Click quality classification and delivery

[0001] This application claims the benefit of U.S. Provisional Application No. 61/058,890, filed on Jun. 4, 2008. The entire teachings of the above application are incorporated herein by reference.

[0002] The present disclosure relates generally to handling of click-throughs on the Internet.

[0003] The delivery of advertisements on the Internet involves several parties: website content publishers, advertisers, advertisement networks, service providers and end users. A publisher provides web pages of content to the end users and space alongside or within the content for advertisements. The publisher may employ an advertisement network, e.g., Google AdSense, to allow advertisers to bid for placement of advertisements in the ad space. Alternatively, the publisher may arrange directly with advertisers to fill the ad space. In either case, the content with advertisements positioned in the ad space is delivered to the end user over a service provider network. If the end user selects an advertisement, the advertiser pays the publisher or the advertising network for the so-called “click-through” or “click” by the end user.

[0004] A rampant problem today is so-called “click fraud,” whereby fraudulent click-throughs are generated, costing advertisers large amounts of money. In one type of click fraud, an unscrupulous competitor may generate a large number of click-throughs in order to deplete the advertiser's advertising budget. In another type of click fraud, a rogue publisher sets up a website that contains only advertisements, and generates a large number of click-throughs at the website in order to obtain the advertising revenues. According to one estimate, click fraud constitutes as much as 20% of all Internet traffic.

[0013] Flows of interest (e.g., HTTP GETs) from end users are redirected at a click server node. The flows are redirected to a click engine that checks the flows against a database of signatures or characteristics indicative of quality based on, for example, likely fraudulent behavior. The click engine may make a determination from the database check whether a particular flow is likely fraudulent. The determination may also include detecting unknown patterns which may indicate suspicious behavior by, for example, the end user, a domain or a network. Based on that determination, the click engine may add classification information to the flow that classifies the flow at differing levels of quality (e.g., high, medium, low) based on the determination from the database check. The modified flow then may be redirected to its originally intended destination. At the edge of the service provider network or at the destination (e.g., an advertiser), the classification information may be examined and an appropriate action taken based on the classification information.

[0014] FIG. 1 is a block diagram of an exemplary communications network 100 that may be used with the present disclosure. Network 100 comprises a plurality of nodes including end user node 120, service provider edge nodes 130, click server node 140 and advertiser server node 150 coupled via various data links to form an internetwork of nodes. These internetworked nodes communicate by exchanging data packets according to a pre-defined set of protocols, such as the Transmission Control Protocol/Internet Protocol (TCP/IP) over Asynchronous Transfer Mode (ATM) or Ethernet.

[0015] The end user node 120 is a conventional node, such as a personal computer, work station, personal digital assistant (PDA) and the like. The service provider edge nodes 130 are conventional edge nodes, such as a router, configured to interface the end user node 120 with a service provider network which includes the edge nodes 130 and click server node 140 that may be part of a wide area network (WAN) 110. The WAN 110 is a conventional WAN, such as the Internet, comprising various other nodes (not shown) configured to implement the WAN. The advertiser server node 150 is a conventional server node that is configured to exchange information (e.g., data packets) with the end user node 120.

[0016] The click server node 140 is illustratively a router node 200 coupled to a click engine 400 that is configured to, inter alia, redirect packet flows received from the network 100 to the click engine 400 for handling analysis of click-throughs and traffic patterns from the end user node 120 contained within the packet flows.

[0017] The end user node 120 may be operable to run a browser program to facilitate the access of information on the network. The browser is a hypertext-linked application used for accessing information. Hypertext is a term used to describe a particular organization of information within a data processing system, and its presentation to a user.

[0018] Multimedia communications may use the Hypertext Transfer Protocol (HTTP), and files or formatted data may use the Hypertext Markup Language (HTML). These documents and other Internet resources may be accessed across the network by means of a network addressing scheme which uses a locator referred to as a Uniform Resource Locator (URL), for example, “http://www.cisco.com.”

[0019] Information transfers on the Internet are broken into variable size packets, each of which contains, in addition to its data (payload), control information to be used for its routing and scheduling over the network. In the description herein, the terms below are used in the conventional sense, except where otherwise evident from context, to characterize information transfers on the Internet and, more generally, over packet-based networks.

• • [0020] IP address: A 32 bit label that uniquely identifies a device.
  • [0021] TCP/IP port number: A 16 bit label that uniquely identifies an application within a device.
  • [0022] Packet Labels (Identifiers): Each IP packet is labeled by the following five labels: 1) Source IP address, 2) Source TCP/IP port number, 3) Destination IP address, 4) Destination TCP/IP port number, and 5) Protocol type. These labels are used by TCP/IP for controlling and routing the packet.
  • [0023] IP connection: A source application/destination application pair which exchange data. The connection can be uniquely identified by the five packet labels described above.
  • [0024] IP flow: The packets transmitted over an IP connection.
  • [0025] HTTP: A protocol running over TCP/IP supporting the retrieval of web pages by clients from Web servers.
  • [0026] Cookie: A label that is used by HTTP servers to identify HTTP clients, typically with unique codes (such as user IDs). The HTTP server assigns the label to each client, which the latter uses in further accesses to the server.
  • [0027] Session: A series of requests and responses between a website, server, or other target and a human end-user, typically, over period of a few minutes to a few hours, for purposes of browsing, carrying out a “web transaction” or conducting some other activity.

[0028] FIG. 2 is a high-level block diagram of an example embodiment of a flow redirect router node 200. Router node 200 may comprise one or more network interface cards 210, one or more click center network interface cards 220 and a routing engine card 300 interconnected by a backplane 230. Node 200 is configured to perform various conventional layer-2 (L2) and layer-3 (L3) switching and routing functions. As used herein, L2 and L3 refer to the data-link layer and the network layer, respectively, of the Open Systems Interconnection Reference Model (OSI/RM). Node 200 may also be configured to support various combinations of protocols including, e.g., Open Shortest Path First (OSPF), Intermediate-System-to-Intermediate-System (IS-IS), TCP/IP, RSVP, RTSP, Ethernet, Asynchronous Transfer Mode (ATM) and Frame Relay (FR). An example of a node that may be used is the Cisco 7600 Series Router available from Cisco Systems, Inc.

[0029] The backplane 230 comprises point-to-point interconnections that interconnect the various cards and allow data and signals to be transferred between the cards. Network interfaces 210 couple the router node 200 with other nodes in the network 100, e.g., edge nodes 130, and allow data packets to be transferred between node 200 and these nodes using various protocols such as ATM, Frame Relay (FR), Ethernet and the like. To that end, network interface cards 210 comprise conventional interface circuitry that incorporates signal, electrical characteristics and interchange circuits, needed to interface with the physical media of the network 100 and the protocols running over that media. Functionally, the line cards 310 acquire information from the network 100 via ports and forward the information to the backplane as well as transfer information acquired from the backplane to the network via the ports. The ports may be conventional ports such as, e.g., ATM, Ethernet and FR ports. The click engine network interfaces 220 are conventional network interfaces that couple the node 200 with the click engine 400 and enable data to be transferred between the node 200 and the click engine 400.

[0030] The routing engine 300 comprises logic that is configured to manage node 200, execute various protocols and perform other functions including forwarding and routing various packets processed by node 200. FIG. 3 is a high-level block diagram of an example embodiment of a routing engine 300. Routing engine 300 comprises interface logic 360, packet buffer 350, system controller 330, processing circuitry and memory 340.

[0031] Interface logic 360 is coupled to the backplane 230 and is configured to transfer information (e.g., data) between the backplane 230 and the routing engine 300. Packet buffer 350 is a RAM comprising high-speed RAM devices (e.g., static RAM devices) capable of storing information acquired by the interface logic 360 and processed by processor 320. System controller 330 is coupled to the processor 320, memory 340 and packet buffer 350 and comprises circuitry configured to enable the processor 320 to access (e.g., read, write) memory locations contained in the memory 340 and the packet buffer 350. The processing circuitry illustratively comprises processor 320 which is a conventional CPU configured to execute instructions and manipulate data contained in memory 340 for performing various functions associated with processing packets as described herein. The memory is a computer-readable medium comprising RAM devices, such as DRAM devices, and contains various software and data structures used by processor 320 including operating system 342, routing services 344 and redirection services 346.

[0032] Operating system 342 comprises computer-executable instructions and data configured to implement a conventional operating system. The OS 342 is a conventional operating system that comprises computer-executable instructions and data configured to support the execution of processes, such as routing services 344 and redirection services 346, on processor 320. Specifically, OS 342 is configured to perform various conventional operating system functions that, e.g., enable the processes to be scheduled for execution on the processor 320 as well as provide controlled access to various resources of the routing engine 300, such as memory 340.

[0033] Routing services 344 is a software process comprising computer-executable instructions and data configured to implement various routing protocols, such as OSPF, and IS-IS. These protocols are configured to manage a forwarding database (FDB) (not shown) containing, e.g., data used to make forwarding decisions for packets processed by the node 200. Redirection services 346 is a software process configured to implement redirection or filtering of packet flows using, e.g., access control lists, policy based routing or the like.

[0034] FIG. 4 is a block diagram of an example embodiment of a click engine 400. Click engine 400 comprises processing circuitry, one or more network interfaces 450 and a memory 440. An example of a click engine that may be used is the Cisco System Control Engine (SCE) 2000 available from Cisco Systems, Inc.

[0035] The network interfaces 450 are conventional network interfaces that connect (interface) the click engine 400 with the network 100 using various protocols, such as Ethernet. To that end, the network interfaces 450 comprise conventional interface circuitry that incorporates signal, electrical, and mechanical characteristics and interchange circuits needed to interface with the physical media of the network 100 and protocols running over that media.

[0036] The processing circuitry illustratively comprises processor 420 which is a conventional central processing unit (CPU) configured to execute instructions and manipulate data contained in the memory 440. The memory 440 is a conventional random access memory (RAM) comprising, e.g., dynamic RAM (DRAM) devices. Memory 440 contains an operating system (OS) 442, flow processing services 444 and analysis database 446. The OS 442 is a conventional operating system that comprises computer-executable instructions and data configured to support the execution of processes, such as flow processing services 444, on processor 420. Specifically, operating system 440 is configured to perform various conventional operating system functions that, e.g., enable processes to be scheduled for execution on the processor 420 as well as provide controlled access to various resources of the click engine 400, such as memory 440 and the network interfaces 450. Flow processing services 444 is a software process comprising computer-executable instructions and data configured, as will be described further below, to handle processing of packet flows such as HTTP flows that may contain click-throughs. The analysis database 446 is a database that may include signatures or characteristics indicative of quality based on, for example, likely fraudulent behavior.

[0037] In another embodiment, the click engine 400 may be implemented based on an intrusion detection service module, e.g., Intrusion Detection System Services Module (IDSM-2) available from Cisco Systems, Inc., integrated within router 200. It should be understood that the click server node 140 can be implemented at any node in the service provider network, including the edge nodes 130.

[0038] By scanning end user packet flows, e.g., HTTP traffic streams, it is believed that additional revenue can be generated for a service provider by utilizing the information gathered. Based on user traffic characterization, a user quality value can be assigned to an end user. Once a value attribute exist for an end user, features based on that information can be offered to the advertising community. Several models can be deployed to implement differing degrees of end user interaction analysis.

[0039] A model referred to as “immediate profile analysis model” uses real-time HTTP scanning. In this model, HTTP streams may be monitored inline, incrementing simple end user or event counters when “signature rules” are alerted. Based on counters, action can be taken to modify the payload, mark the transport layer or document activity.

[0040] Another model referred to as “transactional profile analysis model” features local profile generation. In this model, the HTTP stream is channel scanned to a local resource that may be “in-system” for local analysis. The local analysis may be based on data acquired over a longer period of time, possibly several transactions. Based on this analysis, new or revised “signature rules” can be programmed thus enhancing real-time HTTP scanning of a specific end user.

[0041] A model called “extended profile analysis model” features extend profile generation whereby the HTTP stream is channel scanned to a heuristic engine for in-depth analysis. The heuristic engine is considered pluggable, meaning several heuristic engines can be deployed to offer specific services. An application programming interface (API) may be used to program the real-time HTTP scanning, thus allowing for analysis of data derived over an extended period of time.

[0042] FIG. 5 illustrates an example process that may used to configure click engine 400 to handle redirected packet flows received by the click engine from the flow redirection router 200. The process begins at step 510 where the click engine 400 receives the redirected packet flow from router 200. Next the click engine processes the redirected packet flow to extract information at step 512. At step 514 the extracted information is analyzed. The type of analysis may be based on any of the analysis models described above or other analysis models. For example, in the case of immediate profile analysis model, it may be of interest to analyze a GET request in an HTTP flow. With the transactional profile analysis model or extended profile analysis model, the analysis may look for various traffic patterns (e.g., fraud, demographics, etc.) From the analysis of the extracted information, the click engine 400 may determine characteristics of the packet flow at step 516. For example, what type of HTTP transactions are occurring or how much redirection of the HTTP flow is occurring.

[0043] Next the click engine 400 may classify the packet flow based on the determined characteristics at step 518. The classification may relate to a type of action to be taken downstream. For example, a flow classified as having low quality may be handled (at the advertiser server 150 or within the service provider network itself) differently than a flow having a high quality classification.

[0044] At step 520 the click engine 400 modifies the packet flow to include classification information. The modification may be in the form of adding a “tag” to the packet flow. This tagging may be internal to a data packet (requiring regeneration of CRC and possible HTTP stream manipulation) or external, such as virtual local area network (VLAN) tags, Multi Protocol Label Switching (MPLS) labels or quality of service marking. External tagging allows additional services to be applied, such as providing Optimum Data Path for high-end advertising (e.g., video streams). Generally, the destination (e.g., advertiser server 150) may take appropriate action based on examination of a packet flow that has been modified to include internal tagging. Other nodes, such as edge node 130b, may take appropriate action based on examination of the external tagging of a packet flow.

[0045] At step 522, the click engine 400 returns the modified packet flow to the router 200 and the process concludes.

[0046] FIG. 6 illustrates a first example of a modified HTTP request 600. The request shown is a conventional HTTP/1.1 GET request that has been modified to include a variable representation 620. The example variable representation 620 is labeled “click-quality” and has an assigned value of “001” which may be associated with a particular level of quality, e.g., 001=low, 002=medium and 003=high, indicative of likelihood of fraud behavior.

[0047] FIG. 7 illustrates a second example of a modified HTTP request 700. The request shown is again a conventional HTTP/1.1 GET request that has been modified to include an additional cookie field 720. The example additional cookie field 720 is labeled “click-quality” and has an assigned value of “001” which may be associated with a particular level of quality, e.g., 001=low, 002=medium and 003=high, indicative of likelihood of fraud behavior.

[0048] The modifications described with respect to FIGS. 6 and 7 are examples of so-called internal modifications. Some embodiments may use either or both of these modifications. A reason for using both may be that certain advertisers only support one option and other advertisers support the other, and it may be easier to make both types of modification without having to track which advertiser is supporting which option.

[0049] While the example embodiments have been described in relation to detection of click fraud, it should be understood that other services may be offered based on the configuration described herein. For example, another service may provide counters representing the click rate or number of times a user has clicked a link, thereby giving an indication of intended clicks. Other services include context services (e.g., end user profile/browsing context), location-based services (e.g., identify end user location to the service provider, publisher or advertiser), premium advertisement delivery (e.g., optimal data paths over reserved bandwidth to deliver premium, high bandwidth advertisements), user connectivity profile (e.g., end user device type, end user applications, last mile bandwidth information, last mile latency information), transactional statistics (e.g., comprehensive statistics on end user transactions) and verification services (e.g., verification of delivery, viewing, and conversion of advertisements).

[0050] It should be understood that the network, message, flow, and block diagrams may include more or fewer elements, be arranged differently, or be represented differently. It should be understood that implementation may dictate the network, flow, and block diagrams and the number of network, flow, and block diagrams illustrating the execution of example embodiments.

[0051] It should be understood that elements of the network, flow, and block diagrams described above may be implemented in software, hardware, or firmware. In addition, the elements of the network and flow diagrams described above may be combined or divided in any manner in software, hardware, or firmware. If implemented in software, the software may be written in any language that can support the embodiments disclosed herein. The software may be stored on any form of computer readable medium, such as random access memory (RAM), read only memory (ROM), compact disk read only memory (CD-ROM), and so forth. In operation, a general purpose or application specific processor may load and execute the software in a manner well understood in the art.

[0052] While the foregoing has been particularly shown and described with references to example embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims.