Mapping entities to accounts

Abstract

Mapping anonymous Internet entities to known accounts. In one embodiment, events representing online activity and including IP addresses are received from multiple sources. A subset of the events is aggregated into a mapping that associates the IP addresses shared by the subset with accounts. Each mapping is associated with statistical information about the events. A confidence value for each mapping is calculated based on the statistical information, and a final subset of the mappings is selected based on the confidence value. Subsequently, when a request with an IP address is received, the requested IP address is searched in the final mapping subset, and an indication of an account associated with the requested IP address is returned in response to the request.

Description

[0001] This application is a divisional application of the Chinese national phase patent application with application number 201880082934.0 after the PCT application with international application number PCT / US2018 / 065155, international application date December 12, 2018, and invention name “Mapping Entities to Accounts” entered the Chinese national phase on June 22, 2020.

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS

[0003] This application claims priority to U.S. Provisional Patent Application No. 62 / 609,753, filed on December 22, 2017, the entire contents of which are hereby incorporated by reference herein. Technical Field

[0004] Implementations described herein are generally directed to mapping anonymous Internet entities (eg, IP addresses, domains, cookies, and / or devices) to known accounts (eg, company names), thereby deanonymizing online visitors or contacts. Background Art

[0005] A significant and well-known problem that arises in the context of Internet communications is the ability of Internet users to remain virtually anonymous. While this anonymity is undoubtedly good for free speech, it is bad for business. For example, unless a visitor to a website chooses to accurately identify himself, the operator of the website may know little about the identity of the visitor.

[0006] In most cases, all a website operator will know about a visitor is the Internet Protocol (IP) address used by the visitor's browsing device, the visitor's domain (e.g., the domain associated with the IP address), and / or, if any, one or more "cookies" (data stored on a user's device by a website during a visit to that website). Typically, this information is insufficient to initiate contact with the visitor, e.g., to market a product or service to the visitor.

[0007] In contrast, in a physical storefront, a merchant can physically approach a visitor to immediately initiate contact with the visitor, for example, to begin promoting a product or service. Thus, the Internet, while facilitating marketing and commerce, creates a problem for merchants whose visitors remain anonymous. This is a problem that simply does not exist in a physical storefront scenario.

[0008] Therefore, a solution is needed to pierce the unique shield of anonymity that the Internet provides to visitors. Preferably, such a solution would enable merchants to determine contact information about otherwise anonymous Internet visitors. Such a solution may be particularly advantageous for predictive marketing methods such as those described in U.S. Patent No. 2013 / 0204663, filed on February 7, 2013, which is incorporated herein by reference. Summary of the invention

[0009] In one embodiment, a method for deanonymizing an anonymous Internet Protocol (IP) address is disclosed. The method includes using at least one hardware processor of a server platform to: receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and includes an IP address and event information; aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address shared by the subset of the plurality of events with an account and associates with a plurality of statistics about the subset of events; for each of the plurality of mappings, calculate a confidence value for the mapping based on the associated plurality of statistics; select a final subset of the plurality of mappings based on the confidence values ​​for the plurality of mappings; and respond to one or more requests including the requested IP address by searching the requested IP address in the final subset of mappings and returning an indication of an account associated with the requested IP address in the final subset of mappings. The method may also include using the at least one hardware processor to normalize the event information in the plurality of events. The event information about each of the plurality of events may include a domain name. For each of the plurality of events, the event information may include a geographic region associated with the IP address of the event.Each account may include a company name.

[0010] In one embodiment, selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings comprises, for at least one set of two or more mappings that each associate the same IP address with a different account: determining one of the two or more mappings having a maximum confidence value among the two or more mappings; calculating a sum of the confidence values ​​of the two or more mappings; calculating a ratio of the maximum confidence value to the sum of the confidence values; and excluding the two or more mappings from the final subset of mappings when the ratio does not exceed a threshold. The threshold may include a difference from the maximum confidence value multiplied by a constant value.

[0011] In one embodiment, calculating the confidence value for each mapping based on the associated plurality of statistics includes: calculating a temporal confidence value indicating the timing of events from which the mapping is derived; calculating a statistical confidence value indicating the frequency of the events from which the mapping is derived; calculating a source confidence value indicating the accuracy of one or more of the plurality of sources from which the events from which the mapping is derived are received; and calculating the confidence value based on the temporal confidence value, the statistical confidence value, and the source confidence value. The plurality of statistics may include a span and a delay, wherein the span indicates a time period during which the events from which the mapping is derived occur, wherein the delay indicates a time period since the most recent event from which the mapping is derived occurs, and wherein the temporal confidence value is calculated as:

[0012]

[0013] The plurality of statistics may include a spread and a strength, wherein the spread indicates the number of time periods during which the event from which the mapping is derived occurs, wherein the strength indicates the number of events from which the mapping is derived, and wherein the statistical confidence value is calculated as:

[0014] Weight 强度 *log 1000 (Strength) + Weight 扩展度 *log 100 (Extension)

[0015] The weight 强度 and weight 扩展度 are constant values ​​that sum to one. For example, the weights 强度 and weight 扩展度 They can each be equal to 0.5.

[0016] In one embodiment, the source confidence value is calculated as:

[0017]

[0018] Wherein each source_confidence s represents a source confidence value of one of the one or more sources from which the event from which the mapping is derived is received. The method may also include using the at least one hardware processor to calculate the source confidence value of the source for each of the multiple sources by the following steps: identifying a true set of mappings, each of which is derived from events from at least N of the multiple sources, where N is greater than or equal to two; identifying an overlap between a source mapping set derived from an event received from the source and the mapping true set; and calculating the source confidence value of the source based on the identified overlap between the source mapping set and the mapping true set.

[0019] In one embodiment, the confidence value is calculated as:

[0020] Weight 1 (confidence 源 +(1-confidence 源 )Confidence 统计 )+weight2(confidence 时间 ),

[0021] The confidence 源 is the source confidence value, confidence 统计 is the statistical confidence value, confidence 时间 is the temporal confidence value, and wherein Weight 1 and Weight 2 are constant values ​​that sum to 1. For example, Weight 1 is equal to 0.7, and Weight 2 is equal to 0.3.

[0022] In one embodiment, the method further comprises using the at least one hardware processor to, after receiving a new set of events from one or more sources: aggregate a subset of the new set of events into a new set of mappings; extract a portion of the final set of mappings that includes the IP addresses in the new set of events; merge the new set of mappings with the extracted portion of the final set of mappings, the merging being performed by recalculating the plurality of statistics and the confidence values ​​about the mappings for each mapping in the merged set of mappings; and update the final set of mappings with the merged set of mappings. Each of the plurality of events may be stored in a persistent event pool, and the new set of events may not be stored in the persistent event pool until after the final set of mappings has been updated.

[0023] In one embodiment, the method also includes using the at least one hardware processor to: generate a graphical user interface including one or more inputs for receiving a user request including a requested IP address; in response to receiving the user request, add a query representing the request to a query queue; then, when the query reaches the front of the queue, query the final subset of the multiple mappings based on the query; and after receiving the results of the query, generate a graphical user interface including a visual representation of the results of the query.

[0024] The method may be embodied in an executable software module of a processor-based system (such as a server), and / or in executable instructions stored in a non-transitory computer-readable medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The details of the invention, both as to its structure and operation, may be gleaned in part by a study of the accompanying drawings, in which like reference numerals refer to like parts, and in which:

[0026] Figure 1 shows an example infrastructure in which one or more of the processes described herein may be implemented according to one embodiment;

[0027] Figure 2 An example processing system that can perform one or more of the processes described herein is shown according to one embodiment;

[0028] Figure 3 A process for mapping anonymous entities to known accounts is shown according to one embodiment;

[0029] Figure 4A and Figure 4B A process for determining source confidence values ​​for a plurality of sources is shown;

[0030] Figure 5 According to one embodiment, Figure 3 The interactions between various data structures in one example implementation of the process shown; and

[0031] Figure 6 Interactions between various data structures in an example implementation of a network service are shown according to one embodiment. DETAILED DESCRIPTION

[0032] In one embodiment, systems, methods, and non-transitory computer-readable media for mapping anonymous entities (e.g., IP addresses, domains, cookies, and / or devices) to known accounts (e.g., companies) are disclosed. After reading this description, it will be apparent to those skilled in the art how to implement the present invention in various alternative embodiments and alternative applications. However, although various embodiments of the present invention will be described herein, it should be understood that these embodiments are presented only by way of example and illustration, and are not restrictive. Thus, this detailed description of various embodiments should not be construed as limiting the scope or breadth of the present invention as set forth in the appended claims.

[0033] 1. System Overview

[0034] 1.1. Infrastructure

[0035] Figure 1An example infrastructure according to one embodiment is shown in which a system that maps anonymous entities (e.g., IP addresses, domains, cookies, and / or devices) to known accounts (e.g., companies) can be operated. The infrastructure can include a platform 110 (e.g., one or more server devices) that hosts and / or executes one or more of the various functions, processes, methods, and / or software modules described herein. The platform 110 can include a dedicated server, or can alternatively include a cloud instance that utilizes the shared resources of one or more servers. These servers or cloud instances can be collocated and / or geographically dispersed. The platform 110 can also include a server application 112 and / or one or more databases 114, or can be communicatively connected to the server application 112 and / or one or more databases 114. In addition, the platform 110 can be communicatively connected to one or more user systems 130 via one or more networks 120. The platform 110 can also be communicatively connected to one or more external systems 140 (e.g., data sources, websites, network services, other platforms, etc.) via one or more networks 120.

[0036] The one or more networks 120 may include the Internet, and the platform 110 may communicate with one or more user systems 130 and one or more external systems 140 via the Internet using standard transfer protocols such as Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), File Transfer Protocol (FTP), FTP Secure (FTPS), SSH FTP (SFTP), etc., as well as proprietary protocols. Although the platform 110 is shown as being connected to various systems via a single set of networks 120, it should be understood that the platform 110 may also be connected to various systems via a different set of one or more networks. For example, the platform 110 may be connected to a subset of user systems 130 and / or external systems 140 via the Internet, but may also be connected to one or more other user systems 130 and / or external systems 140 via an intranet. In addition, although only a few user systems 130 and external systems 140, one server application 112, and a set of databases 114 are shown, it should be understood that the infrastructure may include any number of user systems, external systems, server applications, and databases.

[0037] One or more user systems 130 may include any one or more types of computing devices capable of wired and / or wireless communication, including but not limited to desktop computers, laptop computers, tablet computers, smart phones or other mobile phones, servers, game consoles, televisions, set-top boxes, electronic information kiosks, point-of-sale terminals, automated teller machines, etc.

[0038] Platform 110 may include a web server hosting one or more websites and / or web services. In an embodiment in which a website is provided, the website may include one or more user interfaces, including, for example, web pages generated with hypertext markup language (HTML) or other languages. Platform 110 transmits or serves these user interfaces in response to a request from one or more user systems 130. In some embodiments, these user interfaces may be served in a wizard form, in which case two or more user interfaces may be served in a sequential manner, and one or more of the sequential user interfaces may depend on the interaction of the user or user system with one or more previous user interfaces. Requests to platform 110 and responses (including user interfaces) from platform 110 may both be communicated by one or more networks 120 using standard communication protocols (e.g., HTTP, HTTPS, etc.), and network 120 may include the Internet. These user interfaces or web pages may include a combination of content and elements such as text, images, videos, animations, references (e.g., hyperlinks), frames, inputs (e.g., text boxes, text areas, check boxes, radio buttons, drop-down menus, buttons, forms, etc.), scripts (e.g., JavaScript), etc., including elements containing data stored in one or more databases (e.g., one or more databases 114) or derived from the data, which the platform 110 may access locally and / or remotely. The platform 110 may also respond to other requests from one or more user systems 130.

[0039] The platform 110 may also include one or more databases 114, be communicatively coupled to or otherwise have access to one or more databases 114. For example, the platform 110 may include one or more database servers that manage the one or more databases 114. A user system 130 or a server application 112 executing on the platform 110 may submit data (e.g., user data, form data, etc.) to be stored in the one or more databases 114, and / or request access to data stored in the one or more databases 114. Any suitable database may be utilized, including but not limited to MySQL. TM 、Oracle TM 、IBM TM , Microsoft SQL TM 、Sybase TM 、Access TMThe platform 110 may include a plurality of database instances, such as cloud-based database instances and dedicated databases. For example, data may be sent to the platform 110 via FTP or the like using the well-known POST request supported by HTTP. For example, the data and other requests may be processed by server-side network technologies such as servlets or other software modules (e.g., server application 112) executed by the platform 110.

[0040] In an embodiment in which a network service is provided, the platform 110 may receive a request from one or more external systems 140 and provide a response in a Javascript object notation (JSON), an extensible markup language (XML), and / or any other suitable or desired format. In such an embodiment, the platform 110 may provide an application programming interface (API) that defines how one or more user systems 130 and / or one or more external systems 140 may interact with the network service. Thus, one or more user systems 130 and / or one or more external systems 140 (which may themselves be servers) may define their own user interfaces and rely on the network service to implement or otherwise provide the backend processes, methods, functions, storage, etc. described herein. For example, in such an embodiment, a client application 132 executed on one or more user systems 130 may interact with a server application 112 executed on the platform 110 to perform one or more or one or more of the various functions, processes, methods, and / or software modules described herein. The client application 132 may be "thin", in which case the processing is primarily performed on the server side by the server application 112 on the platform 110. A basic example of a thin client application is a browser application that merely requests, receives, and renders web pages at one or more user systems 130, while a server application on the platform 110 is responsible for generating the web pages and managing database functions. Alternatively, the client application 132 may be "fat," in which case the processing is primarily performed on the client side by the one or more user systems 130. It should be understood that the client application 132 may perform a certain amount of processing at any point along this spectrum between "thin" and "fat" relative to the server application 112 on the platform 110, depending on the design goals of the particular implementation. In any case, the applications described herein may include one or more executable software modules that implement one or more of the processes, methods, or functions of the one or more applications described herein, and the applications described herein may reside entirely on the platform 110 (e.g., in which case the application 112 performs all processing) or one or more user systems 130 (e.g., in which case the application 132 performs all processing), or be distributed between the platform 110 and one or more user systems 130 (e.g., in which case both the server application 112 and the client application 132 perform processing).

[0041] 1.2. Example Processing Device

[0042] Figure 22 is a block diagram illustrating an example wired or wireless system 200 that can be used in conjunction with the various embodiments described herein. For example, the system 200 can be used as or in conjunction with one or more of the mechanisms, processes, methods, or functions described herein (e.g., for storing and / or executing an application or one or more software modules of an application), and can represent a component of the platform 110, one or more user systems 130, one or more external systems 140, and / or other processing devices described herein. The system 200 can be a server or any conventional personal computer, or any other processor-enabled device capable of wired or wireless data communications. As will be apparent to those skilled in the art, other computer systems and / or architectures can also be used.

[0043] System 200 preferably includes one or more processors, such as processor 210. Additional processors may be provided, such as auxiliary processors for managing input / output, auxiliary processors for performing floating point math operations, special purpose microprocessors (e.g., digital signal processors) with an architecture suitable for fast execution of signal processing algorithms, slave processors subordinate to a main processing system (e.g., back-end processors), additional microprocessors or controllers for dual or multi-processor systems, or coprocessors. Such auxiliary processors may be discrete processors, or may be integrated with processor 210. Examples of processors that may be used with system 200 include, but are not limited to Processor, Core Processor and processors, all of which are available from Intel Corporation in Santa Clara, California.

[0044] The processor 210 is preferably connected to a communication bus 205. The communication bus 205 may include a data channel for facilitating information transfer between the storage device and other peripheral components of the system 200. In addition, the communication bus 205 may provide a set of signals for communicating with the processor 210, including a data bus, an address bus, and a control bus (not shown). The communication bus 205 may include any standard or non-standard bus architecture, such as, for example, a bus architecture that conforms to the Industry Standard Architecture (ISA), the Extended Industry Standard Architecture (EISA), the Micro Channel Architecture (MCA), the Peripheral Component Interconnect (PCI) local bus, or a standard promulgated by the Institute of Electrical and Electronics Engineers (IEEE), including the IEEE488 General Purpose Interface Bus (GPIB), IEEE 696 / S-100, etc.

[0045] The system 200 preferably includes a main memory 215 and may also include a secondary memory 220. The main memory 215 provides storage of instructions and data for programs executed on the processor 210, such as one or more of the functions and / or modules of the application discussed herein. It should be understood that the programs stored in the memory and executed by the processor 210 can be written and / or compiled according to any suitable language, including but not limited to C / C++, Java, JavaScript, Perl, Visual Basic, .NET, etc. The main memory 215 is typically a semiconductor-based memory, such as a dynamic random access memory (DRAM) and / or a static random access memory (SRAM). For example, other semiconductor-based memory types include synchronous dynamic random access memory (SDRAM), Rambus dynamic random access memory (RDRAM), ferroelectric random access memory (FRAM), etc., including read-only memory (ROM).

[0046] The secondary storage 220 may optionally include an internal memory 225 and / or a removable medium 230. The removable medium 230 is read and / or written in any well-known manner. For example, the removable storage medium 230 may be a tape drive, a compact disk (CD) drive, a digital versatile disk (DVD) drive, other optical drives, a flash drive, etc.

[0047] The removable storage medium 230 is a non-transitory computer-readable medium on which computer executable code (eg, a disclosed software module) and / or data is stored. The computer software or data stored on the removable storage medium 230 is read into the system 200 to be executed by the processor 210.

[0048] In alternative embodiments, the secondary memory 220 may include other similar means for allowing computer programs or other data or instructions to be loaded into the system 200. For example, such means may include an external storage medium 245 and a communication interface 240 that allows software and data to be transferred from the external storage medium 245 to the system 200. Examples of the external storage medium 245 may include an external hard drive, an external optical drive, an external magneto-optical drive, etc. Other examples of the secondary memory 220 may include semiconductor-based memory such as a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), or flash memory (a block-oriented memory similar to EEPROM).

[0049] As described above, the system 200 may include a communication interface 240. The communication interface 240 allows software and data to be transferred between the system 200 and an external device (e.g., a printer), a network, or other information source. For example, computer software or executable code may be transferred from a network server to the system 200 via the communication interface 240. Examples of the communication interface 240 include a built-in network adapter, a network interface card (NIC), a Personal Computer Memory Card International Association (PCMCIA) network card, a cardbus network adapter, a wireless network adapter, a universal serial bus (USB) network adapter, a modem, a network interface card (NIC), a wireless data card, a communications port, an infrared interface, an IEEE 1394 FireWire, or any other device that enables the system 200 to interface with a network or another computing device. The communication interface 240 preferably implements industry-promulgated protocol standards, such as Ethernet IEEE802 standard, Fiber Channel, Digital Subscriber Line (DSL), Asynchronous Digital Subscriber Line (ADSL), Frame Relay, Asynchronous Transfer Mode (ATM), Integrated Services Digital Network (ISDN), Personal Communications Service (PCS), Transmission Control Protocol / Internet Protocol (TCP / IP), Serial Line Internet Protocol / Point-to-Point Protocol (SLIP / PPP), etc., but may also implement customized or non-standard interface protocols.

[0050] Software and data transmitted via the communication interface 240 are typically in the form of electrical communication signals 255. These signals 255 may be provided to the communication interface 240 via a communication channel 250. In one embodiment, the communication channel 250 may be a wired or wireless network, or any other variety of communication links. The communication channel 250 carries the signals 255 and may be implemented using a variety of wired or wireless communication means, including wire or cable, fiber optics, a conventional telephone line, a cellular telephone link, a wireless data communication link, a radio frequency ("RF") link, or an infrared link, to name a few.

[0051] Computer executable code (i.e., computer programs, such as disclosed applications or software modules) are stored in the main memory 215 and / or the secondary memory 220. Computer programs may also be received via the communication interface 240 and stored in the main memory 215 and / or the secondary memory 220. Such computer programs, when executed, enable the system 200 to perform various functions of the disclosed embodiments as described elsewhere herein.

[0052] In this specification, the term "computer-readable medium" is used to refer to any non-transitory computer-readable storage medium used to provide computer executable code (e.g., software and computer programs) to the system 200. Examples of such media include the main memory 215, the auxiliary memory 220 (including the internal memory 225, the removable medium 230, and the external storage medium 245), and any peripheral devices (including network information servers or other network devices) communicatively coupled to the communication interface 240. These non-transitory computer-readable media are means for providing executable code, programming instructions, and software to the system 200.

[0053] In embodiments implemented using software, the software may be stored on a computer-readable medium and loaded into the system 200 via the removable medium 230, the I / O interface 235, or the communication interface 240. In such embodiments, the software is loaded into the system 200 in the form of electrical communication signals 255. When executed by the processor 210, the software preferably causes the processor 210 to perform the features and functions described elsewhere herein.

[0054] In one embodiment, I / O interface 235 provides an interface between one or more components of system 200 and one or more input and / or output devices. Example input devices include, but are not limited to, a keyboard, a touch screen or other touch-sensitive device, a biometric sensing device, a computer mouse, a trackball, a pen-based pointing device, etc. Examples of output devices include, but are not limited to, a cathode ray tube (CRT), a plasma display, a light emitting diode (LED) display, a liquid crystal display (LCD), a printer, a vacuum fluorescent display (VFD), a surface conduction electron emitter display (SED), a field emission display (FED), etc.

[0055] System 200 may also include optional wireless communication components that facilitate wireless communication over a voice network and / or a data network. The wireless communication components may include an antenna system 270, a radio system 265, and a baseband system 260. In system 200, RF signals are transmitted and received over the air by antenna system 270 under the management of radio system 265.

[0056] In one embodiment, the antenna system 270 may include one or more antennas and one or more multiplexers (not shown) that perform switching functions to provide transmit and receive signal paths for the antenna system 270. In the receive path, the received RF signal may be coupled from the multiplexer to a low noise amplifier (not shown) that amplifies the received RF signal and sends the amplified signal to the radio system 265.

[0057] In alternative embodiments, the radio system 265 may include one or more radios configured to communicate on various frequencies. In one embodiment, the radio system 265 may combine a demodulator (not shown) and a modulator (not shown) in one integrated circuit (IC). The demodulator and modulator may also be separate components. In the incoming path, the demodulator strips off the RF carrier signal leaving a baseband receive audio signal that is sent from the radio system 265 to the baseband system 260.

[0058] If the received signal contains audio information, the baseband system 260 decodes the signal and converts it into an analog signal. Then, the signal is amplified and sent to the speaker. The baseband system 260 also receives analog audio signals from the microphone. These analog audio signals are converted into digital signals and encoded by the baseband system 260. The baseband system 260 also encodes the digital signal for transmission and generates a baseband transmission audio signal routed to the modulator part of the radio system 265. The modulator mixes the baseband transmission audio signal with the RF carrier signal to generate an RF transmission signal, which is routed to the antenna system 270 and can pass through a power amplifier (not shown). The power amplifier amplifies the RF transmission signal and routes it to the antenna system 270, where the signal is switched to the antenna port for transmission.

[0059] The baseband system 260 is also communicatively coupled to the processor 210, which may be a central processing unit (CPU). The processor 210 may access data storage areas 215 and 220. The processor 210 is preferably configured to execute instructions (i.e., computer programs, such as disclosed applications or software modules) that may be stored in the main memory 215 or the secondary memory 220. Computer programs may also be received from the baseband processor 260 and stored in the main memory 210 or the secondary memory 220 or executed upon receipt. Such computer programs, when executed, enable the system 200 to perform various functions of the disclosed embodiments. For example, the data storage areas 215 or 220 may include various software modules.

[0060] 1.3. Example Data Structure

[0061] The term "entity" may be used herein to refer to data associated with a visitor or contact throughout an activity. For example, an entity may include, but is not limited to, an IP address used by a visitor's or contact's device (e.g., user system 130) for online communications, a domain name associated with a visitor or contact during online communications (e.g., for a website and / or email domain), and / or a cookie that has been stored on the visitor's device during browsing. Such data may be permanently, semi-permanently, or temporarily associated with a visitor or contact, and typically does not uniquely identify the visitor or contact. For example, an IP address may be a static IP address that is always associated with a particular visitor's device, or a dynamic IP address that may be temporarily assigned to a device and subsequently reallocated to a different device by an Internet Service Provider (ISP). In addition, a particular visitor may use multiple IP addresses (e.g., one IP address for a visitor at work, and another IP address for a visitor at home). Similarly, a domain name may be associated with multiple visitors or contacts, and a visitor or contact may be associated with multiple domain names. As another example, a visitor may be associated with multiple cookies both at once and over time, and each cookie exists on the visitor's device for only a limited time before being deleted (e.g., manually by the user of the device, automatically upon expiration or upon session termination, etc.).

[0062] The term "event" may be used herein to refer to any activity from any source. Activities may include, but are not limited to, visiting a website's webpage, filling out an online form, purchasing a product via an e-commerce website, contacting a merchant or salesperson (e.g., via an online form, electronic mail (email) message, instant messaging chat, short message service (SMS) text, multimedia message service (MMS) message, etc.), and / or any other online interaction. Activities may also include offline activities, such as attending a trade show or seminar, calling a customer service call center, making an offline purchase, etc. Sources may include, but are not limited to, websites, marketing automation platforms (MAPs), cookie tracking sources, vendor data, etc. As an example, a visitor to a website may fill out an online form within a website's webpage, and the activity may be communicated to an application as an event along with an entity representing the visitor (e.g., an IP address used by the visitor's device to communicate with the website, a domain name associated with the visitor's ISP or business, a string representing part or all of the contents of a tracking cookie stored on the visitor's device, etc.).

[0063] Events may be implemented as data structures (e.g., vectors, linked lists, arrays, delimited strings, etc.) that include a representation of an entity representing a visitor (e.g., an IP address, domain, and / or cookie) and a timestamp representing the time at which the activity occurred. It should be understood that the data structure may also include any additional data that may help map a visitor to an account, identify or categorize an activity, etc. For example, each event data structure may also include a representation of the activity, source information indicating the source of the event and / or activity, etc. Additionally, an event may include visitor-specific information, such as if the visitor submitted a form or logged into their account during a visit. In this case, the source may incorporate user-specific information entered into a form or obtained from a user profile associated with a logged-in account in the event information recorded for the event.

[0064] The term "mapping" may be used herein to refer to each association between an entity and an account (e.g., a company name or other company identifier). Each mapping indicates that there is at least some reason to believe that the associated account has used the entity in the past, and therefore current or future activity of the entity may represent online activity of the account. A mapping may be implemented as a data structure that includes a representation of an entity (e.g., an IP address, domain, and / or cookie) and an account identifier. It should be understood that the data structure may also include any additional data, including span, latency, spread, strength, source weight, overlap, and / or confidence.

[0065] In one embodiment, each mapping data structure includes or is associated with a span value. The span value represents the time period during which the corresponding mapping is active. For example, if the mapping is derived from three events occurring on January 1, 2017, March 3, 2017, and November 4, 2017, the span value can be calculated as the number of days between the first event and the last event (i.e., January 1, 2017 to November 4, 2017, or three hundred and seven days). It should be understood that the span value can be calculated and represented according to any level of granularity (e.g., days, hours, minutes, seconds, milliseconds, etc.), but for simplicity, it will be measured in days in this disclosure.

[0066] In one embodiment, each mapping data structure includes or is associated with a delay value. The delay value represents the time period since the corresponding mapping was last active. For example, if no mapping events occurred from November 4, 2017 to January 1, 2018, the delay value can be calculated as the number of days between November 4, 2017 and January 1, 2018 (i.e., fifty-eight days). It should be understood that the delay value can be calculated and represented according to any level of granularity (e.g., days, hours, minutes, seconds, milliseconds, etc.), but for simplicity, it will be measured in days in this disclosure.

[0067] In one embodiment, each mapping data structure includes or is associated with a spread value. The spread value represents a time period that indicates how often the mapping is active within its span value. For example, if the mapping is derived from three or more events that occurred on January 1, 2017, March 3, 2017, and November 4, 2017, the spread value may be three days. It should be understood that the spread value may be calculated and represented according to any level of granularity (e.g., the number of days that an event occurred, or the total duration of an event expressed in days, hours, minutes, seconds, milliseconds, etc.), but for simplicity, it will be measured in days in this disclosure.

[0068] In one embodiment, each mapping data structure includes or is associated with an intensity value. The intensity value represents how often the mapping is active within its span value. For example, if the mapping is derived from one event that occurred on January 1, 2017, two events that occurred on March 3, 2017, and three events that occurred on November 4, 2017, the intensity value may be six because there are six events. It is noteworthy that the intensity value is different from the spread value because the intensity value indicates the number of events, not the number of days (e.g., multiple events may occur in a day) or other amount of time. It should be understood that where the spread value is a number of days, the intensity value may equal or exceed the spread value, but will never be less than the spread value.

[0069] In one embodiment, each mapping data structure includes or is associated with a source weight. The source weight represents the relative accuracy of one or more sources of events from which the corresponding mapping is derived. The calculation of the source weight is described elsewhere herein.

[0070] In one embodiment, each mapping data structure includes or is associated with an overlap value. The overlap value represents the number of sources that validate the corresponding mapping. For example, if the mapping is derived from events received from three different sources or the mapping corresponds to other mappings derived from two other different sources, the overlap value will be three total sources (or two validating sources).

[0071] In one embodiment, as described elsewhere herein, each mapping data structure includes or is associated with a confidence value that has been calculated based on one or more factors (e.g., span, latency, spread, strength, source weight, and / or overlap statistics). In this context, the confidence value for a particular mapping represents a measure of confidence that a visitor or contact who has used, is using, or will use the corresponding entity is associated with the corresponding account. The confidence values ​​will be primarily described herein as decimals between 0 and 1. However, it should be understood that the range of possible confidence values ​​can be readily converted to any desired range of values, with corresponding modifications to any disclosed calculations depending on the confidence value.

[0072] The term "event pool" is used herein to refer to a data structure in which all original event data structures are stored. For example, whenever an event is received from a source, a representation of the event can be stored in the event pool as the described event data structure. For example, each event data structure can include a timestamp (e.g., indicating the date and / or time of the activity under the event), an entity (e.g., an IP address, a website and / or an email domain and / or a cookie), a source from which the event is received and / or the event occurs, a hash value of an email address associated with the event (if any), a company name (if any), a geographic location (if the user logs into an account to perform the activity, based on the user entry or user profile during the basic activity) and / or a geographic IP location (if the entity includes an IP address) (i.e., each IP address can be associated with a country, because different IP blocks are assigned to different countries). Each event data structure can also include additional information (e.g., relevant information from a user entry or user profile), such as a city, state, zip code, global positioning system (GPS) coordinates (e.g., latitude, longitude and / or altitude), etc. As described elsewhere herein, one or more fields of each event data structure can be normalized before entering the event pool.

[0073] Since each event is stored separately in the event pool and the number of events collected is usually very large, the event pool will be very large. Therefore, in order to process events in a more compressed state, applications can use "map pools". Specifically, the term "map pool" is used in this article to refer to a data structure that aggregates events stored in the event pool to form a map.

[0074] 2. Process Overview

[0075] An embodiment of a process for mapping an anonymous entity to a known account will now be described in detail. It should be understood that the described process may be embodied in one or more software modules executed by one or more hardware processors, for example, as an application discussed herein (e.g., a server application 112, a client application 132, and / or a distributed application including both a server application 112 and a client application 132), which may be executed entirely by one or more processors of a platform 110, entirely by one or more processors of one or more user systems 130, or may be distributed across a platform 110 and one or more user systems 130, such that some parts or modules of the application are executed by the platform 110 and other parts or modules of the application are executed by one or more user systems 130. The described process may be implemented as instructions represented in source code, object code, and / or machine code. These instructions may be executed directly by one or more hardware processors, or alternatively may be executed by a virtual machine operating between the object code and the hardware processor. In addition, the disclosed application may be built on or interact with one or more existing systems.

[0076] Alternatively, the described process can be implemented as a hardware component (e.g., a general purpose processor, an integrated circuit (IC), an application specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic, etc.), a combination of hardware components, or a combination of hardware and software components. In order to clearly depict the interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described herein according to their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and design constraints imposed on the entire system. For each specific application, the technician can implement the functionality in different ways, but such implementation decisions should not be interpreted as causing deviations from the scope of the present invention. In addition, the functional grouping within the component, block, module, circuit, or step is for ease of description. Without departing from the present invention, a specific function or step can be moved from one component, block, module, circuit, or step to another.

[0077] Figure 3 A process 300 for mapping anonymous entities to known accounts is shown according to one embodiment. Although process 300 is shown with a certain arrangement and order of steps, process 300 may also be implemented with fewer, more, or different steps and different arrangements and / or orders of steps.

[0078] 2.1. Collected into event pool

[0079] In step 310, the application receives events from one or more sources (e.g., external systems 140 and / or internal sources on platform 110) and collects the events into an event pool. As described elsewhere herein, each event can be received as a data structure including at least one entity and a timestamp. Each event can be stored in a data structure within the event pool and can include an entity (e.g., an IP address, domain, and / or cookie), a timestamp, an identifier of the event source, and optional additional information (e.g., a geographic IP location associated with the IP address in the entity, a company or user name, etc.).

[0080] It should be noted that the original event data may have noise.Therefore, in one embodiment, when the event data is input in the event pool or after the event data is input in the event pool, the event data is normalized.For example, can be to geographic IP location (for example, use nomenclature and / or grammatical technology all changes of the same country name are converted to a single standard country name), company or account name (for example, use nomenclature and / or grammatical technology all changes of the same company or account name are converted to a single standard name), domain name (for example, abandon any part of the domain name before the second-level domain name) and / or other fields and perform normalization.Fuzzy matching can be used to identify the variation of these field values.Can perform normalization in all entries in the cross event pool, so that subsequent aggregation process is maximized.

[0081] As an example of normalization, one or more aliases of a primary domain (e.g., abc.com is an alias of abc.go.com) can be detected in incoming event data and normalized to the primary domain before entering the event pool. Advantageously, this avoids parsing the same domain into different domains. In one embodiment, one or more (including all) of the following techniques (e.g., implemented by an application) can be used to build the alias set:

[0082] (1) Send a request to the first domain (e.g., abc.com) to see if it redirects to the second domain (e.g., abc.go.com). If the request to the first domain redirects to the second domain, then the first domain is an alias of the second domain (e.g., abc.com is an alias of abc.go.com).

[0083] (2) Retrieve the Domain Name System (DNS) IP address of the domain (e.g., using a DNS lookup), and build a domain set associated with the retrieved IP address (e.g., using a reverse IP lookup such that the DNS IP => domain set). Once the domain set has been built, the application can send a request to each domain in the domain set and check the similarity between the returned web pages (e.g., based on style). For example, if the domain set for IP address 1.1.1.1 is [a.com, b.com, c.com], then web pages on a.com, b.com, and c.com can be retrieved, and the styles of those retrieved web pages can be compared. If the styles are the same or similar, the application can determine that the domain set [a.com, b.com, c.com] is an alias set, and select a domain from the domain set to act as the primary domain. For example, an application may randomly select a.com as the primary domain and normalize all future event data to the primary domain by modifying any event data associated with alias domains b.com and c.com to be associated with the primary domain a.com (any event data associated with a.com will remain associated with a.com).

[0084] (3) Build a domain set based on the string distance between the domains (e.g., as seen in the event data), send a request to each domain in the domain set, and check the similarity between the returned web pages (e.g., based on style). The similarity matching can be the same or different from the similarity matching in technique (2) above. For example, the application can identify JonBakery.com, JonBakes.com, and JonBaker.com as a domain set that represents possible aliases of each other based on the string distance between the domain names. The web pages on JonBakery.com, JonBakes.com, and JonBaker.com can be retrieved and the styles of those retrieved web pages can be compared. If the styles are the same or similar, the application can determine that the domain set [JonBakery.com, JonBakes.com, and JonBaker.com] is an alias set and select a domain from the domain set to act as the primary domain. For example, the application may randomly select JonBaker.com as the primary domain and normalize all future event data to the primary domain by modifying any event data associated with the alias domains JonBaker.com.com and JonBakes.com to be associated with the primary domain JonBaker.com (any event data associated with JonBaker.com will remain associated with JonBaker.com).

[0085] The domain sets determined to be aliases using the above techniques (1), (2), and / or (3) can be merged into a single alias domain set. Then, in one embodiment, the merged alias domain sets having an unreasonably high number of domains therein (e.g., a set including a number of domains exceeding a predetermined threshold) are filtered out from the collected event data. Specifically, event data associated with any domain in any of the filtered domain sets can be excluded from the event pool. This is because large alias domain sets indicate redirections by domain sellers, hosting services, social media platforms, etc., rather than being associated with valid accounts.

[0086] Additionally, event data can be filtered out based on one or more other criteria. For example, events related to and network service providers (e.g., Amazon TM , Google TM , Microsoft TM As another example, event data associated with an entity from which a pattern of robotic activity is detected may be excluded from the event pool. A pattern of robotic activity may include an unreasonably high number of requests, web scraping behavior, periodic events, etc.

[0087] 2.2. Aggregate into a map

[0088] In step 320, the application aggregates the events stored in the event pool into the mapping pool. For ease of understanding, this step will be described using a specific non-limiting example. Assume that the event pool includes the entries shown in Table 1 below. It is worth noting that not all entry fields are necessarily shown in the included tables, and the entries in these tables represent only a small portion of the entries that will exist in the actual pool and are only used for a single entity. The entries of the actual implementation may include more, fewer, or different fields and / or different representations of field values ​​than the fields shown in the table.

[0089] Table 1

[0090] date IP address domain Geographic IP source 12 / 30 / 2016 1.1.1.1 xyz.com USA Source 1 01 / 01 / 2017 1.1.1.1 abc.com USA Source 2 01 / 03 / 2017 1.1.1.1 abc.com USA Source 3 01 / 04 / 2017 1.1.1.1 abc.com USA Source 3 01 / 06 / 2017 1.1.1.1 abc.com USA Source 3 01 / 14 / 2017 1.1.1.1 abc.com USA Source 3 01 / 15 / 2017 1.1.1.1 abc.com USA Source 3 01 / 20 / 2017 1.1.1.1 xyz.com USA Source 1 01 / 28 / 2017 1.1.1.1 abc.com USA Source 3 01 / 28 / 2017 1.1.1.1 abc.com USA Source 3 01 / 29 / 2017 1.1.1.1 abc.com USA Source 2 02 / 02 / 2017 1.1.1.1 abc.com USA Source 3

[0091] In this example, two events have been received from source 1 (e.g., a data vendor) associating IP address 1.1.1.1 with a domain of xyz.com, two events have been received from source 2 (e.g., directly from a website, e.g., a report login) associating the same IP address with a domain of abc.com, and eight events have been received from source 3 (e.g., a marketing automation platform) associating the same IP address with abc.com. On February 3, 2017, these twelve events from the event pool may be compressed into two entries in the mapping pool, as shown in Table 2 below.

[0092] Table 2

[0093]

[0094] As shown in Table 2, all single events stored in the event pool are matched to other events with matching entities and aggregated into a single entry in the mapping pool, which associates the IP address with the account name. In one embodiment, the account name can be derived from the domain name (e.g., "XYZ" from "xyz.com" and "ABC" from "abc.com"). Statistics (e.g., span value, delay value, extension value, intensity value, and overlap value) are calculated for each aggregated event set, and the statistics are included in the entries in the mapping pool. In this case, two entries with IP address 1.1.1.1 and the same domain name "xyz.com" have been combined into a single entry, which has a span value of 21 days, a delay value of 14 days, an extension value of 2 days, an intensity value of 2 days, an overlap value of one source, and a list of identifiers including the one source. Similarly, ten entries with the same IP address but different domain names "abc.com" have been combined into a single entry with a span value of 32 days, a delay value of 1 day, a spread value of 9 days, an intensity value of 10 days, an overlap of two sources, and a list including identifiers for each of those two sources. Additionally, the domain name "xyz.com" has been associated with XYZ Company with a normalized company name of "XYZ," and the domain name "abc.com" has been associated with ABC Company with a normalized company name of "ABC."

[0095] 2.3. Confidence calculation for each mapping

[0096] In step 330, the application calculates a confidence value for each mapping in the mapping pool. In one embodiment, an overall confidence value for each mapping is calculated based on a plurality of different confidences. For example, the confidence value may be a combination of a temporal confidence, a statistical confidence, and / or a source confidence, each of which is calculated based on aggregate information within each mapping.

[0097] 2.3.1. Time Confidence

[0098] The temporal confidence for a particular mapping can be calculated using the following Equation 1:

[0099]

[0100] where span is the span value associated with the mapping and delay is the delay value associated with the mapping.

[0101] Equation 1 generates an S-shaped curve based on the inference that mappings with higher span values ​​should decay at a lower rate than mappings with lower span values. However, at the same time, mappings with low span values ​​should still be captured. For example, if a particular mapping was active yesterday and only yesterday, it will have a high temporal confidence value (e.g., 0.3) because it is new, but if it is no longer active in the future, the temporal confidence value will drop rapidly. Conversely, a competing mapping that was inactive for the past month but was active for the entire year before the past month will have an even higher temporal confidence value (e.g., 0.8), so that the competing mapping will surpass the new but fleeting mapping in terms of corresponding confidence values.

[0102] 2.3.2. Statistical confidence

[0103] The statistical confidence can be calculated using the following equation 2:

[0104] Weight 强度 *log 1000 (Strength) + Weight 扩展度 *log 100 (Extension) [Equation 2]

[0105] where strength is the strength value associated with the mapping, where spread is the spread value associated with the mapping, and where weight 强度 +Weight 扩展度 = 1.0, and wherein in one embodiment, the weight 强度 =Weight 扩展度 =0.5.

[0106] Equation 2 uses a logarithmic function to reward statistics such as strength and spread. In practice, most mappings are likely to have low values ​​for these statistics. Therefore, those mappings with higher values ​​for these statistics will be distinguished and "rewarded" with respect to their respective confidence values.

[0107] 2.3.3. Source Confidence

[0108] The source confidence for a particular mapping can be calculated using Equation 3 below, which essentially subtracts the probability of an error feeding each source of the event from which the mapping was derived:

[0109]

[0110] Where S is the overlap value for the mapping and source_confidence is a confidence value between 0 and 1 associated with each source from which events used to derive the mapping were received (e.g., a global confidence value for each source based on the source's past reliability or accuracy).

[0111] Source confidence can be an important variable in the overall confidence value. Although some sources can supply credible data based on reliable methods, other sources may also be unreliably noisy (e.g., many inaccurate data are mixed in with accurate data). In one embodiment, the source_confidence value for a particular source can be determined based on the following assumption: if N separate sources agree on a mapping, then the mapping is true. N should be at least two, preferably greater than three.

[0112] Figure 4A and Figure 4B An example process 400 for determining a source confidence value for each event source is shown according to one embodiment. Although process 400 is shown with a certain arrangement and order of steps, process 400 may also be implemented with fewer, more, or different steps and different arrangements and / or orders of steps.

[0113] In step 410, to evaluate the accuracy of a particular source, the application may construct a set of "true" mappings by creating a pool of mappings based on at least N (e.g., three) sources from a pool of mappings. In one embodiment, the source to be evaluated may be excluded from the pool. In such an embodiment, step 410 may occur after decision block 420 so that a new pool of "true" mappings is created each time a source is evaluated. In either case, these selected mappings represent a "true set," a subset of mappings that are assumed to be true.

[0114] In step 420, the application determines whether there are still any sources to consider. It should be understood that all sources from which events come can be evaluated according to process 400. If there is still at least one source to consider (i.e., "yes" in step 420), the next source is selected as the current source, and process 400 proceeds to step 430. Otherwise, if there are no sources to consider (i.e., "no" in step 420), process 400 ends.

[0115] In step 430, the overlap or intersection between the mapping derived from the current source being evaluated and the true set of mappings is determined. Figure 4B This mapping intersection is shown in .

[0116] In step 440, the application uses the intersection to determine a confidence metric for the current source being evaluated based on how many true mappings and / or how many non-true mappings have been derived from the current source being evaluated. In other words, mappings derived from the current source that match the mappings in the true set (e.g., mappings in both entities and accounts) are assumed to be true mappings derived from the current source. The determined metric can then be used as or used to derive a source confidence (i.e., the value of source_confidence in equation 3) for the current source being evaluated. For example, the source confidence can be a ratio (e.g., percentage) of the number of "true" mappings in the overlap to the total number of mappings derived from the current source. After the source confidence for the current source has been determined, process 400 returns to step 420 to evaluate the next source (if any), otherwise terminates.

[0117] 2.3.4. Overall confidence

[0118] The overall confidence of a particular mapping may be calculated based on each of the temporal confidence, statistical confidence, and source confidence of the mapping using Equation 4 below:

[0119] Weight 1 (confidence 源 +(1-confidence 源 )Confidence 统计 )+weight2(confidence 时间 ) [Equation 4

[0120] The confidence 时间 is the calculated time confidence, confidence 统计 is the calculated statistical confidence level, confidence 源 is the calculated source confidence, where Weight 1 + Weight 2 = 1.0, and where in one embodiment, Weight 1 = 0.7 and Weight 2 = 0.3.

[0121] 2.4. Filtering and cleaning maps

[0122] In step 340, the mapping with the calculated confidence value may be filtered, cleaned, or corrected. In one embodiment, step 340 includes ISP filtering and / or location cleansing.

[0123] 2.4.1. ISP Filtering

[0124] Typically, if an entity includes an IP address belonging to an ISP (e.g., which dynamically assigns IP addresses to different customers), there may be many conflicting mappings for the same entity. Therefore, in one embodiment, the application filters the mappings by calculating the ratio of the confidence value of the mapping with the largest confidence value for a particular entity to the sum of all confidence values ​​of all mappings for the particular entity and then comparing the ratio to a threshold. For example, the comparison can be expressed as the following Equation 5:

[0125]

[0126] So, for example, if the maximum confidence value is 0.5, then that confidence value would need to be equal to 25% of the cumulative confidence values ​​to be considered a valid mapping. If the maximum confidence value is 0.1, then it would need to be equal to 45% of the cumulative confidence values. This thresholding filters out conflicting mappings in the case where no single mapping clearly stands out in terms of its confidence value.

[0127] In one embodiment, sum(confidence 实体 ) can represent the sum of all distinct confidence values, rather than the sum of all confidence values, to avoid overcounting. In particular, two or more mappings for the same entity may end up having the same confidence value. In this case, dividing by the sum of all distinct confidence values, rather than the sum of all confidence values ​​(i.e., including distinct confidence values ​​and identical confidence values), can make the ISP filter more conservative. Alternatively, sum(confidence) 实体 ) can be used to represent the sum of all confidence values ​​without considering the dissimilarity.

[0128] In one embodiment, if Equation 5 is not satisfied, all mappings associated with the particular entity can be filtered out (e.g., discarded or ignored). Otherwise, if Equation 5 is satisfied, the mapping with the largest confidence value for the entity can be retained, while all other mappings associated with the entity can be filtered out. In essence, Equation 5 ensures that mappings with lower confidences need to account for a larger percentage of the total confidence values ​​to avoid being discarded, while mappings with higher confidences will remain unless they compete with an unreasonable number of mappings for the same entity.

[0129] 2.4.2. Location Cleanup

[0130] Because ranges of IP addresses are associated with certain countries, if an entity includes an IP address, the IP address can be used to determine the associated country or other geographic information. The application can use this geographic information to correct or clean up the mapping. For example, an event can associate an online activity (e.g., a website visit) with a contact of an account (e.g., based on a login to the website). In this case, if the contact is incorrect, the mapping will be incorrect. Additionally, if the contact is employed by a company with different divisions (e.g., a multinational corporation, a consulting firm, etc.), the contact may be performing activities associated with one division while linking the activity to another division (e.g., the division that employs the contact).

[0131] In one embodiment, the application solves these problems by determining which portion of the events for a particular account from a particular source come from different countries. Specifically, the application can collect statistics at the account level, rather than by IP address, in order to determine whether the account has been correctly linked. As an example, if thousands of IP addresses have been previously mapped to an account in the United States called "ABC, USA", it can be assumed that most of the new IP addresses received in new events should also originate from the United States.

[0132] In one embodiment, the application may correct, clean, or filter the mapping as follows:

[0133] (1) if the majority of IP addresses in new events are associated with a country that is different from the country in the existing map, then change the country in the existing map to a new, different country;

[0134] (2) if the accounts in the mapping represent large companies with offices across the globe and the IP addresses in the events are associated with multiple countries without one country having a clear majority, split the mapping into multiple mappings, with one mapping targeting one of the multiple countries or targeting one of the major countries (e.g., and discarding mappings targeting countries with a relatively insignificant number of events); and / or

[0135] (3) If the IP address in the new event is associated with a country that is different from the country in the existing mapping, but the source and / or mapping confidence value is lower, then the existing mapping is not changed and a new mapping is not created for the new event (i.e., the new event is discarded, ignored, or otherwise filtered out).

[0136] 2.4.3. Valid domain check

[0137] In one embodiment, one of the key fields used to identify an account is a domain. Due to noise in the event data, some mappings may map invalid domains and / or incorrect domains to accounts. Therefore, in one embodiment, the application can verify one or more domains in the mapping by sending a request to each domain. For example, the application can verify the domain name in each mapping associated with a low confidence value (e.g., a confidence value below a predetermined threshold) by sending a request to each domain name in the low confidence mapping. If a request for a domain associated with a particular mapping is redirected to a website that does not indicate a valid account (e.g., a domain seller, a hosting service, a social media platform, etc.) and / or the request results in an error or some other reason that the mapping may be wrong, the mapping can be discarded or excluded as invalid.

[0138] 2.5. Mapping selection

[0139] In step 350, for each entity, the application selects the remaining mappings having the highest confidence value determined in step 330 from the mappings that were filtered and cleaned in step 340. In one embodiment, the application may select a mapping only if the confidence value of the mapping exceeds a minimum threshold. For example, in some cases, the application may discard all mappings for a particular entity, including the mapping with the highest confidence value, if none of the mappings have a confidence value above a certain minimum threshold.

[0140] In one embodiment, the minimum threshold may depend on the specific context in which the mapping is to be used. For example, some contexts or users of the platform 110 may require a higher level of confidence in the mapping, in which case the minimum threshold may be set higher. Other contexts or users may not require such a high level of confidence, in which case the minimum threshold may be set lower or eliminated entirely.

[0141] In one embodiment, the output of process 300 is a graph, list, table, or other representation of each remaining mapping between entities and accounts. It should be understood that the representation will only include the mappings remaining after filtering and cleaning in step 340 and selection and / or thresholding in step 350. The representation can be stored and / or transmitted as a data structure, displayed in a graphical user interface, used as input to another application (e.g., via an API), etc. In one embodiment, the representation is a database of the final mappings indexed by entity. The entity index can be a primary unique index so that a single entity is never mapped to more than one account.

[0142] In addition, in one embodiment, each of the final mappings can be linked to the contact information for the account through the account represented in the mapping. For example, the account identifier in the mapping can be used (e.g., as an index into a database) to retrieve the contact information associated with the account identifier.

[0143] Thus, for example, a user can demonstrate online activity on a user's website from a particular IP address. The user can initiate a query for the resulting mapping through the application using the IP address as a search criterion, and the application can responsively return to the user an account name (e.g., company name) and associated contact information for the account. Advantageously, this enables the user to contact Internet visitors who would otherwise be unable to contact due to the inherent anonymity of the Internet.

[0144] The lookup process can also be automated. For example, a website operator can develop third-party software that utilizes the application's API to automatically query the resulting mapping for each IP address seen in the website's online activity (e.g., in real time, periodically, etc.). The application can then automatically return account names and / or contact information associated with those IP addresses for further processing by the third-party software and / or use by the website operator.

[0145] 2.6. Example Implementation

[0146] Figure 5 The interactions between various data structures in one example implementation of process 300 according to one embodiment are shown. It should be understood that the process can be implemented by the disclosed application (e.g., server application 112 and / or client application 132). Although the process is shown with certain data structures and steps, the process can also be implemented with fewer, more, or different data structures and / or different steps.

[0147] The events collected in step 310 are initially stored in event pool buffer 555 before being stored in event pool 560. When events are added to event pool buffer 555, the events may each be given a status indicating that it is a new event. In addition, the events may be normalized as discussed elsewhere herein.

[0148] In step 505, the events in the event pool buffer 555 are aggregated into maps, as described elsewhere herein. These maps are initially stored in a pool of mini-maps 565 for smoother merging in step 520. Additionally, in step 510, each unique entity from the events in the event pool buffer 555 is stored in a changed entity buffer 570. The changed entity buffer 570 may be partitioned by the date of the event. As events in the event pool buffer are aggregated into maps, the state of the event may be changed to indicate that the event is being aggregated and / or the time when the event has been aggregated (e.g., to prevent redundant processing).

[0149] In step 515, the mappings stored in the existing mapping pool 575 are split based on the entities stored in the changed entity buffer 570 to produce a split mapping pool 580. This may involve sorting the mapping pool 575 based on the entities in the mapping, or extracting mappings only for those entities stored in the changed entity buffer 570.

[0150] In step 520, the mini-map pool 565 is merged with the split map pool 580 to produce a changed map pool 585. The merge can include: for each map that exists in both the mini-map pool 565 and the split map pool 580, calculating the combined statistics and new confidence values, as described elsewhere herein, and adding new entries for the map to the changed map pool 585 using the combined statistics and confidence values. To facilitate the calculation of the statistics and confidence values, the pool can be split based on the account (e.g., company name) and the domain. Maps that exist only in the mini-map pool 565 can simply be added to the changed map pool 585 with their corresponding statistics and confidence values.

[0151] In step 525, mapping pool 575 is updated with the entries in the changed mapping pool 585. For example, the entries in the changed mapping pool 585 may overwrite any corresponding entries in mapping pool 575. In addition, in step 530, the events aggregated in step 505 (e.g., those events whose status indicates that they are being aggregated) in event pool buffer 555 are injected into event pool 560.

[0152] It should be appreciated that this implementation of process 300 may be performed periodically (e.g., at specific time intervals, when event pool buffer 555 reaches a predetermined size, etc.) as new events are added to event pool buffer 555. Additionally, in one embodiment, all changes to mapping pool 575 and / or event pool 560 may be logged (e.g., by date and data) for audit purposes and / or to restore or roll back mapping pool 575 and / or event pool 560 to a previous state if necessary.

[0153] 2.7. Sample web service

[0154] As discussed elsewhere herein, the platform 110 may implement network services, for example, as part of a service application 112 . Figure 6 The interaction between various data structures in an example implementation of a network service according to one embodiment is shown. Although the process is shown with certain data structures and steps, the process may also be implemented with fewer, more or different data structures and / or different steps.

[0155] As shown, the platform 110 may include a web server 680 serving graphical user interfaces including a user interface 690 for interacting with a queue of inquiries 682 and a user interface 695 for submitting inquiries. Users may have access to one or both of the user interfaces 690 and 695 based on their permissions. For example, an administrative user may have access to the user interface 690 for managing a queue of inquiries submitted by clients, and multiple client users may have access to the user interface 695 for submitting inquiries.

[0156] In step 605, a user of user interface 690 may submit a request for information about queue 682 (e.g., to view all queries in queue 682). The request is sent to network server 680 (e.g., via one or more networks 120), and in response, network server 680 queries queue 686 in step 610. In response to the query, a representation of queue 682 is returned to network server 680 in step 615. Network server 680 then parses the representation of queue 682 to generate a renderable representation of queue 682, and returns the renderable representation of queue 682 to user interface 690 for visual representation to the user (e.g., on a display of the user system 130 of the user).

[0157] In step 625, a user of the user interface 695 may submit a query. The query may include the mapped entity, account name, and / or any other indexable field in the mapping pool 575. For example, a user who has noticed an increase in activity from a particular IP address may wish to bind the originally anonymous IP address to a particular company so that the user can then directly contact and contact the company (e.g., for marketing or sales purposes). Therefore, a user may submit a query for a company name that has been mapped to the originally anonymous IP address via the user interface 695. The query is sent to the network server 680 (e.g., via one or more networks 120). The network server 680 may verify the query (e.g., ensure that it meets format requirements, information requirements, etc.) and check whether the query already exists in the queue 682. If the query cannot be verified, the network server 680 may return an error message to the user interface 695. Otherwise, if the query is verified and does not yet exist in the queue 682, the network server 680 adds the query to the queue 682 in step 630. If the query already exists in the queue 682, the network server 680 may discard the query. Alternatively, the network server 680 can add all verified queries to the queue 682, regardless of whether they are redundant. It should be understood that when the network server 680 adds a query to the queue 682, the network server 680 can parse the query from the user interface 695 and construct the query in a new format to add to the queue 682.

[0158] In step 636, the query from the front of the queue 682 is provided to the query runner 684. The query runner 684 may include a software module that converts the query into a query to the mapping pool 575. Thus, in step 640, the query runner 684 queries the mapping pool 575, and receives the query results in step 645. In step 650, the query runner 684 stores the query results in results 686, which may include a local cache of the platform 110. The query results may be stored in results 686 in JSON or any other suitable format.

[0159] In step 655, a user of the user interface 695 may submit a request for the results of a previous query (e.g., submitted in step 625). The request is sent to the network server 680 (e.g., via one or more networks 120), and in response, the network server 680 queries for results 686 in step 660. In response to the query, the results of the query (if any) are returned to the network server 680 in step 665. The network server 680 then parses the results to generate a renderable representation of the results, and returns the renderable representation of the results to the user interface 695 for visual representation to the user (e.g., on a display of the user system 130 of the user). The network server 680 may use a stored template for reporting to construct the renderable representation of the results.

[0160] In an alternative or additional embodiment, an API may be present for use in a manner similar to the user interface 695. For example, an application may submit queries via the API (e.g., similar to step 625), and in response receive results of those queries (e.g., similar to step 670). In this manner, third-party software (e.g., executed by external system 140) may be used to automate the query process for various users of platform 110.

[0161] The above description of the disclosed embodiments is provided to enable any person skilled in the art to adopt or use the present invention. Those skilled in the art will readily appreciate various modifications to these embodiments, and the basic principles described herein may be applied to other embodiments without departing from the spirit or scope of the present invention. Therefore, it should be understood that the description and drawings presented herein represent the current preferred embodiments of the present invention, and therefore represent the subject matter broadly contemplated by the present invention. It should also be understood that the scope of the present invention fully encompasses other embodiments that may be apparent to those skilled in the art, and the scope of the present invention is accordingly not limited thereto.

[0162] The combinations described herein, such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof", include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations, such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof", may be only A, only B, only C, A and B, A and C, B and C, or A, B, and C, and any such combination may contain one or more members of its constituent elements A, B, and / or C. For example, the combination of A and B may include one A and multiple Bs, multiple A and one B, or multiple A and multiple Bs.

Claims

1. A method for deanonymizing an anonymous Internet Protocol (IP) address, the method comprising using at least one hardware processor of a server platform to: receiving a plurality of events from a plurality of sources, wherein each of the plurality of events represents online activity and includes an IP address and event information; aggregating a subset of the plurality of events into a plurality of maps, wherein each of the plurality of maps associates the IP address shared by the subset of the plurality of events with an account and with a plurality of statistics about the subset of the plurality of events; For each of the plurality of mappings, calculating a confidence value of the mapping based on the associated plurality of statistical information, wherein calculating the confidence value of each mapping based on the associated plurality of statistical information comprises: calculating a temporal confidence value indicating a timing of events from which the mapping was derived; calculating a statistical confidence value indicating a frequency of the event from which the mapping was derived; calculating a source confidence value indicating an accuracy of one or more of the plurality of sources from which the event from which the mapping was derived was received; and Calculating the confidence value based on the temporal confidence value, the statistical confidence value and the source confidence value; selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings; and One or more requests including the requested IP address are responded to by searching the final subset for the requested IP address and returning an indication of an account associated with the requested IP address in the final subset. 2 . The method of claim 1 , further comprising using the at least one hardware processor to normalize the event information among the plurality of events. The method of claim 1 , wherein the event information of each of the plurality of events comprises a domain name.

4. The method of claim 1, wherein for each of the plurality of events, the event information includes a geographic region associated with the IP address of the event. The method of claim 1 , wherein each account includes a company name.

6. The method of claim 1 , wherein selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings comprises, for at least one set of two or more mappings that each associate the same IP address with a different account: determining one of the two or more mappings having a maximum confidence value among the two or more mappings; calculating a sum of the confidence values ​​of the two or more mappings; calculating a ratio of the maximum confidence value to the sum of the confidence values; as well as When the ratio does not exceed a threshold, the two or more mappings are excluded from the final subset.

7. The method of claim 6, wherein the threshold comprises a difference between one and the maximum confidence value multiplied by a constant value.

8. The method of claim 1, further comprising, after receiving a new set of events from one or more sources, using the at least one hardware processor: aggregating a subset of the new event set into a new mapping set; extracting a portion of the final subset that includes the IP addresses in the new event set; merging the new set of mappings with the extracted portion of the final subset by recalculating, for each mapping in the merged set of mappings, the plurality of statistics and the confidence values ​​about the mappings; as well as The final subset is updated with the merged set of mappings.

9. The method of claim 8, wherein each of the plurality of events is stored in a persistent event pool, and wherein the new set of events is not stored in the persistent event pool until after the final subset has been updated.

10. The method of claim 1, further comprising using the at least one hardware processor to: generating a graphical user interface including one or more inputs for receiving a user request including a requested IP address; In response to receiving the user request, adding a query representing the request to a query queue; subsequently, when the query reaches the front of the queue, querying the final subset of the plurality of mappings based on the query; as well as After receiving the results of the query, a graphical user interface is generated that includes a visual representation of the results of the query.

11. A system for deanonymizing an anonymous Internet Protocol (IP) address, the system comprising: at least one hardware processor; as well as One or more software modules, the one or more software modules being configured, when executed by the at least one hardware processor: receiving a plurality of events from a plurality of sources, wherein each of the plurality of events represents online activity and includes an IP address and event information, aggregating a subset of the plurality of events into a plurality of maps, wherein each of the plurality of maps associates the IP address shared by the subset of the plurality of events with an account and with a plurality of statistics about the subset of the plurality of events, For each of the plurality of mappings, calculating a confidence value of the mapping based on the associated plurality of statistical information, wherein calculating the confidence value of each mapping based on the associated plurality of statistical information comprises: calculating a temporal confidence value indicating a timing of events from which the mapping was derived; calculating a statistical confidence value indicating a frequency of the event from which the mapping was derived; calculating a source confidence value indicating an accuracy of one or more of the plurality of sources from which the event from which the mapping was derived was received; and Calculating the confidence value based on the temporal confidence value, the statistical confidence value and the source confidence value; selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings, and One or more requests including the requested IP address are responded to by searching the final subset for the requested IP address and returning an indication of an account associated with the requested IP address in the final subset.

12. The system of claim 11, wherein each account includes a company name.

13. The system of claim 11, wherein selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings comprises, for at least one set of two or more mappings that each associate the same IP address with a different account: determining one of the two or more mappings having a maximum confidence value among the two or more mappings; calculating a sum of the confidence values ​​of the two or more mappings; calculating a ratio of the maximum confidence value to the sum of the confidence values; as well as When the ratio does not exceed a threshold, the two or more mappings are excluded from the final subset.

14. The system of claim 13, wherein the threshold comprises a difference between one and the maximum confidence value multiplied by a constant value.

15. The system of claim 11, wherein the one or more software modules are further configured to, upon receiving a new set of events from one or more sources: aggregating a subset of the new event set into a new mapping set; extracting a portion of the final subset that includes the IP addresses in the new event set; merging the new set of mappings with the extracted portion of the final subset by recalculating, for each mapping in the merged set of mappings, the plurality of statistics and the confidence values ​​about the mappings; as well as The final subset is updated with the merged set of mappings.

16. The system of claim 15, wherein each of the plurality of events is stored in a persistent event pool, and wherein the new set of events is not stored in the persistent event pool until after the final subset has been updated.

17. The system of claim 11, wherein the one or more software modules are further configured to: generating a graphical user interface including one or more inputs for receiving a user request including a requested IP address; In response to receiving the user request, adding a query representing the request to a query queue; subsequently, when the query reaches the front of the queue, querying the final subset of the plurality of mappings based on the query; as well as After receiving the results of the query, a graphical user interface is generated that includes a visual representation of the results of the query.

18. A non-transitory computer-readable medium having instructions stored therein, wherein the instructions, when executed by a processor, cause the processor to: receiving a plurality of events from a plurality of sources, wherein each of the plurality of events represents online activity and includes an IP address and event information; aggregating a subset of the plurality of events into a plurality of maps, wherein each of the plurality of maps associates the IP address shared by the subset of the plurality of events with an account and with a plurality of statistics about the subset of the plurality of events; For each of the plurality of mappings, calculating a confidence value of the mapping based on the associated plurality of statistical information, wherein calculating the confidence value of each mapping based on the associated plurality of statistical information comprises: calculating a temporal confidence value indicating a timing of events from which the mapping was derived; calculating a statistical confidence value indicating a frequency of the event from which the mapping was derived; calculating a source confidence value indicating an accuracy of one or more of the plurality of sources from which the event from which the mapping was derived was received; and Calculating the confidence value based on the temporal confidence value, the statistical confidence value and the source confidence value; selecting a final subset of the plurality of mappings based on the confidence values ​​of the plurality of mappings; and One or more requests including the requested IP address are responded to by searching the final subset for the requested IP address and returning an indication of an account associated with the requested IP address in the final subset.

Images