HK1145889A - A method and system for tracking and optimizing advertisements on a decentralized network - Google Patents

Description

Method and system for tracking and optimizing advertisements over a distributed network

Technical Field

The field of the invention relates generally to computer systems, and more particularly to a method and system for tracking and optimizing advertisements on a distributed (decentralized) network.

Background

Peer-to-peer file sharing is a data exchange infrastructure that allows information to be exchanged between computers without the need for a centralized network fabric. Each machine connected to a peer-to-peer network includes a client and a server, both of which are capable of requesting information from, and serving information to, other machines of similar configuration. Such networks are loosely organized without any centralized administrative authority. Which allows any user to attach to the network and share files. It also allows any user to request shared files from other users with similar characteristics.

Currently, advertising is not effective in many modern peer-to-peer networks. In privately developed peer-to-peer networks, advertising is generally limited to companies that pay network owners for banner-based advertisements. On open source developed peer-to-peer networks, advertising may not be permitted. Furthermore, even if advertising is permitted, the advertisements are typically not targeted to the needs or desires of the user. This type of advertising is annoying to peer-to-peer users as it results in slower connections and wasted time. This is exactly the opposite for advertisers, as they lose money on each ad and may receive negative promotions or exposures. There is also a lack of a way to track user file disposition shared on a peer-to-peer network and develop statistics on that user disposition (userrection) to optimize advertising and monetization efforts on the network (monetization effort).

Disclosure of Invention

A method and system for tracking and optimizing advertisements on a distributed network. In one embodiment, the method comprises: a user request is received from a user over a network. The method further comprises the following steps: responding to the request by sending a file to the user, the file containing an identifier. This identifier is used to track user file handling.

The above and other preferred features, including various novel details of implementation and combination of elements, will now be more particularly described with reference to the accompanying drawings and pointed out in the claims. It is to be understood that the specific methods and systems described herein are shown by way of illustration and not limitation. It should be appreciated by those skilled in the art that the principles and features described herein may be employed in various and numerous embodiments without departing from the scope of the invention.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate presently preferred embodiments and together with the general description given above and the detailed description of the preferred embodiments given below, serve to explain and teach the principles of the present invention.

FIG. 1 illustrates a node diagram of a non-hierarchical decentralized network, according to one embodiment.

FIG. 2 illustrates a node diagram of a hierarchical distributed network, according to one embodiment.

FIG. 3 illustrates a flow diagram of a method for performing a search query in a non-hierarchical distributed network, according to one embodiment.

FIG. 4 illustrates a flow diagram of a method for performing a search query performed by a regular node in a hierarchical distributed network, according to one embodiment.

FIG. 5 illustrates a flow diagram of a method for performing a search query performed by a supernode in a hierarchical distributed network, according to one embodiment.

FIG. 6 illustrates a block diagram of a system that utilizes aspects of the invention to block (intercept) search queries in a distributed network, according to one embodiment.

FIG. 7 illustrates a flow diagram of a method for blocking search queries through search result manipulation, according to one embodiment.

Fig. 8 shows a flow diagram of a method for isolating nodes according to one embodiment.

Fig. 9-12 illustrate node diagrams as an example of a method for isolating nodes, according to one embodiment.

Fig. 13 shows a flow diagram of a method for blocking a search query by file impersonation (impersonation), according to one embodiment.

FIG. 14 illustrates a flow diagram of a method for blocking search queries through file delivery attenuation, according to one embodiment.

FIG. 15 illustrates a flow diagram of a demand-based method for interdicting unauthorized copying in a distributed network, according to one embodiment.

FIG. 16 depicts a flow diagram of a preferred embodiment of a demand-based method for interdicting unauthorized copying in a distributed network in accordance with one embodiment.

Fig. 17 illustrates a block diagram of an apparatus for performing a demand-based method to block unauthorized copying in a distributed network prior to connecting a controlled node, in accordance with one embodiment.

Fig. 18 illustrates a block diagram of an apparatus for performing a demand-based method to block unauthorized copying in a distributed network after connecting a controlled node, according to one embodiment.

FIG. 19 illustrates a block diagram of a system for tracking and optimizing advertisements on a distributed network, according to one embodiment.

FIG. 20 illustrates a flow diagram of a method for tracking and optimizing advertisements on a distributed network, according to one embodiment.

FIG. 21 illustrates a flow diagram of a method for tracking and optimizing advertisements on a distributed network, according to one embodiment.

FIG. 22 illustrates an exemplary computer architecture for use with the system, according to one embodiment.

Detailed Description

A method and system for tracking and optimizing advertisements on a distributed network. In one embodiment, the method comprises: a user request is received from a user over a network. The method further comprises the following steps: responding to the request by sending a file to the user, the file containing an identifier. This identifier is used to track user file handling.

In the following description, for purposes of explanation, specific nomenclature is set forth to provide a thorough understanding of the various inventive concepts disclosed herein. However, it will be understood by those skilled in the art that these specific details are not required in order to practice the various inventive concepts disclosed herein.

Some portions of the detailed descriptions which follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the description, discussions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

The present invention also relates to an apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer. The computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories ("ROMs"), random access memories ("RAMs"), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus.

The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of computer programming languages may be used to implement the teachings of the invention as described herein.

In a distributed network, there is no centralized authorization or management entity. Each node of the network automatically makes decisions to connect, disconnect, and share information with other nodes in the network according to a predetermined protocol established by the network creator. Files and documents are stored in nodes of a network and are propagated through the network via exchanges between the nodes. Users search the network at their various nodes for a particular file or document using search queries and then select a host to download or stream content based on the search results.

To illustrate aspects of the present invention, two networks, referred to as a type a network and a type B network, respectively, are used as examples throughout the following description.

FIG. 1 illustrates, as an example, a node diagram of a type A non-hierarchical decentralized network 100. In such a network structure, all nodes (e.g., nodes N11-N19) are handled equally. On the other hand, fig. 2 illustrates, as an example, a node diagram of a type B hierarchical distributed network 200. In this second network there are regular nodes (e.g. nodes N20 to N28), and so-called super nodes (e.g. super nodes SN0 to SN 2). A regular node represents a computer hooked to the network 200 that hosts (or is capable of hosting) files for sharing. A supernode is a computer hooked to the network 200 that not only hosts (or is capable of hosting) files for sharing, but also has higher resources than conventional nodes and typically performs various functions in addition to the functions of conventional nodes.

FIG. 3 illustrates a flow chart of a method for performing a file or document search in a type A non-hierarchical distributed network (e.g., network 100). In 301, when a user of a node (e.g., node N10 in fig. 1) initiates a search by generating a search (or keyword) string, the node operated by the user (hereinafter referred to as a "client node") receives and records the search string. In some systems, the name of the file being requested is hashed (hash) to obtain a key or hash value, and the key or hash value is sent out in a search string for matching.

The client node then forwards the search string to other nodes in the distributed network in 302. This may be done, for example, by: the search string is forwarded to one or more of its neighboring nodes (i.e., the nodes with which it communicates through the distributed network software, such as nodes N11, N12, and N13 with respect to node N10 in fig. 1), which in turn forward the search string to their neighboring nodes (such as nodes N14, N15, and N16 with respect to node N13 in fig. 1) through the distributed network, and so on. Note that the exact behavior of the search string manipulation, forwarding, and query matching return processes depends on the defined rules and/or policies of the distributed network.

In 303, each node that receives the search string examines its list of files for matches and sends back any information that asks for a match over the distributed network to be received by the client node. The information asking for a match includes information about how to locate the file (e.g., a URL). The hash value for each reference (i.e., file or document) may also be sent in the query match. All query matches (also referred to herein as "search results") are typically sent back along the path they came from.

In 304, all received query matches are compared and displayed on a display screen by the client node for its user. The client node receives the selection (i.e., file or document) indicated by its user 305, and manages the P2P transfer of the host node using the selected file 306. For example, the client node may establish a direct connection with nodes having a copy of the selection available for download and send HTTP requests to those nodes requesting the selection. The node may then reply with a standard HTTP response.

Fig. 4-5 illustrate flow diagrams of methods for performing a search query in a type B hierarchical distributed network, such as network 200. In particular, FIG. 4 shows the actions taken by a client node that initiated the search string (e.g., node N20 in FIG. 2), while FIG. 5 shows the corresponding actions taken by a super node that received the search string (e.g., super node SN0 that FIG. 2 is connected to node N20).

Referring now to FIG. 4, in 401, when a user of a node (e.g., node N20) initiates a search by generating a search (or keyword) string, the node operated by the user (i.e., the "client node") receives and records the search string. In 402, the client node then forwards the search string to a super node (e.g., SN0), which in turn performs the activities described with reference to FIG. 5. In 403, the client node receives the matching priority list returned from the supernode and displays it on the client node's display screen. In 404, the client node receives the selection indicated by its user, and in 405, it manages the P2P transfer of the host node utilizing the selected file in much the same manner as described with reference to 305 of FIG. 3.

Referring now to FIG. 5, in 501, a super node receives and records a search string from a client node. In 502, it checks the search string against its file list, which includes the files it hosts and the files available on other nodes connected to it (e.g., conventional nodes N22 and N21 connected to supernode SN0) to generate a local match list. In 503, it forwards the search string to all or some of the super nodes connected to it (e.g., super nodes SN1 and SN2 connected to super node SN 0). These super nodes may in turn forward the search string to other super nodes connected to them, and so on, where the number of levels the search string is forwarded depends on the defined rules and/or policies of the distributed network.

Each supernode that receives the search string then checks its list of files for matches and sends information asking for matches (as a local match list) back through the distributed network to be received by the original supernode at 504. In 505, the original supernode (i.e., the supernode that first received the search string) then generates a priority match list from all local match lists (including itself). The priority is in this case usually done e.g. according to the connection speed and quality of the file. Finally, at 506, the matching priority list is sent back to the client node from which the search string originated.

Additional details regarding distributed networks, each of which is useful in implementing aspects of the present invention, can be found from publicly available information for distributed peer-to-peer technology and various protocols (e.g., Freenet, GNUtela, and Fastrack).

Blocking system

Fig. 6 illustrates a block diagram of a system 600 for blocking unauthorized copying in a distributed network 604. The plurality of software agents SA-1 to SA-N infiltrate the distributed network 604 by being masquerading as a node following all traditions and policies of the distributed network 604, so that they are not substantially distinguished as infiltrators (infilters).

The software agents SA-1 through SA-N are implemented as software residing on one or more computers that communicate with nodes in the distributed network 604 through individually assigned ports of the one or more computers. The IP addresses of these ports may change over time or in some other manner so that the software agents SA-1 to SA-N are detected as unauthorized masquerading nodes in the distributed network 604 and are prevented from exiting the network 604 or at least made considerably more difficult.

Software agents SA-1 through SA-N may uniformly infiltrate distributed network 604, for example, by connecting each of software agents SA-1 through SA-N to a corresponding node of a representative set of nodes in distributed network 604. The representative set of nodes is in this case a subset of the distributed network 604 from which the characteristics of the entire distributed network 604 can be statistically inferred.

The general steps for the software agents SA-1 through SA-N to infiltrate the distributed network 604 include: making internet connections to other nodes in the distributed network 604; perform a handshake or login procedure with those other nodes specified by the protocol of the distributed network 604 to be identified as nodes of the distributed network 604; and also performs the search while performing the blocking function in the dark and performs the operations that conventional nodes conventionally perform in the distributed network 604.

Furthermore, if software agents SA-1 through SA-N are to masquerade as supernodes in distributed network 604, they also notify distributed network 604 at login and/or at configuration to notify them that they are supernodes, or at least notify distributed network 604 that they are configured to satisfy all criteria for a supernode according to the policies of distributed network 604.

To perform the above-described infiltration, it is useful to first identify nodes in the distributed network 604 to which the software agents SA-1 through SA-N may be Internet connected. One way to do this is to: for nodes controlled by the blocking system, the distributed network 604 is first joined as a regular client by: the login is performed by client application software provided by or otherwise associated with the distributed network 604, after which the address of the node of the distributed network 604 is received and stored in the node address cache for later use. The node address may be provided along with additional node addresses (in the initial list of node addresses received when logging in) originating from one or more nodes in the initial list connected to the node.

The number of software agents SA-1 through SA-N, their attributes reported to other nodes in the distributed network 604, and the geographic location of the computer or computers on which they reside are preferably determined by the number and geographic distribution of the nodes of the distributed network 604, such that the software agents SA-1 through SA-N receive a desired percentage of search-related communications traveling through the distributed network 604.

Each of the software agents SA-1 through SA-N receives requests from client-capable nodes for file search queries from the distributed network 604 and forwards these search queries to other nodes in the distributed network 604, thereby appearing to be just conventional in this regard. However, when the software agents SA-1 through SA-N receive search results back from these forwarded search queries, rather than passing these search results back along the same path that the software agents SA-1 through SA-N receive the corresponding search queries, they first send the search results to the query matcher 602 implemented as software residing on a computer connected to the software agents SA-1 through SA-N through a private network.

The query matcher 602 compares each reference in the search results with the terms in its own database 603 containing metadata including the content identification code of the protected file. The match is then sent back to each of the software agents SA-1 through SA-N for the search results received by query matcher 602 from that software agent.

A centralized coordination authority 601, implemented as software on a computer, coordinates the activities of the multiple software agents SA-1 through SA-N, blocking unauthorized copying in the distributed network 604. The way it does this is: an instruction is sent over the private network to the plurality of software agents SA-1 to SA-N specifying an action to be taken when the plurality of software agents SA-1 to SA-N receive a match returned from the query matcher 602 with the search results for the protected file.

Search result manipulation

Fig. 7 shows a flow chart of a method for blocking a search query by search result manipulation. In 701, the software agent, along with other software agents as described with reference to FIG. 6, infiltrate through a distributed network that resembles or masquerades as a node. The node may be any node in a non-hierarchical network, or it may be a super node in a hierarchical network. At 702, the software agent captures the search results on their way back to the client node from which their corresponding search string originated.

At 703, the software agent identifies files, documents, and/or programs (also referred to herein collectively as "protected files") that it has privileged to protect in the search results. For example, the way it can do this is: the search results are sent to the query matcher, and matches for the protected files returned from the query matcher are received, as previously described with reference to FIG. 6.

In 704, the software agent modifies the search results to block unauthorized copying of the protected file according to instructions provided thereto by, for example, a centralized coordination authority, as previously described with reference to FIG. 6. In 705, the software agent then forwards the modified search results over the distributed network so that they are subsequently received by the client node that issued the corresponding search string.

The software agent may employ one or more of several techniques at 704 to modify the search results to block unauthorized copying in the distributed network. However, in all these techniques, a key feature is that the actual files residing on the nodes in the distributed network and available for file sharing by these nodes are not damaged in any way. These techniques merely block unauthorized copying of protected files in a distributed network.

One such technique for modifying the search results in 704 is: all or a subset of the references corresponding to matches to protected files in the search results are simply deleted.

Another technique for modifying the search results in 704 is: the information for the references corresponding to matches with the protected files are modified so that they point to, for example, invalid IP addresses, or IP addresses of computers that do not host the requested content, or even IP addresses of computers that do not run the client application software of the distributed network.

Another technique for modifying the search results in 704 is: the information for references corresponding to matches with protected files is modified so that they point to replacement files on their respective host nodes (i.e., nodes identified by the search results as having protected files available for file sharing). The selection of the alternate file may in this case be random selection of the unprotected file or random selection of the unprotected file (i.e., the file, document or program that the software agent is not privileged to protect).

Another technique for modifying the search results in 704 is: the information for the references corresponding to the matches with the protected files is modified so that they point to one or more alternate files residing on the controlled node. The selection of the substitute file may be made by randomly or non-randomly selecting the file on the controlled node, provided that the substitute file pointed to is not a protected file. The controlled node may be a software agent or another node that is controlled by a centralized coordination authority 601.

Since the nodes are controlled in this case, there is flexibility in the form and/or content of the substitute file pointed to. For example, a replacement file, or another file that may be freely distributed, or a rights management version of a protected file (i.e., a version with controls and/or features added to make it compatible with a digital rights management system) may be a synthetic decoy (decoy).

Synthesis of decoy files

Decoys are used to impersonate protected documents. Specifically, fraudsters are files that have the same characteristics (e.g., file name and metadata) as the files they counterfeit, but have different content. However, the hash values provided by the fraudsters typically match their actual content, not the content of the files they spoof. The following describes the manner in which decoys can be algorithmically synthesized to spoof protected audio, video, application, image, and document files accordingly.

For all file types, the title of the synthetic fraudster will be a random combined rearrangement (reordering) of words and phrases from the title of the protected file. The mouse movement (mouseover) on the property of the file will be the same as the title.

For audio files, the content may be white noise or an anti-piracy message. The MIME type will be randomly selected from one of the commonly used types of audio (e.g., wave or aiff). The length of the file is chosen randomly from a range corresponding to the size range of the known instance of the file on the network.

For video files, the content will be snowflake or white noise. The MIME type will be randomly selected from one of the commonly used types of video (e.g., mpeg, avi, or quicktime). The length of the file is also chosen randomly from a range corresponding to the size range of the known instance of the file on the network.

For applications, the content will be a "no operation" or executable NOP that simply terminates when executed. The type will be randomly selected from one of the commonly used types (e.g., ZIP).

For image files, the content will be a snowflake or anti-piracy statement. The MIME type will be randomly selected from one of the commonly used types of images (e.g., jpg, tif, or gif). The color depth and resolution are also chosen randomly (e.g., 1600 by 800 resolution, 16 bit depth).

For documents, the content is blank and the MIME type is randomly selected from a commonly used type of document (e.g., zip, pdf, doc, ppt, rtf, or html).

As just one example, an algorithmically synthesized decoy for a protected audio file of a Ray of Life track for Madonna (Madonna) may include a Ray of Life track for Madonna, the title. However, the content of the file may be only white noise. The MIME type can be mp3 (or any public audio MIME type) and the length of the audio file can be 3.5 minutes. Mouse movement on the decoy can display the file title that will closely match the protected file title.

In addition, or instead of modifying the search results in 704, the interdiction system of the present invention may also perform other activities for interdicting unauthorized copying in a distributed network.

Node isolation

One such activity is node isolation, where nodes to be isolated are surrounded by, for example, a centralized control authority 601 through a software agent. Using node isolation, nodes identified as having protected files available for file sharing can be effectively eliminated from the distributed network by: while allowing it to share unprotected files with other nodes in the distributed network, it is made "invisible" to other nodes on the distributed network or its file sharing activities are limited but not completely eliminated, thereby blocking unauthorized copying of protected files.

Fig. 8 shows a flow diagram of a method for isolating nodes, and fig. 9-12 show simple step-by-step examples of this method using a node diagram. In 801, after identifying node C to be isolated, a list of its immediately adjacent nodes N1 and N2 is obtained from that node (FIG. 9). In 802, software agent SA1 is connected to neighbor node N1 and node C (FIG. 10). At 803, the neighboring node N1 is then disconnected from node C (left side of fig. 11).

Depending on the performance and protocol of the distributed network, the neighboring node N1 may be disconnected using, for example, any of a number of different techniques:

1) issue a "disconnect from node C" message to node N1, or vice versa;

2) issue a "disconnect from network" message to node N1;

3) issuing a message to node C, purporting to be from the neighboring node N1, indicating that node N1 is now disconnected, or vice versa;

4) issuing a message to node N1 violating the agreed upon connection protocol between node N1 and node C, thus causing node N1 to drop the connection, or vice versa;

5) attaching a very large number of software agents to node C, exceeding the capacity or quota of its immediate neighbors, thus causing node C to disconnect from one or more of its immediate neighboring nodes until node N1 disconnects;

6) attaching a very large number of software agents to node C, exceeding the capacity or quota of its immediate neighbors, thus causing node C to pass connections for one or more of its immediate neighboring nodes to a single neighboring node until node N1 disconnects from node C;

7) the capacity of the port of (ovrewhelm) node C, the socket or connection to node N1, is throttled by: attacks (boards) on messages or requests that they have to parse, act or otherwise process; or

8) Eliminate N1 from the distributed network or disconnect N1 from the distributed network entirely by: utilizing known defects (e.g., overflow stacks) in the client software application of the distributed network or a potential client operating system running on node N1.

Note that in this regard, for most popular software client, large-scale distributed networks, the latest disconnect technique for such failed documents is available in the public domain, but is short lived.

In 804, the method determines whether there are neighboring nodes that are still directly connected to the node to be isolated. In this example, the answer is "yes," so the method loops back to 802, and another software agent SA2 is connected to neighbor node N2 and node C (right side of fig. 11). At 803, the neighboring node N2 is then disconnected from the node to be isolated (fig. 12). Then, again in 804, the method determines if there is another neighboring node connected to the node to be isolated. This time, however, the answer is no, so the method terminates.

Document counterfeiting

Another activity for blocking unauthorized copying in distributed networks is file impersonation. For example, FIG. 13 illustrates a flow diagram of a method for interdicting unauthorized copying in a distributed network through file impersonation. In 1301, the software agents traverse a distributed network similar to or masquerading as nodes infiltrated with other software agents as described with reference to FIG. 6. The nodes in this case may be any type of nodes in either a non-hierarchical network or a hierarchical distributed network. In 1302, the software agent receives the search string just as other nodes in the distributed network and in 1303 it reports matches of protected files that satisfy the search string along with attributes for matches in the distributed network that will be granted to its top selection or source.

At 1304, the software agent receives a request for one of the reported matches, which sends a replacement file instead of the actual requested file at 1305. The substitute file may in this case be a synthetic decoy file, or a spoofed file, or a freely distributable file, or a copyright managed version of a matching protected file.

Document delivery attenuation

Another activity for blocking unauthorized copying in distributed networks is file delivery attenuation. For example, fig. 14 shows a flow diagram of a method for blocking unauthorized copying in a distributed network through file transfer decay, where 1401 to 1404 are performed in the same manner as described with reference to 1301 to 1304. However, in 1405, in addition to sending the substitute file, the method also attenuates the transmission so that its transmission rate starts fast and then slows as the download progresses. At the time when the transmission rate is significantly slowed, the user of the client node requesting the file has already acquired most of the file, so he or she will be reluctant to cancel the download at that time. Eventually, however, the transmission rate will drop as a trickle, so that the user will likely become abnormally unsatisfied with the download process, and thus cancel the download at this time. In this case, the download will not pause, so that the user must explicitly cancel it to terminate the transmission. Alternatively, the transmission may automatically terminate after a certain percentage (e.g., 95%) of the files have been sent.

Another technique for blocking unauthorized copying in a distributed network is hash spoofing (hashspoofs). Although discussed separately herein, forms of hash spoofing may also be used in the search result modification method described with reference to FIG. 7 and the file spoofing method described with reference to FIG. 13.

Hash spoofing

In most distributed peer-to-peer file sharing networks, whether hierarchical or non-hierarchical, each unique file is given an identification code to uniquely identify its contents. Typically, such a code is a hash value generated by a cryptographic hash algorithm (e.g., MD-4, MD-5, SHA-1, SHA-64, etc.) of all or a subset of the contents of the file. This hashing mechanism is used by some distributed networks to facilitate downloads where the resume has been interrupted for some reason before completion, or multi-source downloads that can be used to greatly increase the reliability and speed of file downloads.

The client node sends out the search string over the distributed network and retrieves the search results along with their hashes. A file that a user of a client node desires to download may reside on more than one node in the distributed network as evidenced by the same hash. If the client node has its download interrupted for some reason, it may resume its download at a later time by: another node having the file identified by the same hash value is found and the remainder of the file is downloaded from that node at this time. Furthermore, if a client node wants to download a file through many sources on a distributed network and it knows that all of these sources have exactly the same content (as evidenced by their same hash values), the client node may divide the file content into multiple segments and request some segments from each source.

Once the download is complete, the client node can then verify whether the hash given to it in the search results is the same as the hash computed using the downloaded file content. If the two match, the download is successful. On the other hand, if they do not match, the downloaded file is considered corrupt and the client node will either automatically delete it or mark it as corrupt and ask the user how to act on it.

Hash spoofing may be used to block unauthorized copying where such interruptions/transfers and multi-source downloads are being used in a distributed network. In the blocking method described with reference to fig. 7, the software agent may modify the search results to replace the link (or address) to the file to be protected with either a link to a non-existing file along with the reported hash value that does not correspond to any file in the distributed network or a link to a spoofed file along with the reported hash value of the file whose link is replaced. In the first case, the client node will attempt to find a file that does not exist, but will be unsuccessful because the file does not exist. The client node may also attempt to find other files that have the same hash value as the non-existing file for download, but will not be able to succeed because there is no file in the distributed network that corresponds to the hash value.

In the second case, when the software agent receives a request for a protected file, or a segment of a protected file in the case of a multi-source download, a spoofed file, or portion thereof, is sent instead of the requested file or segment of a file. After the client node has finished downloading the file, or all segments from its source in the case of a multi-source download, the hash will be computed at this point and a mismatch will be detected (i.e., the file will be corrupted) because the hash value of the spoofed file or segment thereof is different than the hash value of the reported file.

Multi-level and/or demand-based blocking

While it is possible to perform all of the blocking methods described herein simultaneously to maximum effect, such methods may not fully utilize system resources and are commercially impractical from a cost/benefit standpoint. Furthermore, some blocking methods may be most advantageous in certain situations, while other blocking methods are most advantageous in other situations.

For example, one commonly used blocking method is: distributed network flooding (flood) is enabled with decoys to protected files. This approach may be very effective when there is a large demand for protected files. However, when the demand for protected files is small, it may also waste system resources, as a large number of controlled nodes (which provide the spoofer with downloads in a distributed network) must be provided, effectively flooding the network with the spoofer, which makes the method not easily scalable (scalable).

Conversely, certain blocking methods described herein (e.g., search result manipulation) are easily scalable and, therefore, very cost effective even when the demand for protected files is small. These methods are particularly useful for protecting large classes of protected files, where the need for individual files may vary greatly in class from one class to another. Thus, a multi-level and/or demand-based approach that uses one or more blocking techniques in certain situations and other blocking techniques in other situations may be readily understandable for its usefulness in cost-effectively blocking unauthorized copying of protected files in a distributed network.

FIG. 15 illustrates, as an example, a general approach to a multi-level and/or demand-based approach for interdicting unauthorized copying in a distributed network. In 1501, a first level of blocking is performed to block unauthorized copying of protected files in a distributed network. At 1502, a trigger event is detected while performing a first level of blocking. The triggering event may involve: are sent back to a plurality of search results representing one of the distributed network nodes that blocked the file to be protected by the first level, or a plurality of search queries originating from the nodes representing the file to be protected by the first level. In 1503, a second level of blocking is performed in response to detecting the triggering event. The second level of interdiction may include performing tasks in addition to, or instead of, the tasks performed in the first level of interdiction. Although only two levels of blocking are shown in this particular example, it should be understood that additional levels of blocking may be added, where each additional level is triggered by a different triggering event.

FIG. 16 illustrates, as an example, a particular preferred multi-level and/or demand-based approach for interdicting unauthorized copying in a distributed network. In 1601, a filter model is run along with or as part of a software agent disguised as a node in the distributed network to perform search result manipulation, such as described with reference to fig. 7.

In 1602, a software agent detects a trigger event while performing search result manipulation. The triggering event in this case relates to: the number of times the protected file is referenced in the search results being sent back to one of the nodes of the distributed network. More specifically, when the number exceeds a threshold number programmed into or provided to the software agent, a trigger event is detected.

In 1603, a flooder module included in the software agent is activated, which causes the node identified in 1602 to be flooded with a spoofer of the protected file. Note that this is a selective flooding for a particular node of the distributed network, as opposed to a traditional flooding for the entire distributed network. Since this is a selective or localized flood, as opposed to a shot (shotgun) flood, it will be appreciated that it is a much more efficient method of blackout with respect to utilizing system resources.

Fig. 17 and 18 illustrate the operation of 1601 to 1603 in the hierarchical distributed network as an example. Referring first to fig. 17, a software agent "SNF" performs the task of a filter such as that described with reference to 1601 while masquerading as a super node in the distributed network, thereby cutting off communication within the distributed network in relation to a search query.

During execution of its blackout task, the software agent "SNF" identifies references in the communication to the protected file by interacting with the query matcher 602 described with reference to fig. 6. The software agent "SNF" detects a triggering event when the number of references to one of the protected files exceeds a threshold number for one of the other supernodes in the distributed network. In this example, assume that a supernode "SN 1" has been identified as being associated with a triggering event.

Referring now to fig. 18, in response to detection of a triggering event, a flooder module included in the software agent "SNF" is activated. The flooder module floods the identified supernode "SN 1 with a spoofer of the protected file, for example, by: one or more controlled nodes (e.g., controlled node "CN 4") are connected as regular nodes to the supernode "SN 1", where each controlled node has one or more spoofers of protected files available for download. Note that these nodes are referred to as controlled nodes because they are controlled by or under common control as a software agent "SNF".

By continuously looping 1601 to 1603 and applying 1601 to 1603 after a triggering event has identified the supernode and the protected file as satisfying the additional protection provided by such selective flooding, software agent "SNF" can selectively flood any supernode in the distributed network with a decoy of any protected file in the classification of protected files. Although not shown in the figures, the reverse procedure may also be used, wherein selective flooding is stopped when the triggering event is no longer triggered (i.e. when the number of references identifying a protected file and included in the communication associated with a given supernode falls below a threshold number).

Other techniques for interdicting unauthorized copying in a distributed network through the use of multiple software agents, a centralized coordinating authority, and a query matcher as described herein are also readily contemplated and are fully contemplated as falling within the full scope of the present invention.

Advertisement tracking and optimization

One embodiment of the invention relates to the tracking and optimization of advertisements on a distributed network. More specifically, one embodiment of the present invention provides a system and method for tracking the effectiveness of monetization efforts on a distributed network (e.g., a peer-to-peer network), and using information about users on the distributed network to optimize other monetization efforts to maximize revenue generation.

FIG. 19 illustrates an exemplary system for tracking and optimizing advertisements over a distributed network. Blocker 1902 is coupled to distribution network 604. Blocker 1902 is configured to receive a user search over distributed network 604 and return one or more files that match the user search query found in uploader 1904. The ID embedder 1906 is configured to embed an identifier on a file stored in the uploader 1904. The title processing server 1908 is also coupled to the distribution network 604. If a user on distributed network 604 executes a file provided by blocker 1902, title processing server 1908 is configured to retrieve the embedded identifier in the file and provide the embedded identifier to advertisement server 1910. The advertisement server 1910 is also coupled to the distributed network 604 and is configured to: if the verification server 1912 verifies that the file was downloaded directly from the interdiction system rather than another node in the distributed network 604, an advertisement matching the embedded identifier is provided to the user.

FIGS. 20 and 21 illustrate exemplary processes by which monetization over a distributed network may be tracked and optimized. In 2002, a user on the distributed network 604 searches for content on the distributed network 604 by using a query (e.g., "Britney Spears Poster"). In 2004, blocker 1902 searches for the word used in the query and returns the filename found in uploader 104 and having the embedded identifier provided by ID embedder 1906. For example, the embedded identifier may be the query parameter "23456 Britney% 20 Spears% 20 Poster". In 2006, after providing the file retrieved from the uploader 1904 to the user, the user executes the file, for example, by clicking on a link in the file. In 2008, the embedded identifier is provided to the title processing server 1908 after the user executes the file (e.g., clicks on the link and browses the website). In 2010, title processing server 1908 queries advertisement server 1910 for advertisements that match the user query. In one embodiment of the invention, the file sent to the user is configured to: the user is redirected to a uniform resource locator ("URL") containing parameters of a query provided by the user to request the file.

In 2102, title processing server 1908 sends information identifying the user, the IP address of the user's computer, and the advertisement title requested by the user to authentication server 1912. At 2104, authentication server 1912 determines whether the user initially downloaded the file from the blocking system or from another node or user on distributed network 604. If the file was not initially downloaded from the interdiction system (i.e., the second dissemination), the user may not be provided with the entire advertised content. Thus, in 2106, if verification server 1912 determines that the file was downloaded directly from the interdiction system, advertisement server 1910 transmits the targeted advertisement to the user. At 2108, the user determines whether to purchase the advertised content. If the user decides to purchase the advertised content, statistics reflecting the titles purchased by the user are updated in 2110. If the user determines not to purchase the advertised content, then statistics reflecting titles not purchased by the user are updated at 2112.

In one embodiment of the invention, the identifier embedded in the file is unique to the user and/or the user's request for the file. For example, the user's username on distributed network 604 may be embedded in a file provided to the user. Thus, one embodiment of the present invention allows for tracking of user behavior on distributed network 604. Among the possible user behaviors that can be tracked are: 1) a distributed network where users find files; 2) exact search criteria used by the user; 3) the date and time the user found the file; 4) the geographic location of the user (e.g., using the IP address of the user's computer); 5) the type of connection the user has and its approximate speed; 6) statistics about user usage of the distributed network, including how many files the user is sharing; and 7) the ability to browse files shared by users. Through the embedded identifiers, embodiments of the invention may also track: 1) how long the user takes to complete the download; 2) when a user clicks on or executes a file; 3) what the user did later (e.g., sales, actions, browsing a website, etc.); and 4) the ability to view files shared by the user at a later time, e.g., to know whether the user has deleted downloaded files from the shared folder. Through these statistics, which are available to the user, embodiments of the present invention allow for detection of who is the best user for targeting advertisements. For example, if statistics show that user A is more likely to perform an end action or sale than user B, one embodiment of the present invention allows for targeting user A for advertising rather than user B.

One embodiment of the present invention also provides for optimization of monetization efforts over a distributed network. For example, many metrics may be adjusted and optimized, such as what ad titles to share, how many ad titles to share, the number and bandwidth of connections to allow uploads from ad titles, and the bandwidth to allow users to be given to download a given ad title. To determine what titles are shared on the distributed network 604, the user queries and query results sent on the distributed network 604 match the advertisement inventory stored in the advertisement server 1910. The titles that match the highest number of user queries and query results are selected for presentation to the users on the distributed network 604.

To determine how many of each advertisement title is shared on distributed network 604, and the number of connections and bandwidth to allow uploads on the basis of the title, one embodiment of the present invention tracks the revenue generated by a particular title. The resources may be adjusted according to the revenue that each title is generating. For example, if title a has 50% of the resources and produces 99% of the revenue, while title B has 50% of the resources and produces 1% of the revenue. The resources may be reallocated such that title a is provided with 99% of the resources and title B is provided with 1% of the resources. Resource reconfiguration may be performed periodically. In particular, it may be desirable to move gradually towards suggested resource usage to account for day-to-day variations.

The bandwidth for allowing a given user to download a particular title may be determined based on past data. When a user requests to download a file from the interdiction system, certain information about the user may be derived, such as the user's geographic location, the file requested by the user, the keywords the user uses to find the file, and the approximate speed and type of the user's connection. Based on this information, one embodiment of the present invention looks at past similar users and determines the probability that the past users will initiate a sales transaction or continue an action. This probability can be used to assign a certain amount of system resources to similar users.

FIG. 22 illustrates an exemplary computer architecture for use with the system, according to one embodiment. The computer architecture 2200 may be used to implement the computer systems described in the various embodiments of the invention. One embodiment of architecture 2200 includes: system bus 2220 for communicating information; and a processor 2210 coupled to bus 2220 for processing information. Architecture 2200 also includes a Random Access Memory (RAM) or other dynamic storage device 2225 (referred to herein as main memory), coupled to bus 2220, for storing information and instructions to be executed by processor 2210. Main memory 2225 also may be used for storing temporary variables or other intermediate information during execution of instructions by processor 2210. Architecture 2200 may also include a Read Only Memory (ROM) and/or other static storage device 2226, which storage device 2226 is coupled to bus 2220 for storing system static information and instructions used by processor 2210.

A data storage device 2227 (e.g., a magnetic disk or optical disc) and its corresponding drive may also be coupled to computer system 2200 for storing information and instructions. The architecture 2200 may also be coupled to a second I/O bus 2250 via an I/O interface 2230. A number of I/O devices may be coupled to I/O bus 2250, including a display device 2243, an input device (e.g., an alphanumeric input device 2242 and/or a cursor control device 2241). For example, web pages and business related information may be presented to the user on display device 2243.

The communication device 2240 is used to access other computers (servers or clients) via a network. The communication devices 2240 may include a modem, a network interface card, a wireless network interface, or other known interface devices, such as those used for coupling to ethernet, token ring, or other types of networks.

Although the method and system have been described in connection with a distributed network, those skilled in the art will appreciate that the described techniques may be used in any situation where advertising on a network is to be tracked and optimized.

A method and system for tracking and optimizing advertisements on a distributed network. In one embodiment, the method comprises: a user request is received from a user over a network. The method further comprises the following steps: responding to the request by sending a file to the user, the file containing an identifier. This identifier is used to track user file handling.

Claims (30)

1. A computer-implemented method, comprising:

receiving a user's request from a user over a network;

responding to the request by sending a file to the user, the file containing an identifier; and

tracking user file handling using the identifier.

2. The computer-implemented method of claim 1, wherein the identifier is used to determine whether a sale was made as a result of user file disposition.

3. The computer-implemented method of claim 1, wherein the identifier is used to determine whether a website has been browsed as a result of user file disposition.

4. The computer-implemented method of claim 1, wherein the identifier is used to determine whether a user executed a file.

5. The computer-implemented method of claim 1, wherein the identifier is used at a later time to determine whether the user deleted a file from a shared folder.

6. The computer-implemented method of claim 1, further comprising: users are located through advertisements based on user file handling.

7. The computer-implemented method of claim 1, wherein the identifier is unique to the user and the request.

8. The computer-implemented method of claim 1, wherein the identifier comprises a query provided by the user requesting the file.

9. The computer-implemented method of claim 1, wherein the file sent to the user redirects the user to a link containing parameters of a query provided by the user requesting the file.

10. The computer-implemented method of claim 1, wherein the file sent to the user further comprises a user nickname.

11. A computer-readable medium having stored thereon a plurality of instructions which, when executed by a computer, cause the computer to:

receiving a user's request from a user over a network;

responding to the request by sending a file to the user, the file containing an identifier; and

tracking user file handling using the identifier.

12. The computer-readable medium of claim 11, wherein the identifier is used to determine whether a sale was made as a result of user file disposition.

13. The computer-readable medium of claim 11, wherein the identifier is used to determine whether a website has been browsed as a result of user file disposition.

14. The computer-readable medium of claim 11, wherein the identifier is used to determine whether a user executed a file.

15. The computer-readable medium of claim 11, wherein the identifier is used at a later time to determine whether the user deleted a file from a shared folder.

16. The computer-readable medium of claim 11, wherein the computer further performs: users are located through advertisements based on user file handling.

17. The computer-readable medium of claim 11, wherein the identifier is unique to the user and the request.

18. The computer-readable medium of claim 11, wherein the identifier comprises a query provided by the user requesting the file.

19. The computer-readable medium of claim 11, wherein the file sent to the user redirects the user to a link containing parameters of a query provided by the user requesting the file.

20. The computer-readable medium of claim 11, wherein the file transmitted to the user further comprises a user nickname.

21. A computer system, comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions;

wherein the instructions, when executed by the processor, cause the processor to:

receiving a user's request from a user over a network;

responding to the request by sending a file to the user, the file containing an identifier; and

tracking user file handling using the identifier.

22. The computer system of claim 21, wherein the identifier is used to determine whether a sale was made as a result of user file disposition.

23. The computer system of claim 21, wherein the identifier is used to determine whether a web site was browsed as a result of user file disposition.

24. The computer system of claim 21, wherein the identifier is used to determine whether a user executed a file.

25. The computer system of claim 21, wherein the identifier is used at a later time to determine whether the user deleted a file from a shared folder.

26. The computer system of claim 21, wherein the instructions, when executed by the processor, further cause the processor to: locating the user through advertising based on user file handling.

27. The computer system of claim 21, wherein the identifier is unique to the user and the request.

28. The computer system of claim 21, wherein the identifier comprises a query provided by the user requesting the file.

29. The computer system of claim 21, wherein a file sent to the user redirects the user to a link containing parameters of a query provided by the user requesting the file.

30. The computer system of claim 21, wherein the file sent to the user further comprises a user nickname.