Use user transitions over time to determine the geographic location of IP addresses.

Abstract

This invention generally relates to determining the geolocation of IP addresses using user transitions over time, and describes various techniques for determining the physical location of a network by tracking the movement of users / devices across different networks, and more specifically by tracking the movement of a specific user and / or device from a network with a known geolocation to a network with an unknown geolocation. Aspects of this technique include using time and network address information (e.g., IP address) from queries from users and combining this information with known geolocation information to create new, high-quality geolocation maps for previously unseen networks.

Description

[0001] This application is a divisional application of the original Chinese patent application entitled "Using Time-varying User Transitions to Determine the Geolocation of IP Addresses". The original application number is 201780064738.6, the PCT application number is PCT / US2017 / 057072, the original application date is October 18, 2017, the PCT international application entered the national phase on April 17, 2019, and the priority date of the original patent application is October 27, 2016. Background Technology

[0002] Internet users' physical location is useful for many different types of applications. Search engines and other applications often use a user's location to customize responses to user requests. For example, when a user submits a query for "weather," the search engine will use the user's location to display a weather forecast based on the user's location context. E-commerce websites can use geolocation information to pre-populate fields on forms, display different languages, and calculate shipping costs. Credit card companies use location information to detect fraud. Content delivery providers use location information to select the server closest to the user to deliver online content quickly and cost-effectively. However, obtaining accurate and complete information about a user's location is difficult.

[0003] For the purposes of this application, it is assumed that the user's location is the same as the location of the device the user is using. The device's location can be inferred based on its IP address. IP addresses are designed to allow one computer (or other digital device) to communicate with another computer (or other digital device) via a network such as the Internet. IP addresses also allow for the precise location and differentiation of the billions of digital devices connected to the Internet from other devices. In the same sense that a street address determines where a letter should be delivered, an IP address identifies where an Internet message should be delivered (i.e., which computer on the Internet). Currently, there are two versions of IP addresses: IPv4 and IPv6. IPv4 IP addresses are 32 bits long and are typically represented by four octets, each octet containing one to three digits, with each number or group of digits separated by a single dot (.). Each of the four digits can be between 0 and 255. Here is an example of an IPv4 address: 72.129.0.209. The next generation of IP addresses (IPv6) are 128 bits long, written in hexadecimal, and separated by colons. An example of an IPv6 address is: 3ffe:1900:4545:3:200:f8ff:fe21:67cf. IP addresses ensure that messages sent over the internet, as well as requests for data and the requested data, reach the correct destination.

[0004] IP addresses can be static or dynamic. A static IP address identifies a specific computer and remains the same every time the computer connects to the internet. Dynamic IP addresses are assigned when a computer connects to a network and can change over time for a specific device. Furthermore, when a device changes its geographical location, it can use a different IP address to connect to the network.

[0005] Matching IP addresses to geographic locations is a form of geolocation. However, determining the geolocation of an IP address can be difficult. The most accurate way to determine geolocation is using a location system such as GPS. Unfortunately, this information is unavailable to most users because they are not using devices with GPS or have not granted search engines permission to use their device's GPS information. Another method to determine geolocation is to require users to self-report their geolocation. While this may be accurate in the short term, in the long term, users may move to another location without updating their self-reported location. Another solution is to use location information extracted from user queries to determine geolocation information. For example, if an IP address is frequently used to search for queries such as "Seattle weather," "Seattle restaurants," or "plumbers near Seattle," it can be assumed that the IP address is geolocated in Seattle. Or, if a group of users with consecutive IP addresses frequently searches for items in Denver, it can be assumed that the IP address queue is located in Denver. However, this method is useless for most IP addresses because there is insufficient data (e.g., search history with location information) and / or the IP address is not part of a queue.

[0006] Another method for determining the geolocation of an IP address is to consult an IP geolocation database. These databases contain ranges of IP addresses mapped to corresponding physical location information. Physical location information can be in the form of geographic coordinates for a specific location or sets of coordinates defining a geographic area (e.g., minimum and maximum longitude coordinates and minimum and maximum latitude coordinates). The granularity of geolocation databases varies from large regions (such as districts or cities) to very specific locations (such as streets). The physical location information in IP geolocation databases comes from various sources that report this information, such as IANA, Internet Service Providers (ISPs), and various national and local Internet Registries. However, traditional IP geolocation databases often contain inaccurate and incomplete location information. Furthermore, geolocation information is unavailable for many IP addresses.

[0007] It is with regard to these and other overall considerations that various aspects of this technology have been addressed. Moreover, although relatively specific problems have been discussed, it should be understood that the aspects of the technology presented should not be limited to solving the specific problems identified in the background art. Summary of the Invention

[0008] This disclosure generally relates to systems and methods for determining the accurate geolocation of networks (e.g., IP addresses) for which geolocation information is unknown. Various techniques are described for determining the physical location of a network by tracking user movement across different networks, and more specifically by tracking user movement from networks with known geolocations to networks with unknown geolocations. Aspects of these techniques utilize time and network address information (e.g., IP addresses) from user queries and combine this information with known geolocation information to create new, high-quality geolocation maps for networks with unknown geolocations.

[0009] As used in this article, a “network” is an IP address or range of IP addresses associated with a specific device or group of devices. Many devices can connect to a public network from the same IP address, thus creating a given network of devices, which are typically associated with a given physical location. For example, a business LAN is a network with a range of IP addresses associated with specific devices. A “known network” is a network with high-quality (e.g., relatively accurate) geolocation information associated with it. In other words, it is an IP address (or range) whose physical location is known. An “unseen network” is a network whose physical location is unknown because there is no accurate information mapping its IP addresses to physical locations, or because there is no geolocation information at all.

[0010] In embodiments of the invention, the system learns user transitions over time, where each transition is for a specific user moving between known and unseen networks. The specific user is identified by an identifier such as a client ID. User transition information is combined with geolocation information for known networks to predict geolocation for unseen networks.

[0011] The weighted average prediction algorithm can be used to predict geolocation information for unseen networks. Geolocation information for each known network with a transformation to the unseen network is weighted by the count of the transformations to the unseen network, and then the weighted geolocation information is averaged to create a weighted average geolocation prediction for the unseen network.

[0012] Extreme value prediction algorithms can be used alone or in combination with weighted average prediction algorithms to predict geolocation information for unseen networks. Geographic coordinates for each known network with a transformation to the unseen network are compared to accurately calculate the extreme coordinates for all of these known networks. For example, minimum and maximum latitude coordinates and minimum and maximum longitude coordinates are identified to create geolocation polygons that include extreme geolocation predictions for unseen networks.

[0013] In one embodiment of the invention, a weighted average geolocation prediction is compared with an extreme value geolocation prediction to determine a ratio between the two. If the ratio is too large, the geolocation prediction is determined to be inaccurate. If the ratio is less than a predetermined amount, the prediction is considered an accurate determination of the geolocation of the unseen network. In some aspects, the state of such a network can become known from unseen, and its determined geolocation information can be stored for future use in mapping additional unseen networks.

[0014] It should be understood that this "Summary" is provided to introduce some concepts that will be further described in the following "Detailed Description" section. This "Summary" is not intended to identify key or essential features of the claimed subject matter. Attached Figure Description

[0015] Figure 1 The diagram illustrates a networked computing environment used to determine the geolocation of IP addresses.

[0016] Figure 2 Describing the target Figure 1 The geographic location information of the known networks A, B, C, and D is shown.

[0017] Figure 3 The illustration depicts a process for learning user transitions over time according to an embodiment of the present invention.

[0018] Figure 4 The illustration shows a process for creating a request log according to an embodiment of the present invention.

[0019] Figure 5 A request log is described according to an embodiment of the present invention.

[0020] Figure 6 The illustration shows a process for creating a user conversion log according to an embodiment of the present invention.

[0021] Figure 7 A sorted request log is depicted according to an embodiment of the present invention.

[0022] Figure 8 A user conversion log is described according to an embodiment of the present invention.

[0023] Figure 9 The illustration depicts a process for determining a weighted average geolocation prediction for an unseen network according to an embodiment of the present invention.

[0024] Figure 10 A weighted average geolocation prediction for unseen networks is described according to an embodiment of the present invention.

[0025] Figure 11The illustration depicts a process for determining extreme geolocation predictions for unseen networks according to an embodiment of the present invention.

[0026] Figure 12 The illustration shows extreme geolocation prediction for unseen networks according to an embodiment of the present invention.

[0027] Figure 13 The diagram illustrates a networked computing environment and server computer used to determine the geolocation of IP addresses.

[0028] Figure 14 An exemplary tablet computing device is illustrated that can perform one or more aspects disclosed herein.

[0029] Figure 15A and Figure 15B The illustration shows mobile computing devices, such as mobile phones, smartphones, personal digital assistants, tablet computers, laptop computers, etc., from which examples of the present invention can be practiced.

[0030] Figure 16 It is a simplified block diagram of a distributed computing system that can implement the various aspects of this disclosure. Detailed Implementation

[0031] This disclosure will now describe exemplary embodiments in detail with reference to the accompanying drawings, in which exemplary embodiments are illustrated. However, other aspects may be implemented in many different forms, and the inclusion of specific embodiments in this disclosure should not be construed as limiting such aspects to the embodiments set forth herein. Rather, the embodiments depicted in the drawings are included to provide a thorough and complete disclosure that fully communicates the intended scope to those skilled in the art. When referring to the drawings, the same structures and elements shown throughout are indicated by the same reference numerals. Objects depicted in the figures that are covered by another object, along with their reference notes, are shown using dashed lines. Optional steps or modules are also shown using dashed lines.

[0032] This document discloses systems and methods for obtaining accurate geolocation information for IP addresses. A method for collecting information about user queries independent of user location knowledge is also disclosed, allowing for the determination of user movement across IP addresses. The invention uses knowledge about the IP address from which a user sends a query, combined with geolocation information (e.g., GPS and reverse IP mappings), to build a database of information about user movement over time. The invention also combines this information with current reverse IP mappings to identify and determine geolocations for networks for which their geolocation information is unknown. By creating these mappings, users can still be served with accurate location information when they query the system but do not provide their own location data, allowing for improved search results, targeted services, and advertising.

[0033] Various techniques are described for determining the physical location of IP addresses by tracking user movement across different IP addresses, and more specifically by tracking user movement from IP addresses with known geolocations to IP addresses with unknown geolocations. Aspects of these techniques include using time-based and IP-based information from user queries, along with known geolocation information, to create new, high-quality geolocation maps.

[0034] Figure 1 The illustration shows a logical representation of a network environment 100, in which users are provided with access to one or more public communication networks 140, such as the Internet. Although only one public network is shown, network 140 may include multiple connected networks.

[0035] Network environment 100 also includes other networks, such as network A 160, network B 162, network C 164, network D 166, and network E 168, that allow client devices to access public network 140 and network server 150. As used herein, a “network” is an IP address or range of IP addresses associated with a particular device or group of devices. Many users can connect to a public network from the same IP address and thus create a given user network, which is typically associated with a given physical location. For example, a LAN used by a physical enterprise, such as network D 166, is a network with a range of IP addresses associated with a particular user. A “known network” is a network with high-quality (e.g., relatively accurate) geolocation information associated with it. In other words, it is an IP address (or range) whose physical location is known. An “unseen network” is a network whose physical location is unknown because there is no accurate information mapping its IP address to a physical location, or because there is no geolocation information at all.

[0036] like Figure 2 As shown, networks A, B, C, and D are known networks whose geolocation information is known. For example, network A 202 has a geolocation boundary defined by a polygon with four corners having geographic coordinates:

[0037]

[0038] Network B 212 has a geolocation boundary defined by a polygon with four corners having geographic coordinates:

[0039]

[0040] Network C 222 has a geolocation boundary defined by a polygon with four corners having geographic coordinates:

[0041]

[0042] Network D 232 is a building with a geographic location defined by a single set of coordinates:

[0043]

[0044] Network E is an unseen network with unknown geographic location information.

[0045] return Figure 1 Network environment 100 is not limited to any particular implementation, but rather to any computing environment that enables user devices to connect to a public network using IP addresses. A “user” is anyone who uses a computing device to access one or more public communication networks. For example, user 101 uses client device 102 to connect to public network 140 via a LAN such as network B 162. Client device 102 can be implemented as any device capable of connecting to a public network using an IP address, such as smartphones, tablets, portable computers (e.g., laptops), desktop computers, wearable devices, etc., as an example and not a limitation. The following... Figure 14 , 15A One example of various different examples of client device 102 shown and described in 15B. As shown by dashed line 113, client device 102 and / or LAN 162 can be protected from public network 140 by a firewall.

[0046] A client device, such as client 102, includes various functions that enable the execution of various activities and tasks. For example, client device 102 includes an operating system 104 and an application 106. Typically, operating system 104 represents the functionality used to abstract various system components of client device 102, such as hardware, kernel-level modules, and services. For example, operating system 104 can abstract various components of client device 102 into application 106 to enable interaction between components and application 106.

[0047] Application 106 represents a function that enables various tasks and activities to be performed via client device 102, such as word processing, web browsing, email, social media, enterprise tasks, etc. For example, application 106 includes a browser 112 that allows client 102 to connect to public network 140 (such as the Internet) and web server 150, and a weather application 124 that also allows client 102 to connect to public network 140 and web server 150. Application 106 can be locally installed on client device 102 to execute via a local runtime environment, and / or can represent a portal to remote functions, such as cloud-based services, web applications, etc. Therefore, application 106 can take various forms, such as locally executed code, a portal to a remotely hosted service, etc.

[0048] Network environment 100 includes many other client devices, such as client 122 and client 132. While client 122 is shown as a mobile phone and client 132 as a mobile computer, the client devices can be any device capable of connecting to a public network using an IP address. In one embodiment, client 122 connects to public network 140 via cell tower 117 and network A160, and client 132 connects to public network 140 via wireless access point 119 connected to network B162. However, clients can connect to public networks in any suitable manner. Furthermore, although clients are shown connected via a specific network (e.g., client 132 connects to the Internet via network B162), clients can move their physical location and / or change their logical connections and connect to public network 140 via any number of networks.

[0049] One or more web servers 150 are also connected to the public network 140 and communicate with client devices such as clients 102, 122, and 132. Although only one web server 150 is shown, according to one embodiment of the invention, more than one server computer or a single server, such as a server cluster, may be used. System 100 also includes a back-end computer system 154, which can provide search engine services or other web-based services. For example, the back-end system may include one or more servers 152 and one or more databases 156 for storing information according to the invention. The following... Figure 13 The image shows and describes one of the various examples of servers 150 and 152.

[0050] According to embodiments of this application, user 101 can use one or more applications 106 to send requests for information or resources to web server 150 via networks such as network B 162 and public network 140. Web server 150 receives and responds to the requests and provides the requested information or resources. For example, user 101 can use a web browser 112 on client 102 to send a search query to web server 150 via public network 140 (the Internet). Web server 150 will receive the user's search query and, in response to the query, deliver the search results back to the user.

[0051] When a user enters a search query, their query is tagged with a client identifier, such as client ID 110, which may be stored on client device 102 as a logging cookie 108. Client ID 110 may be associated with a specific person and used for queries made by that person on different client devices. For example, client ID 110 may be associated with login credentials for a specific service, such as a Microsoft user ID. Thereafter, each time the user makes a request over the Internet while logged into the service, that client ID will be used. In another embodiment, the client ID may be a randomly generated tag that is associated with a specific client device or a specific application on a specific client device. For example, user 101's mobile phone may have one client ID, and her laptop computer may have another client ID. As another example, the client ID may be associated with a specific application on client 102. Browser 112 may have a different client ID associated with weather application 124. In any case, other queries from the same user and / or computing device and / or application use the same client ID 110 to associate these queries with the same user 101 and / or device 102.

[0052] Learning user conversion over time

[0053] Figures 3 to 8 The illustration depicts a process for learning user transitions over time according to an embodiment of the present invention. A "user transition" occurs when a particular user or client device changes the IP address used to send requests over a public network. A request can be any type of message sent using an IP address over one or more public networks. A search query is an example of such a request. User transitions can be detected by comparing the IP addresses used to send each request in a consecutive request pair. If the IP addresses are different, a user transition has occurred.

[0054] The first step in this process is to identify and aggregate user transitions. Using the user query log, each uniquely identified user query is aggregated with all its queries within a given time span. The process then iterates through each user query, using its associated timestamp to find the most recent consecutive query pairs (before and after) from different IP addresses. The output of this step is a dataset of all user transitions that occurred within the given time range. At this point, each data point includes the previous IP address, the next IP address, and the time elapsed between the two queries.

[0055] Figure 3 The document shows how to collect information about user 101 ( Figure 1 ) and / or client device 102 ( Figure 1An embodiment of user-transformed information over time is shown as arrow 300. At step 302, the client device receives a search query 308 or other request from user 101. The request can be made in any application 106 on client 102, such as browser application 112 or weather application 124. For example, user 101 may have already used browser application 112 on client 102 to access a search engine webpage via web server 150. As mentioned above, client 102 needs an IP address to send information, such as a search request, over the Internet. Typically, the IP address used by the client device is not static and changes over time. At step 304, client 102 uses IP address A (e.g., as shown in the image). Figure 1 and 2 Network A (160) shown accesses the Internet. If client 102 does not currently have client ID 110, a client ID is randomly generated and stored as an information logger.

[0056] At step 312, client 102 sends a search request to web server 150, and query 308, associated with user 101 and / or client 102 (in combination). Figure 1 (Discussed) Client ID 110 and IP address A associated with the access point used to send search request 312 to network server 150. The search request also includes a timestamp 312 indicating when the search request was sent. At step 316, network server 150 receives the search request and uses... Figure 4 The process log request is shown. At step 318, the web server processes the query to retrieve search results 320 in response to query 308. At step 328, the web server 150 sends the search results back to client 102.

[0057] At a later time point 309, client 102 receives query 311 and uses IP address A (e.g., Figure 1 and 2 Network A (160) sent search request 322. Although Figure 3 Not shown, but search request 322 also includes client ID 110 for user 101 and / or client 102, IP address A, and a timestamp indicating when request 322 was sent. Server 150 records the request at step 324, processes the query at step 326, and sends the search results back to client 102 at step 328.

[0058] At a later time point 300, client 102 receives search query 330. Client 102 uses IP address E 332 (e.g., Figure 1Network E 168 in the network sends search request 334 over the Internet. There are many reasons why client 102 might be sending search request 334 using an IP address different from the IP addresses used to send search requests 322 and 312. For example, user 101 and / or client 102 may have moved physically. Or, user 101 may be using a different client device (such as client 122 or client 132) to send search request 334. Or, client 102 may have been disconnected from the Internet or assigned a different IP address when sending search request 334. Although in Figure 3 Not shown, but search request 334 also includes a client ID for user 101 and / or client 102, an IP address E 332 associated with the access point used to send search request 334 over the public network, and a timestamp indicating when request 334 was sent. Server 150 at step 336 (as in conjunction with...) Figure 4 (More detailed description) Record request, process query at step 338, and send search results back to client 102 at step 340.

[0059] At a later time point 300, client 102 receives search query 342. At this time, client 102 uses IP address C344 (e.g., Figure 1 and Figure 2 Network C 164 in the network is connected to the Internet. Client 102 uses IP address C 344 to send a search request 348 with query 342 over the Internet. Although in Figure 3 Not shown, but search request 348 also includes client ID 110 for user 101 and / or client 102, IP address C, and a timestamp for request 348. Server 150 at step 350 (as in conjunction with...) Figure 4 (More detailed description) Record request, process query at step 356, and send search results back to client 102 at step 358.

[0060] At a later time point 300, client 102 receives search query 360. At this time, client 102 connects to the Internet using IP address E362. Client 102 then sends a search request 364 with query 360 over the Internet using IP address E362. Although in Figure 3 Not shown, but search request 364 also includes client ID 110 for user 101 and / or client 102, IP address E 362, and a timestamp for request 364. Server 150 at step 366 (as in conjunction with...) Figure 4 (More detailed description) Record request, process query at step 368, and send search results back to client 102 at step 370.

[0061] Figure 4 The diagram illustrates the use of logging requests (such as...) Figure 3 Record requests 316, 324, 336, 350, and 366 in the request log to create a request log (see [link to request log]). Figure 5 This is used to track user conversion processes over time. At step 402, a request, such as a search request, is received from the client. This request can be made on web server 150 or a backend server (such as...). Figure 1 The request is received at server 152 or any other computing device. At step 404, the server parses the request to retrieve the client ID, IP address, and timestamp. Next, at step 408, it logs this data in the search request log, such as... Figure 5 The request log shown is 500.

[0062] Figure 5 A request log according to an embodiment of the present invention is illustrated. Log 500 includes three fields: a client ID field 502 indicating which client sent the request; an IP address field 504 indicating which IP address the request originated from; and a timestamp field 506 indicating the time the request was sent. For example, the second request 508 recorded in log 500 corresponds to search request 312 sent from client 102 to web server 150 from IP address A at 10:10:00. Figure 3 The fourth request 510 recorded in log 500 corresponds to search request 322 sent from client 102 to web server 150 at IP address A at 11:15:00. Figure 3 The fifth request 512 recorded in log 500 corresponds to search request 334 sent from client 102 to web server 150 at IP address E at 11:16:00. Figure 3 ). Request 514, recorded in log 500, corresponds to search request 348 sent from client 102 to web server 150 at IP address C at 13:18:00. Figure 3 ). Request 516, recorded in log 500, corresponds to search request 364 sent from client 102 to web server 150 at IP address A at 15:40:00. Figure 3Request log 500 is not limited to any particular implementation or format, but rather embodies any type of log that allows recording information that enables the association of requests and queries with specific users, making it possible to track user transitions from one network to another over time. Therefore, for example, while request log 500 shows three columns of information, the request log can include additional columns and can be organized in different orders or formats. Furthermore, while request log 500 includes entries for three different client IDs, the log can have more or fewer client IDs. Request logs can be stored in, for example, Figure 1 The database 156 in the database, or stored elsewhere or in any other format.

[0063] Figure 6 The diagram illustrates the process of transforming information from request logs, such as request log 500, into... Figure 8 The process shown is the transition log 800. The purpose of this transition log is to identify user transitions from known networks to unseen networks and vice versa, which will allow for the determination of geolocation information for unseen networks in the next section.

[0064] At step 602, the request log (such as log 500) is retrieved. In one embodiment, the log is retrieved periodically, such as every 24 hours. At step 604, requests from the log are aggregated for each specific client ID. For example, the log can be sorted by client ID so that all requests for a specific ID are grouped together. At step 606, any duplicate entries are removed. Duplicate entries should have at least the same client ID, IP address, and timestamp. At step 608, all requests for each client ID are sorted by timestamp to create a new log in chronological order, such as... Figure 7 The log number shown is 700.

[0065] exist Figure 7 In this process, all requests from request log 500 for client 102 are aggregated into group 708. All requests from request log 500 for client 122 are aggregated into group 710. All requests from request log 500 for client 132 are aggregated into group 712. Furthermore, all requests in each group are ordered chronologically. Thus, for example, five requests for client 102 (identified by a single client ID for client 102 and / or user 101) are organized such that the earliest request 714 (which corresponds to...) is listed first in group 708. Figure 3 Search request 312). The next consecutive request in time for the client ID of client 102 is request 716, which corresponds to the request from... Figure 3Search request 322 is listed below request 714. The next consecutive request in time for client ID 102 is request 718, which corresponds to the request from... Figure 3 Search request 334 is listed below request 716. The next consecutive request in time for client ID 102 is request 720, which corresponds to the request from... Figure 3 Search request 348 is listed below request 718. Furthermore, the next (and last) consecutive request for client ID 102 is request 722, which corresponds to the request from... Figure 3 The search request 364 was listed under request 720.

[0066] return Figure 6 In step 610, the earliest consecutive request pair for a specific client ID is identified. The earliest request pair for client 102 is from... Figure 7 Requests 714 and 716 are copied below:

[0067] Client ID IP address Timestamp 102 A 11.00.00 102 A 11.15.00

[0068] At step 612, the system determines whether each request in the request pair originates from the same network (e.g., IP address). When the request pair originates from the same IP address, no user translation as defined herein exists and this data is ignored. In this example, requests 714 and 716 both originate from IP address A ("Yes" at 612), so the process moves to step 622, where the system looks for the next consecutive request pair. If another pair exists ("Yes" at 622), the system moves to step 624.

[0069] At step 624, from Figure 7 The next consecutive request pair following log 700 are requests 716 and 718, as shown below.

[0070] Client ID IP address Timestamp 102 A 11.15.00 102 E 11.16.00

[0071] At step 612, the system determines whether each of these requests originates from the same IP address. They do not ("No" at step 612), so the process moves to step 614 to determine whether both requests originate from a known network. When both requests originate from a known network, the user conversion does provide any useful information about the geolocation of the unseen network, and therefore this information is ignored. (See above reference...) Figure 1 and 2The networks A, B, C, and D discussed are known networks because the system has accurate geolocation information for these networks. Network E is not a known network. In this example, the request pair does not all originate from a known network ("No" at 614), so the process proceeds to step 616. Here, the system determines whether both requests originate from an unseen network; if so, it is not useful for determining the geolocation of the unseen network. These specific requests do not all originate from an unseen network ("No" at step 616), so the process proceeds to step 618, where the elapsed time between requests 716 and 718 is calculated. At step 620, the consecutive request pair 716 and 718 is added to the user conversion log.

[0072] Figure 8 A user conversion log 800 according to an embodiment of the present invention is shown. Log 800 includes client IDs 810, known IP addresses 812, unknown IP addresses 814, and (in...) for consecutive request pairs. Figure 6 The field related to the elapsed time between request pairs (calculated at position 618) is used. For example, the first entry in log 800 corresponds to... Figure 7 Requests 716 and 718, where the client ID comes from client 102, the known IP address from the translation is IP address A, the unseen IP address from the translation is IP address E, and the time elapsed between these requests is 1 minute.

[0073] return Figure 6 The process moves from step 620 to step 622, where the system searches for the next consecutive request pair. If another pair exists ("Yes" at 622), the system moves to step 624. At step 624, from Figure 7 The next consecutive request pair after log 700 is requests 718 and 720, as shown below.

[0074] Client ID IP address Timestamp 102 E 11.16.00 102 C 13.18.00

[0075] These requests will be logged in the user conversion log because they originate from different IP addresses ("No" at 612) and from a known IP address C and an unseen IP address E ("No" at 614 and 616). The same applies to the last two request pairs, 720 and 722, so they will also be logged at step 620.

[0076] When the method proceeds to step 622 after recording the last request for client 102, the system will determine that there is no other set of consecutive requests for client 102 ("No" at 622) and the method will proceed to step 626 to determine if there is another set of requests for a different client ID. If yes ("Yes" at 626), the method returns to step 610 to begin work regarding the next specific client ID. In this example, the next client ID is for client 122, and is determined by... Figure 7 Group 710 is shown in the diagram. All requests in group 710 will be logged in the user conversion log, except for consecutive request pairs 724 and 726, because these two requests originate from the same IP address ("No" at step 612).

[0077] Similarly, all request pairs in group 712 for client 132 will be logged, except for requests 728 and 730, since these requests originate from an unseen network ("No" at step 616). When there are no requests for any other client ("No" at 626), the user conversion log is complete and the process ends.

[0078] Predicting geolocation for unseen networks

[0079] Figures 9 to 12 The illustration depicts a process according to an embodiment of the invention for accurately predicting and determining the geolocation of unseen networks using user transitions learned from the previous section and other information such as geolocation information for known networks. More specifically, the output of the previous section provides a large dataset of all user transitions over time from known networks to unseen networks. This dataset is combined with a reverse IP mapping to predict the geolocation of unseen networks. The reverse IP mapping includes the IP addresses of known networks associated with the geographic coordinates of multiple points forming a polygon (e.g., ...). Figure 2 As shown and as described above, the polygon defines the geographical area covered by these points.

[0080] In one embodiment of the invention, a weighted prediction algorithm is used to determine the geolocation of an unseen network. The algorithm determines a weighted average of the coordinates of each corresponding point (e.g., a corner) of the geolocation polygon for each known network fed into the unseen network. The coordinates of the corresponding point for each known network are weighted by a transformation count from that known network to the unseen network to give a weighted average set of coordinates for each corresponding point of the unseen network. Thus, for example, if each geolocation polygon of the known network is a square, then four corners (e.g., points) will be averaged, and these four corners will be referred to as corner 1 (NW), corner 2 (NE), corner 3 (SW), and corner 4 (SE). For each corner, there will be two coordinates: longitude and latitude. Therefore, the weighted average prediction algorithm will provide eight data points for the geolocation of the unseen network, including:

[0081] • Angle 1 (NW: longitude, latitude);

[0082] • Angular 2 (NE: longitude, latitude);

[0083] • SW (longitude, latitude); and

[0084] •Angle 4 (SE: longitude, latitude).

[0085] Figure 9 The illustration depicts an embodiment for predicting geolocation information for unseen networks using a weighted prediction algorithm 900. At step 902, the system determines which known networks have user transfers to the unseen network in question. For example, from... Figure 8 User conversion log 800 shows that there are 4 known networks with at least one conversion to the unseen network E.

[0086] At step 904, the conversion count from each known network to an unseen network is determined. For example, the output of step 904 for user conversion log 800 is shown below:

[0087] Known IP address No IP address found Number of conversions A E 1 B E 3 C E 2 D E 2

[0088] Next, at step 906, a weighted average of the longitude coordinates for the first angle of the known network is calculated. In one embodiment, the formula for calculating the weighted average prediction of the longitude of angle 1 for network E using user transitions from log 800 is as follows, where T is the transition count, C1 is the NW angle of each known network, and "Long" is the longitude coordinate:

[0089]

[0090] At step 908, the same formula is used to determine the weighted average latitude coordinates, except that "Lat" refers to the latitude coordinates for angle 1:

[0091]

[0092] Use for example Figure 2 The coordinates of angle 1 shown and the transformation count from log 800 are for network E=E C1 The weighted average prediction of angle 1(NW) for (Lat) is:

[0093]

[0094] At step 910, the weighted average coordinates of the corner 1 (e.g., NW corner) of the geolocation polygon for network E are set to be equal to the sum of the formulas determined in steps 908 and 910, as follows:

[0095]

[0096] The process proceeds to step 912, where a weighted average longitude coordinate is determined for a second (e.g., NE) angle of the known network. At step 914, a weighted average latitude coordinate is determined for the second (e.g., NE) angle of the known network. At step 916, the weighted average coordinates of angle 2 of the geolocation polygon for network E are set to be equal to the sum determined in steps 912 and 914, as follows:

[0097]

[0098] The process proceeds to step 918, where a weighted average longitude coordinate is determined for the third (e.g., SW) angle of the known network. At step 920, a weighted average latitude coordinate is determined for the third (e.g., SW) angle of the known network. At step 922, the weighted average coordinates of angle 3 of the geolocation polygon for network E are set to be equal to the sum determined in steps 918 and 920, as follows:

[0099]

[0100] The process proceeds to step 924, where a weighted average longitude coordinate is determined for the fourth (e.g., SE) angle of the known network. At step 926, a weighted average latitude coordinate is determined for the fourth angle of the known network. At step 924, the weighted average coordinates of angle 4 of the geolocation polygon for network E are set to be equal to the sum determined in steps 924 and 926, as follows:

[0101]

[0102] Figure 10 It shows the use of Figure 9The weighted average prediction algorithm described herein yields the geolocation polygons for network E 1002. Points 1 1004, 2 1006, 3 1008, and 4 1010 are determined according to... Figure 9 The weighted average prediction described in the text is used to create polygon 1012 (dashed line) that defines the geolocation prediction for network E.

[0103] In one embodiment of the invention, an extreme value prediction algorithm is used to determine the geographic location of unseen networks. The algorithm identifies the most extreme point in any given direction for combinations of known networks fed into the unseen network in question to create a new set of points that describe polygons that fully contain all points of the participating known networks.

[0104] Figure 11 The illustration depicts an embodiment using an extreme value prediction algorithm 1100 to predict geolocation information for unseen networks. At step 1102, the system determines which known networks have user transfers to the unseen network in question. For example, from... Figure 8 User conversion log 800 shows that there are 4 known networks (A, B, C, and D) with at least one conversion to the unseen network E.

[0105] At step 1104, the system retrieves the coordinates of each point of the geolocation polygon for each known network (i.e., those known networks identified in step 1102) with a transformation to an unseen network. At steps 1106 and 1108, the minimum and maximum latitude coordinates are identified. At steps 1110 and 1112, the minimum and maximum longitude coordinates are identified. For example, for known networks A, B, C, and D, the following includes the coordinates retrieved at step 1104. The latitude coordinates in bold are the minimum and maximum coordinates identified in steps 1106 and 1108.

[0106] The bold longitude coordinates are the minimum and maximum coordinates identified in steps 1110 and 1112.

[0107]

[0108] In step 1116, four points are set for extreme value geolocation prediction, wherein the first point includes the maximum latitude coordinate and the minimum longitude coordinate, the second point includes the maximum latitude coordinate and the maximum longitude coordinate, the third point includes the minimum latitude coordinate and the minimum longitude coordinate, and the fourth point includes the minimum latitude coordinate and the maximum longitude coordinate.

[0109] Figure 12 It shows the use of Figure 11The extreme value prediction algorithm described herein yields a geolocation polygon 1212 for network E 1202. More specifically, points 1 1204, 2 1206, 3 1208, and 4 1210 are based on... Figure 9 The weighted average prediction described in the text is used to create polygon 1212 (dashed line) that defines the geolocation prediction for network E.

[0110] In another embodiment of the invention, the accuracy of the aforementioned geolocation prediction can be tested, and geolocation can be determined by comparing a weighted average prediction with an extreme value prediction. If the ratio of the two is too high (e.g., above a predetermined threshold or a maximum allowed ratio), the weighted predicted geolocation information can be rejected. If the ratio is acceptable (i.e., less than or equal to the threshold), the weighted average prediction can be used to determine geolocation information for unseen networks. In one embodiment, each prediction (A) is calculated as a weighted average (A... W ) and extreme values ​​(A) e The area of ​​prediction (A) is a function of longitude and latitude coordinates, which is transformed to calculate the curvature of the Earth. Therefore, A = Fn(Lat, Long, Lat1, Long2). * , where * is the approximate geometric transformation used to calculate the curvature of the Earth. This ratio is calculated as follows:

[0111]

[0112] If the ratio exceeds a maximum number, such as 4, the extreme value weighted prediction is rejected. If the ratio is less than the maximum number, the weighted average prediction can be used as the final determination of geolocation. In another embodiment, the lower the ratio, the higher the confidence level of the weighted average prediction may be.

[0113] As shown in the figure, system 1300 may include one or more client computing devices 1306 and 1308 (e.g., from...). Figure 1 The client computing devices 102, 122, and 132 run applications and can send requests over a network as described herein. In some examples, the client application can execute locally on the client computing device. In other examples, the client application (e.g., a mobile app on thin client computing devices 1304, 1306) can communicate (e.g., via network 1310) with a corresponding server version of the application running on one or more server computing devices (e.g., server computing device 1308). In other aspects, the one or more client computing devices are not client versions of the application, but applications implemented on server computing device 1308 or (e.g., in a distributed computing environment such as a cloud computing environment) multiple server computing devices that can be remotely accessed via network 106, for example via a browser.

[0114] like Figure 13 As shown, the reverse IP prediction application 1311 is implemented by server computing device 1308. It should be understood that a server version of the reverse IP prediction application 1311 can also be implemented in a distributed environment (e.g., a cloud computing environment) spanning multiple server computing devices (not shown). Furthermore, it should be understood that a client or server version of the reverse IP prediction application 1311 may be able to determine the geolocation of unseen networks. While server versions of the reverse IP prediction application 1311 and associated components 1312-1320 are shown and described, this should not be construed as limiting. Rather, a client version of the reverse IP prediction application 1310 can similarly implement components 1312-1320 on client computing devices 1302, 1304.

[0115] In the basic configuration, one or more client computing devices 1302 and 1304 are personal or handheld computers having input and output elements operated by one or more users 1302, 1304. For example, one or more client computing devices 1306, 1308 may include one or more of the following: mobile phones; smartphones; tablet computers; tablet phones; smartwatches; wearable computers; personal computers; desktop computers; laptop computers; gaming devices / computers (e.g., [missing information]). (); television, etc. This list is merely illustrative and should not be considered a limitation. Any suitable client computing device can be used to perform the client-side reverse IP prediction application and / or remotely access the reverse IP prediction application 1311.

[0116] In some respects, network 1306 is a computer network such as the Internet. In this respect, network 1306 may include a local area network (LAN), a wide area network (WAN), the Internet, and wireless and wired transmission media. In other respects, server computing device 1308 may communicate with some components of the system via a local network (e.g., an enterprise intranet), while server computing device 1308 may communicate with other components of the system via a wide area network (e.g., the Internet). Furthermore, the aspects and functions described herein can operate on a distributed system (e.g., a cloud computing system), where application functions, memory, data storage and retrieval, and various processing functions can operate remotely to each other via a distributed computing network such as the Internet or an intranet.

[0117] As described above, the reverse IP prediction application 1311 can be implemented on server computing device 1308. In a basic configuration, server computing device 1308 may include at least a processing unit for executing computer-readable instructions and system memory. In some aspects, server computing device 1308 may include one or more server computing devices 1308 in a distributed environment (e.g., a cloud computing environment). Server computing device 1308 can create reverse IP mapping objects for sharing via network 1310 between one or more client computing devices 1304 and / or one or more other server computing devices (e.g., server computing devices 1324A and / or 1324B).

[0118] like Figure 13 As shown, the reverse IP prediction application 1311 may include various components for determining geolocation for unseen networks, including a request logging component 1312, a communication component 1314, a conversion component 1316, a prediction component 1318, a mapping component 1320, etc. In each respect, each component can transfer and pass data between other components. The various components can be implemented using hardware, software, or a combination of hardware and software. Furthermore, the various components can execute on a single server computing device (e.g., server computing device 1308), on multiple server computing devices (e.g., server computing devices 1324A, 1324B, and / or 1334), or locally on client computing devices (e.g., client computing devices 1304, 1306).

[0119] The reverse IP prediction application 1310 can be configured to use the methods described above to determine the geolocation of unseen networks.

[0120] Communication component 1314 can receive one or more requests from client devices 1304 and 1306. In various aspects, communication component 1314 can receive requests from client devices, such as... Figure 3 The examples shown are search requests 312, 322, 334, 348, and 364 from client 102. In one embodiment, communication component 1314 can detect that a request contains information related to a mapping network based on analysis of information contained in the request. For example, communication component 1314 can identify that the request contains a client identifier, IP address, and timestamp. Communication component 1314 can parse the request to retrieve the client identifier, IP address, and timestamp, and forward this information to request logging component 1312. It should be understood that communication component 1314 can receive one or more requests in any suitable manner. The above embodiments are provided for illustrative purposes and should not be considered limiting.

[0121] In embodiments of the present invention, the request log component 1312 collects and stores logs for specific users, as described above. Figure 3-5 The information described above is useful for learning user transitions over time when moving between known and unseen networks. The request logging component 1312 can receive information from the request as detailed above, including an identifier for the user or client device or application issuing the request, the IP address used to send the request, and a timestamp indicating when the request was sent. The request logging component 1312 uses this information to create a request log, such as... Figure 5 The request log 500 is shown. However, as detailed above, the request log can be in any format that includes this type of information. The request log component 1312 can store request logs (such as request log 1332) for a given time period in the data storage device 1326.

[0122] As mentioned above Figure 5-8 As detailed herein, conversion component 1316 identifies user conversions for a specific user from a known network to an unknown network, or vice versa. More specifically, conversion component 1316 retrieves request logs, such as request log 1332, from storage device 1326 and transforms the information in the request logs into conversion log 1330 in data storage device 1326. In various ways, conversion component 1316 may aggregate requests for a specific user, sort requests for a specific user by time, identify consecutive request pairs, retrieve information from reverse IP mapping 1328 to determine whether a specific network in the request is known or unknown, and add user conversions to conversion logs, such as conversion logs 800 and 1330.

[0123] Based on the above combination Figure 9-12 In the embodiments of the present invention described above, prediction component 1318 uses user conversions (e.g., conversion logs 1330 from conversion component 1316 and geolocation information for known networks, such as reverse IP mapping 1328) to predict the geolocation of unseen networks.

[0124] In all aspects, such as combining Figure 9 and 10 The prediction component 1318 uses a weighted average algorithm to predict geolocation for unseen networks. For example, the prediction component 1318 uses conversion logs to determine which known networks have user conversions to unseen networks, and further determines how many user conversions occur between the known and unseen networks. The prediction component 1318 can weight the geolocation information for each known network by the conversion counts with the unseen networks. The prediction component 1318 then averages the weighted geolocation information for each participating known network to create a weighted average geolocation prediction for the unseen network.

[0125] In other aspects of the invention, such as in combination Figure 11 and 12 The prediction component 1318 uses an extreme value prediction algorithm, either alone or in combination with a weighted average prediction algorithm, to determine geolocation for unseen networks. The prediction component 1318 can access the geographic coordinates of each participating known network from the reverse IP map 1328 and compare the coordinates to find the extreme coordinates for all of these known networks. For example, the prediction component 1318 can identify minimum and maximum latitude coordinates and minimum and maximum longitude coordinates to create a geolocation polygon that includes extreme geolocation predictions for unseen networks. In one embodiment, the prediction component 1318 stores its geolocation predictions 1340 in a data repository 1326.

[0126] As described above, mapping component 1320 determines whether the geolocation prediction from prediction component 1318 is accurate. In all respects, when mapping component determines that the prediction is accurate, it stores the geolocation information for the unseen network as a reverse IP mapping 1328, and changes the state of the network from unseen to known.

[0127] It should be understood that, regarding Figure 13 The various devices, components, etc., described are not intended to limit the systems and methods to the specific components described. Therefore, additional topology configurations can be used to implement the methods and systems disclosed herein, and / or some of the described components can be excluded without departing from the methods and systems disclosed herein.

[0128] Figures 14 to 16 The associated description provides a discussion of various operating environments in which the aspects of this disclosure can be implemented. However, regarding Figures 14 to 16 The devices and systems shown and discussed are for illustrative purposes only and are not intended to limit the wide range of computing device configurations that may be used to implement the aspects of this disclosure as described herein.

[0129] Figure 14This is a block diagram illustrating the physical components (e.g., hardware) of a computing device 1400 that can implement aspects of the present disclosure. The computing device components described below may have computer-executable instructions for mapping unseen networks on computing devices (e.g., network server 150, server 152, and / or clients 102, 122, and 132), which can be executed to implement the methods disclosed herein. In a basic configuration, computing device 1400 may include at least one processing unit 1402 and system memory 1406. Depending on the configuration and type of computing device, system memory 1406 may include, but is not limited to, volatile memory (e.g., random access memory), non-volatile memory (e.g., read-only memory), flash memory, or any combination of these memories. System memory 1406 may include an operating system 1407 and one or more program modules 1408 suitable for applications 1420 (such as application 1428 (e.g., a browser application)), as well as an I / O manager 1424 and other utilities 1426, particularly for reverse IP prediction applications.

[0130] For example, operating system 1407 may be suitable for controlling the operation of computing device 1400. Furthermore, embodiments of this disclosure may be implemented in conjunction with graphics libraries, other operating systems, or any other applications, and are not limited to any particular application or system. This basic configuration is in Figure 14 The components within the dashed lines 1422 are illustrated in the diagram. The computing device 1400 may have additional features or functions. For example, the computing device 1400 may also include (removable and / or non-removable) additional data storage devices, such as, for example, disks, optical discs, or magnetic tapes. Such additional storage... Figure 14 The diagram is illustrated using a removable storage device 1409 and a non-removable storage device 1410.

[0131] As described above, multiple program modules and data files can be stored in system memory 1406. When executed on processing unit 1402, program module 1406 (e.g., reverse IP prediction application 1311) can perform processes including but not limited to the aspects described herein.

[0132] Furthermore, embodiments of this disclosure can be implemented in circuits including discrete electronic components, packaged or integrated electronic chips containing logic gates, circuits utilizing microprocessors, or single chips containing electronic components or microprocessors. For example, embodiments of this disclosure can be implemented via a system-on-a-chip (SoC), wherein... Figure 14Each or many of the components shown can be integrated onto a single integrated circuit. Such a SoC device may include one or more processing units, graphics units, communication units, system virtualization units, and various application functions, all integrated (or “burned in”) onto a chip substrate as a single integrated circuit. When operating via the SoC, the capabilities described herein regarding the client switching protocol can be operated via application-specific logic integrated with other components of the computing device 1400 on the single integrated circuit (chip). Embodiments of this disclosure can also be implemented using other techniques capable of performing logical operations (such as, for example, AND, OR, and NOT), including but not limited to mechanical, optical, fluid, and quantum technologies. Furthermore, embodiments of this disclosure can be implemented within a general-purpose computer or in any other circuit or system.

[0133] The computing device 1400 may also have one or more input devices 1412, such as a keyboard, mouse, pen, voice or speech input device, touch or swipe input device, etc. Output devices 1414, such as a monitor, speakers, printer(s), etc., may also be included. The above devices are examples and other devices may be used. The computing device 1400 may include one or more communication connections 1416 that allow communication with other computing devices 1418. Examples of suitable communication connections 1416 include, but are not limited to, radio frequency (RF) transmitters, receivers and / or transceiver circuitry; universal serial bus (USB), parallel and / or serial ports.

[0134] The term "computer-readable medium" as used herein can include computer storage media. Computer storage media can include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, or program modules. System memory 1406, removable storage device 1409, and non-removable storage device 1410 are examples of computer storage media (e.g., memory storage). Computer storage media can include RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage devices, magnetic cassettes, magnetic tape, disk storage devices or other magnetic storage devices, or any other article of manufacture that can be used to store information and can be accessed by computing device 1400. Any such computer storage medium may be part of computing device 1400. Computer storage media may be non-transitory media that do not include carrier waves or other propagated or modulated data signals.

[0135] Communication media can be embodied in computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and include any information delivery medium. The term "modulated data signal" can describe a signal having one or more characteristics that are set or altered in a manner that encodes information in the signal. By way of example and not limitation, communication media can include wired media such as wired networks or direct wired connections, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0136] Figure 15A and Figure 15B The illustration depicts a mobile computing device 1500, such as a mobile phone, smartphone, wearable computer (e.g., a smartwatch), tablet computer, laptop computer, etc., from which embodiments of the present disclosure can be practiced. In some aspects, the client may be a mobile computing device. References Figure 15A The illustration shows one aspect of a mobile computing device 1500 for implementing various aspects. In a basic configuration, the mobile computing device 1500 is a handheld computer with input and output elements. The mobile computing device 1500 typically includes a display 1505 and one or more input buttons 1510 that allow users to input information into the mobile computing device 1500. The display 1505 of the mobile computing device 1500 may also function as an input device (e.g., a touchscreen display). If included, an optional side input element 1515 allows additional user input. The side input element 1515 may be a rotary switch, a button, or any other type of manual input element. Alternatively, the mobile computing device 1500 may include more or fewer input elements. For example, in some embodiments, the display 1505 may not be a touchscreen. In yet another alternative embodiment, the mobile computing device 1500 is a portable telephone system, such as a cellular phone. The mobile computing device 1500 may also include an optional keyboard 1535. The optional keyboard 1535 may be a physical keyboard or a “soft” keyboard generated on a touchscreen display. In various embodiments, output elements include a display 1505 for displaying a graphical user interface (GUI), a visual indicator 1520 (e.g., a light-emitting diode), and / or an audio transducer 1525 (e.g., a speaker) for displaying a graphical user interface (GUI). In some aspects, the mobile computing device 1500 includes a vibration transducer for providing haptic feedback to a user. In another aspect, the mobile computing device 1500 includes input and / or output ports for sending signals to or receiving signals from external devices, such as audio inputs (e.g., a microphone jack), audio outputs (e.g., a headphone jack), and video outputs (e.g., an HDMI port).

[0137] Figure 15BThis is a block diagram illustrating one aspect of the architecture of a mobile computing device. That is, the mobile computing device 1500 may include a system (e.g., architecture) 1502 to implement certain aspects. In one embodiment, the system 1502 is implemented as a "smartphone" capable of running one or more applications (e.g., browser, email, calendar, contact manager, messaging client, game, and media client / player). In some aspects, the system 1502 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone.

[0138] One or more applications 1566 may be loaded into memory 1562 and run on or associated with operating system 1564. Examples of applications include telephone dialers, email programs, personal information management (PIM) programs, word processing programs, spreadsheet programs, internet browser programs, messaging programs, etc. System 1502 also includes a non-volatile storage area 1568 within memory 1562. The non-volatile storage area 1568 may be used to store permanent information that should not be lost when system 1502 is powered off. Applications 1566 may use and store information in the non-volatile storage area 1568, such as emails or other messages used by email applications. A synchronization application (not shown) also resides on system 1502 and is programmed to interact with a corresponding synchronization application residing on the host computer to keep the information stored in the non-volatile storage area 1568 synchronized with the corresponding information stored on the host computer. It should be understood that other applications may be loaded into memory 1562 and run on mobile computing device 1500, including instructions for creating and sharing collaborative objects as described herein (e.g., request log components, communication components, transformation components, collaborative object components, permission components, and / or UX components, etc.).

[0139] System 1502 includes a power supply 1570, which can be implemented as one or more batteries. The power supply 1570 may also include an external power source, such as an AC adapter or power docking station for replenishing or recharging batteries. System 1502 may also include a radio interface layer 1572 that performs the functions of transmitting and receiving radio frequency communications. The radio interface layer 1572 facilitates a wireless connection between system 1502 and the "outside world" via a communications operator or service provider. Transmissions to and from the radio interface layer 1572 are conducted under the control of the operating system 1564. In other words, communications received by the radio interface layer 1572 can be propagated to application 1566 via the operating system 1564, and vice versa.

[0140] Visual indicator 1520 can be used to provide visual notification, and / or audio interface 1574 can be used via audio transducer 1525 (e.g., Figure 15A The audio transducer 1525 shown generates audible notifications. In the illustrated embodiment, the visual indicator 1520 is a light-emitting diode (LED), and the audio transducer 1525 can be a speaker. These devices can be directly coupled to the power supply 1570 such that they remain on for a duration indicated by the notification mechanism when activated, even if the processor 1560 and other components may be turned off to conserve battery power. The LED can be programmed to remain on indefinitely until the user takes action to indicate the device's power-on status. The audio interface 1574 is used to provide and receive audible signals from the user. For example, in addition to being coupled to the audio transducer 1525, the audio interface 1574 can also be coupled to a microphone to receive audible input, such as to facilitate telephone conversations. According to embodiments of this disclosure, the microphone can also function as an audio sensor to facilitate control notifications, as described below. The system 1502 may also include a video interface 1576 that enables the operation of a peripheral device 1530 (e.g., a vehicle camera) to record still images, video streams, etc.

[0141] The mobile computing device 1500 implementing system 1502 may have additional features or functions. For example, the mobile computing device 1500 may also include (removable and / or non-removable) additional data storage devices, such as disks, optical discs, or magnetic tapes. Such additional storage devices... Figure 15B The diagram shows a non-volatile storage area 1568.

[0142] As described above, data / information generated or captured by mobile computing device 1500 and stored via system 1502 can be locally stored on mobile computing device 1500, or the data can be stored on any number of storage media that can be accessed by the device via radio interface layer 1572 or via a wired connection between mobile computing device 1500 and a separate computing device associated with mobile computing device 1500 (e.g., a server computer in a distributed computing network such as the Internet). It should be understood that such data / information can be accessed via radio interface layer 1572 or via a distributed computing network through mobile computing device 1500. Similarly, according to known data / information transmission and storage devices, including email and collaborative data / information sharing systems, such data / information can be easily transferred between computing devices for storage and use.

[0143] It should be understood that Figure 15A and Figure 15B This description is intended to illustrate the purpose of the method and system and is not intended to limit this disclosure to a particular sequence of steps or a particular combination of hardware or software components.

[0144] Figure 16The illustration depicts one aspect of the architecture of a system for processing data received from a remote source at a computing system, such as a general-purpose computing device 1604 (e.g., a personal computer), a tablet computing device 1606, or a mobile computing device 1608, as described above. Content displayed at server device 1602 can be stored in different communication channels or other storage types. For example, various documents can be stored using a directory service 1622, a web portal 1624, an email service 1626, an instant messaging repository 1628, or a social networking service 1630. A reverse IP prediction application 1621 can be used by a client communicating with server device 1602, and / or a reverse IP prediction application 1620 can be used by server device 1602. Server device 1602 can provide data to and from client computing devices, such as general-purpose computing device 1604, tablet computing device 1606, and / or mobile computing device 1608 (e.g., a smartphone), via network 1615. References above are also provided as examples. Figures 1 to 11 The described computer system can be implemented in a general-purpose computing device 1604 (e.g., a personal computer), a tablet computing device 1606, and / or a mobile computing device 1608 (e.g., a smartphone). Except for receiving graphics data that can be preprocessed at the graphics origin system or post-processed at the receiving computing system, any embodiment of these computing devices can be obtained from repository 1616.

[0145] It should be understood that Figure 16 This description is intended to illustrate the purpose of the method and system and is not intended to limit this disclosure to a particular sequence of steps or a particular combination of hardware or software components.

[0146] In a first aspect, a system is provided. The system includes a processing unit and a memory storing computer-executable instructions that, when executed by the processing unit, cause the system to perform actions. For example, in response to the computer-executable instructions, the system receives a task list for a project, wherein the task list includes multiple tasks, and creates a collaborative object including the task list. Furthermore, the system associates tasks with documents and receives updates to the documents to complete the tasks. In response to receiving updates to the documents, the system updates the task list to reflect the completion of the tasks and provides controls for performing actions when the task list is completed.

[0147] For example, the foregoing references to block diagrams and / or operational illustrations of methods, systems, and computer program products according to various aspects of this disclosure have described aspects of this disclosure. The functions / actions recorded in the blocks may not occur in the order shown in any flowchart. For example, two blocks shown consecutively may actually be executed substantially simultaneously, or, depending on the functions / actions involved, these blocks may sometimes be executed in reverse order.

[0148] The descriptions and illustrations of one or more aspects provided in this application are not intended to limit or restrict the scope of this disclosure in any way. The aspects, examples, and details provided in this application are considered sufficient to convey ownership and enable others to make and use the claimed disclosure as the best mode. The claimed disclosure should not be construed as limited to any aspect, example, or detail provided in this application. Various features (structural and methodological) are intended to be selectively included or omitted, whether shown and described in combination or separately, to produce embodiments with a particular set of features. Those skilled in the art, having been provided with the descriptions and illustrations of this application, can conceive of variations, modifications, and alternatives falling within the spirit of the broader aspects of the overall inventive concept embodied in this application, without departing from the broader scope of the claimed disclosure.

[0149] Throughout the specification, references to "an example" or "example" have been used, indicating that at least one example includes the specific feature, structure, or property described. Therefore, the use of such a phrase can refer to more than one example. Furthermore, the described features, structures, or properties can be combined in any suitable manner in one or more examples.

[0150] However, those skilled in the art will recognize that these examples can be implemented without one or more specific details, or by utilizing other methods, resources, materials, etc. In other instances, well-known structures, resources, or operations have not been shown or described in detail simply because observations have obscured aspects of the examples.

[0151] While exemplary examples and applications have been shown and described, it should be understood that the examples are not limited to the precise configurations and resources described above. Various modifications, alterations, and variations that will be apparent to those skilled in the art may be made to the arrangement, operation, and details of the methods and systems disclosed herein without departing from the scope of the claimed examples.

Claims

1. A computerized system for determining geolocations of unseen IP addresses, wherein the system comprises: processor; as well as A memory storing computerized instructions, which, when executed by the processor, cause the processor to: Receive at least one request from at least one client computer; Identify at least one user conversion, wherein the at least one user conversion includes a first request from at least one known IP address and a second request from the unseen IP address, wherein geolocation information is known for the at least one known IP address; as well as The geolocation information for the unseen IP address is determined based on the at least one user conversion and the geolocation information for the at least one known IP address. The geolocation information for the unseen IP address includes: Determine the known IP address that has been translated to the unseen IP address; Determine the count of user translations from the known IP address to the unseen IP address; A weighted average geolocation prediction for the unseen IP address is determined based on the count of user transitions from the known IP address to the unseen IP address.

2. The computerized system of claim 1, wherein the at least one request includes a client ID, an IP address, and a timestamp.

3. The computerized system of claim 1, wherein the weighted average geolocation prediction is weighted based on the conversion count from the at least one known IP address to the unseen IP address.

4. The computerized system of claim 1, further comprising computerized instructions stored in the memory, the computerized instructions causing the processor, when executed by the processor, to: Determine an extreme geolocation prediction for the unseen IP address, wherein the extreme geolocation prediction includes at least one pair of geographic coordinates associated with the at least one known IP address.

5. A computerized method for determining the geolocation of unseen networks, comprising: Identify at least one user transition, wherein the at least one user transition is between at least one known network and the unseen network; Based on the identifier converted by the at least one user, collect geolocation information for the at least one known network; as well as The geographic location of the unseen network is predicted based on the at least one user conversion and the geographic location information for the at least one known network. The prediction of the geographic location of the unseen network includes: Identify known networks that have user translations to the unseen networks; Determine the count of user transitions from the known network to the unseen network; A weighted average geolocation prediction for the unseen network is determined based on the count of user transitions from the known network to the unseen network.

6. The computerized method of claim 5, wherein determining the weighted average geolocation prediction comprises: The geolocation information for the first known network is weighted using the count of user transitions between the first known network and the unseen network to create weighted geolocation information for the first known network. The geolocation information for the second known network is weighted using the count of user transitions between the second known network and the unseen network to create weighted geolocation information for the second known network; as well as The weighted geolocation information for the first known network and the weighted geolocation information for the second known network are averaged.

7. The computerized method of claim 6, wherein predicting the geolocation of the unseen network further includes determining extreme geolocation predictions.

8. The computerized method of claim 7, wherein predicting the geolocation of the unseen network further comprises: The ratio is calculated by comparing the weighted average geolocation prediction with the extreme value geolocation prediction. as well as Compare the ratio with the threshold.

9. The computerized method of claim 7, wherein the prediction of the geolocation of the unseen network takes into account the curvature of the Earth.

10. The computerized method of claim 5, wherein predicting the geolocation of the unseen network further comprises: Extreme value geolocation predictions are determined by identifying at least four extreme value coordinates from a coordinate set.

11. The computerized method of claim 10, wherein the at least four extreme coordinates comprise: A first latitude and a first longitude, wherein the first latitude is the maximum value in the coordinate set, and the first longitude is the minimum longitude in the coordinate set; The second latitude and the second longitude, wherein the second latitude is the minimum value in the coordinate set, and the second longitude is the maximum longitude in the coordinate set; The first latitude and the second longitude; as well as The second latitude and the first longitude.

12. The computerized method according to claim 11, further comprising: A polygon is created based on the at least four extreme coordinates, wherein the polygon identifies the geographic location of the unseen network.

13. The computerized method according to claim 5, characterized in that, The unseen network is at least one of the following: an IPv4 address and an IPv6 address.

14. The computerized method of claim 5, wherein the at least one user conversion comprises a pair of consecutive requests, wherein one request in the pair of consecutive requests is from the at least one known network, and the other request in the pair of consecutive requests is from the unseen network.

15. The computerized method of claim 14, wherein the consecutive request pairs are from the same client computer.

16. A computerized method for mapping unseen networks, comprising: Create a request log that includes multiple requests, each of which includes the client ID, network address, and timestamp. The request log is transformed into a transformation log, wherein the transformation log includes multiple user transformations from at least one known network to the unseen network; as well as Based on the conversion log, geolocation information for the unseen network is determined, wherein the user conversion includes a first request from the at least one known network and a second request from the unseen network, wherein the geolocation information is known for the at least one known network. The geographic location information for the unseen network determined based on the conversion log includes: Identify known networks that have user translations to the unseen networks; Determine the count of user transitions from the known network to the unseen network; A weighted average geolocation prediction for the unseen network is determined based on the count of user transitions from the known network to the unseen network.

17. The computerized method of claim 16, wherein transforming the request log into the transformation log further comprises: Retrieve the request log; Aggregate the multiple requests based on the client ID; Remove duplicates from the request log; The multiple requests are sorted according to the timestamps; as well as Record multiple consecutive request pairs, wherein the consecutive request pair includes one request from the at least one known network and another request from the unseen network.

Images