher with many invisible placements will have a poor conversion rate. From a statistical standpoint, a low confidence signal such as the regular ad conversion rate is being replaced with a high confidence signal, namely the conversion rate for the high conversion rate content. This comes at a cost though, in the form of the payout to be made to converting users. This cost can be limited by, for example, only targeting users where other robot detection flags are triggered, or publishers whose quality is suspect. Similarly, the cost can be limited by limiting the payout to one gift card per user at most, or using statistical techniques like importance sampling, among other such options.
Because the high conversion rate content is relatively expensive for the advertiser or other entity attempting to validate human users, it can be beneficial in at least some embodiments to identify the users that are most likely to correspond to robots or other automated processes or components. Accordingly, components such as an activity tracker can observe user and traffic behavior in order to sparingly and selectively target certain users and publishers with suspicious activity whose quality is to be determined. In some embodiments the number selected can be based in part upon a current performance level of the system, where the number selected is intended to identify and block a sufficient amount of robotic traffic to return the system to performing within a target performance range or other such value.
In this example, the content provider 302 generates and serves pages of content available to any appropriate end user 306, and thus can include components such as a production data store 308 that can be used by a page generator 310 to generate pages that can be served by a page server 312 (such as a Web server in a Web-based environment) or other content server over a network 314 to the end user 306. Similarly, another appropriate provider 304 can include components such as ad generator and ad server components for generating and serving advertisements to a user. While many of the embodiments are described with respect to a Web-based environment, it should be understood that pages are not limited to Web pages, but can include any application page or other interface page that can be displayed or otherwise conveyed to a user as discussed and suggested herein.
If the advertising entity 304 wishes to advertise with the provider 302 (or if the advertising from the advertising entity is determined to correspond to content from the provider using a third party advertising service, for example) using sponsored links or other advertisements that direct a user back to a page provided by the advertising entity, the advertising entity also can include components for determining the landing pages to be associated with the advertisements. While various advertising components in this example are shown to be part of the advertiser's system, it should be understood that these components can be part of a separate system or provided as a third party service, for example. In this example, the content provider system includes an advertising manager 318, which can encompass, monitor, and/or control a number of different algorithms and components for selecting and deciding upon pages on which to display ads, as well as dynamically determining when to show certain ads and selecting appropriate ads to show for each category, classes of users, specific items, etc. When the advertising manager 318 decides on an advertisement to be associated with content on the provider pages, the advertising manager 318 can store the advertising data to an advertising data store 320, which in some embodiments can comprise separate tables in the production data store 308. The advertising data store can include any information related to advertising, such as ad performance data, bid histories, bid amounts, categorizations, creative elements, etc. Portions of this data alternatively can be stored and/or accessed from other appropriate storage devices of the system and/or across the network. The content provider system also can include a synchronization manager 316 that can work with a synchronization component of the advertiser 304 to periodically synchronize the advertising data with the advertising data stored at the provider 302, such that the appropriate landing pages, creative content, and financial information can be designated and updated as desired. When a user 306 views a page of content served by the provider 302, the page can include an advertisement that can in some instances direct the user to a page of the advertising entity 304 upon selection by the user. In other cases, the user 306 can be directed to a page of content from the content provider 302 that relates to the advertisement. In still other cases, the content provider might credit the user or offer the user a promotion in exchange for watching the advertisement from the advertiser, which can relate to a product or service offered by the advertiser.
In order to determine potentially suspicious users and/or publishers that are not performing to expectation, a component such as an activity tracker 408 can be used in such a system, as illustrated in the example environment 400 of
For each request in this example an attempt is made 508 to authenticate the user, such as by using an authentication manager or other such component or service as discussed previously. In some embodiments a third party authentication service might be used for such purposes. A number of authenticated conversions can be determined 510 for the number of impressions of the high conversion ad that were served to, and potentially viewed by, the user. If the number (or rate) of conversions is not acceptable 512, such as where the rate falls below a minimum conversion rate threshold, the user can be flagged 514 as a robot or otherwise handled as likely not being a human user. Other remedial actions can be taken as well, such as to block or delete the user or user account. If a human subsequently indicates that they were improperly blocked, the account can be reactivated or unblocked and the user account whitelisted or otherwise flagged as a valid human user. If the conversion rate is successful but the rate is determined 516 to be on the low side, the placement(s) of the ad can be analyzed to determine which of the placements is performing poorly, or at least below expectations. In this example a notification of the poor performing placement can be generated 518 to be provided to, or viewable by, an entity associated with the placement, such that a content provider or other such entity can make changes to improve the placement or otherwise adapt the ads or content displayed in that location or placement. Regardless of whether the rate is low, the activity can be logged 520 or otherwise stored for subsequent analysis. Further, the suspicious tag (or other indicator) can be removed 522 from the user account, or a flag added that the user is a valid human user, among other such options.
As mentioned, some of the suspicious users will be associated with a common publisher who is attempting to inflate his or her ad revenue. If users with common patterns of behavior for the same sites are detected, a small number of those users can be tested and if those users are found to be robots then the entire group of similar users can be flagged as robots and the publisher account closed or otherwise handled for violating the rules of the advertising program, etc. In some embodiments it will be tough to correlate the users based on the lack of data points or other such information. In such instances it can be beneficial to instead look at the collective behavior of sites associated with a publisher to attempt to identify publishers with a lot of robotic traffic generating impressions, clicks, and/or conversions.
In some embodiments, each publisher can have a score generated that is an indication of advertising performance for sites associated with that publisher. A high score can indicate that ads placed on those sites have high numbers of impressions and high conversion rates, while a low score may indicate that the ads have poor placement, are not sufficiently related to the content, or otherwise are not performing as expected. For most of these publishers, however, the conversion rates and other ad metrics will still fall within the appropriate range. For some publishers the conversion rates may fall way under the expected levels with sufficient amounts of data that the publisher can be determined to be using robot traffic and can be blocked, have the content deleted, or can otherwise be handled by the advertising entity. For other publishers, it may be necessary to attempt to determine if that publisher has a high percentage of robot traffic leading to the poor performance and thus poor publisher scores.
For the publishers selected for testing, a first type of conversion content can be displayed 606 on sites, applications, or other content provided by, or otherwise associated with, that provider. In some embodiments only a single type of high conversion content might be used, but in this example since an initial group of publishers is selected for testing that might be relatively large, it can be desirable to select a first type of high conversion rate content that might cost less but provide sufficient conversion information to validate that at least some of the publishers have valid human-generated traffic. For example, instead of a $5 gift card an ad might advertise a free music download or other compensation that is significantly less than $5, but still provides a relatively high conversion rate such that a number of valid human requests should be received for those ads. As mentioned previously, the value of the ads or the number of ads served can vary based on factors such as budget, number of potential abusers, and the like.
Based at least in part upon the conversion data that is received for the high conversion content, including the number of human user validations, updated publisher scores can be calculated 608 for at least the selected publishers. A similar process can be used as before to calculate 610 a new or updated suspicion threshold, and cause 612 a second type of high conversion content to be displayed with content associated with publishers falling below the updated threshold. If none of the publishers fall below the new threshold, then no publishers may be blocked at this time and the process can continue. As mentioned, the second type of content can have a much higher value and average conversion rate in order to attempt to obtain more accurate data and evidence as to the number of non-human users of the publisher's content. The conversion data will again be determined for the high conversion rate content, and a determination made 614 as to whether any of the publishers have conversion rates that are unacceptable or otherwise fall below the threshold or a minimum acceptable rate. If so, those publishers with unacceptably low rates can be blocked 616 or otherwise handled. For publishers with acceptable rates, those publishes can be tagged 618 as acceptable or otherwise flagged or managed such that those publishers are not selected for testing again in order to minimize testing costs, unless the behavior of those publishers is such that repeated testing is warranted.
In addition to saving the advertiser money, approaches in accordance with the various embodiments can help to improve the performance of a content serving system, an advertising system, and various client devices and computers running related applications, among other such systems, services, and devices. As mentioned, there can be a large number of robotic users which can provide a significant drain on resources such as bandwidth, processing capacity, and memory. By reducing this fraudulent traffic, the performance of these systems can be improved. The improvement can include faster download speeds, reduced latency in advertisement and other content interaction, more reliable content, and other such aspects. Further, the reduction in traffic can allow for fewer resources to be required, which can require less management and oversight within the system, as well as less repair and potentially less downtime.
In this example, the computing device 700 has a display screen 704 and an outer casing 702. The display screen under normal operation will display information to a user (or viewer) facing the display screen (e.g., on the same side of the computing device as the display screen). As discussed herein, the device can include one or more communication components 706, such as may include a cellular communications subsystem, Wi-Fi communications subsystem, BLUETOOTH® communication subsystem, and the like.
Example environments discussed herein for implementing aspects in accordance with various embodiments are primarily Web-based, as relate to Web services and cloud computing, but it should be appreciated that, although a Web-based environment is used for purposes of explanation, different environments may be used, as appropriate, to implement various embodiments. Client devices used to interact with various embodiments can include any appropriate device operable to send and receive requests, messages, or information over an appropriate network and convey information back to a user of the device. Examples of such client devices include personal computers, smart phones, handheld messaging devices, laptop computers, set-top boxes, personal data assistants, electronic book readers, and the like. The network can include any appropriate network, including an intranet, the Internet, a cellular network, a local area network, or any other such network or combination thereof. Components used for such a system can depend at least in part upon the type of network and/or environment selected. Protocols and components for communicating via such a network are well known and will not be discussed herein in detail. Communication over the network can be enabled by wired or wireless connections, and combinations thereof.
Various aspects can be implemented as part of at least one service or Web service, such as may be part of a service-oriented architecture. Services such as Web services can communicate using any appropriate type of messaging, such as by using messages in extensible markup language (XML) format and exchanged using an appropriate protocol such as SOAP (derived from the “Simple Object Access Protocol”). Processes provided or executed by such services can be written in any appropriate language, such as the Web Services Description Language (WSDL). Using a language such as WSDL allows for functionality such as the automated generation of client-side code in various SOAP frameworks.
Most embodiments utilize at least one network that would be familiar to those skilled in the art for supporting communications using any of a variety of commercially-available protocols, such as TCP/IP, FTP, UPnP, NFS, and CIFS. The network can be, for example, a local area network, a wide-area network, a virtual private network, the Internet, an intranet, an extranet, a public switched telephone network, an infrared network, a wireless network, and any combination thereof.
In embodiments utilizing a Web server, the Web server can run any of a variety of server or mid-tier applications, including HTTP servers, FTP servers, CGI servers, data servers, Java servers, and business application servers. The server(s) also may be capable of executing programs or scripts in response requests from user devices, such as by executing one or more Web applications that may be implemented as one or more scripts or programs written in any programming language, such as Java®, C, C # or C++, or any scripting language, such as Perl, Python, or TCL, as well as combinations thereof. The server(s) may also include database servers, including without limitation those commercially available from Oracle®, Microsoft®, Sybase®, and IBM®.
The environment can include a variety of data stores and other memory and storage media as discussed above. These can reside in a variety of locations, such as on a storage medium local to (and/or resident in) one or more of the computers or remote from any or all of the computers across the network. In a particular set of embodiments, the information may reside in a storage-area network (“SAN”) familiar to those skilled in the art. Similarly, any necessary files for performing the functions attributed to the computers, servers, or other network devices may be stored locally and/or remotely, as appropriate. Where a system includes computerized devices, each such device can include hardware elements that may be electrically coupled via a bus, the elements including, for example, at least one central processing unit (CPU), at least one input device (e.g., a mouse, keyboard, controller, touch screen, or keypad), and at least one output device (e.g., a display device, printer, or speaker). Such a system may also include one or more storage devices, such as disk drives, optical storage devices, and solid-state storage devices such as random access memory (“RAM”) or read-only memory (“ROM”), as well as removable media devices, memory cards, flash cards, etc.
Such devices also can include a computer-readable storage media reader, a communications device (e.g., a modem, a network card (wireless or wired), an infrared communication device, etc.), and working memory as described above. The computer-readable storage media reader can be connected with, or configured to receive, a computer-readable storage medium, representing remote, local, fixed, and/or removable storage devices as well as storage media for temporarily and/or more permanently containing, storing, transmitting, and retrieving computer-readable information. The system and various devices also typically will include a number of software applications, modules, services, or other elements located within at least one working memory device, including an operating system and application programs, such as a client application or Web browser. It should be appreciated that alternate embodiments may have numerous variations from that described above. For example, customized hardware might also be used and/or particular elements might be implemented in hardware, software (including portable software, such as applets), or both. Further, connection to other computing devices such as network input/output devices may be employed.
Storage media and other non-transitory computer readable media for containing code, or portions of code, can include any appropriate media known or used in the art, including storage media and communication media, such as but not limited to volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules, or other data, including RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the a system device. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will appreciate other ways and/or methods to implement the various embodiments.
The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may be made thereunto without departing from the broader spirit and scope of the invention as set forth in the claims.
This application is a Continuation of allowed U.S. patent application Ser. No. 14/840,899, filed Aug. 31, 2015, entitled “TRACKING USER ACTIVITY FOR DIGITAL CONTENT,” which is incorporated herein by reference for all purposes.
Number | Name | Date | Kind |
---|---|---|---|
8886575 | Liu | Nov 2014 | B1 |
20080201214 | Aaron | Aug 2008 | A1 |
20080270154 | Klots | Oct 2008 | A1 |
20080281606 | Kitts | Nov 2008 | A1 |
20090099904 | Affeld | Apr 2009 | A1 |
20090164269 | Gupta | Jun 2009 | A1 |
20100306161 | Chen | Dec 2010 | A1 |
20110314116 | Bayer | Dec 2011 | A1 |
20120143861 | Sethi | Jun 2012 | A1 |
20140068407 | Suh | Mar 2014 | A1 |
20150046254 | Raab | Feb 2015 | A1 |
20150237115 | Kirillov | Aug 2015 | A1 |
20150262226 | Howe | Sep 2015 | A1 |
20160117726 | Lee | Apr 2016 | A1 |
Entry |
---|
Leung, Depress phishing by CAPTCHA with OTP, IEEE, 2009 3rd International Conference on Anti-counterfeiting, Security, and Identification in Communication, Aug. 20-22, 2009, IEEE Xplore, Oct. 6, 2009 (Year: 2009). |
Kitts et al., Click fraud botnet detection by calculating mix adjusted traffic value: A method for de-cloaking click fraud attacks that is resistant to spoofing, IEEE, 2013 IEEE International Conference on Intelligence and Security Informatics, Jun. 4-7 2013 (Year: 2013). |
Kantardzic et al., Improving Click Fraud Detection by Real Time Data Fusion, 2008 IEEE International Symposium on Signal Processing and Information Technology, Dec. 16-19, 2008 (Year: 2008). |
Majumdar et al., Addressing Click Fraud in Content Delivery Systems, IEEE INFOCOM 2007—26th IEEE International Conference on Computer Communications, IEEE, May 6-12, 2007 (Year: 2007). |
Walgampaya et al., Cracking the Smart ClickBot, 2011 13th IEEE International Symposium on Web Systems Evolution (WSE), IEEE, Sep. 30-30, 2011 (Year: 2011). |
Non-Final Rejection issued in U.S. Appl. No. 14/840,899, dated Dec. 22, 2016. |
Notice of Allowance issued in U.S. Appl. No. 14/840,899, dated Dec. 22, 2016. |
Oikonomou et al., Modeling Human Behavior for Defense Against Flash-Crowd Attacks, IEEE, Communications, 2009. ICC '09. IEEE International Conference on, Aug. 2009. |
Gu et al., Active Botnet Probing to Identify Obscure Command and Control Channels, IEEE, Computer Security Applications Conference, 2009. ACSAC '09. Annual, Dec. 2009. |
Rui et al., ExcuseMeButAreYouHuman, ACM, Nov. 2003 Multimedia '03: Proceedings of the eleventh ACM international conference on Multimedia, Nov. 2003. |
Kang et al., Large-scale bot detection for search engines, ACM, Apr. 2010 WWW '10: Proceedings of the 19th international conference on World wide web, Apr. 2010. |
Number | Date | Country | |
---|---|---|---|
20180097792 A1 | Apr 2018 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 14840899 | Aug 2015 | US |
Child | 15829119 | US |