Abstract: Providing tailored supplemental content to a user in a Network Address Translation (NAT) environment is described. Network traffic from a user to a supplemental content provider is monitored within a first network and a supplemental content identifier (ID) is identified in the monitored traffic and linked to a profile of the device or user of the device. A supplemental content provider on a second network receives a request for supplemental content that includes the supplemental content ID and uses the received supplemental content ID to retrieve the profile linked to the supplemental content ID. Supplemental content may then be generated or retrieved based on the retrieved profile and returned to the user device.

Abstract: A web mapping system and method are described. The web map system receives a content pointer and provides a category result associated with the content pointer. The category result is determined by successively selecting and applying one of a plurality of categorization algorithms that each attempt to provide a category result for a URL based on a plurality of rules. If no category result is determined, the content pointer may be passed to a categorization manager to generate a rule for the content pointer so that subsequent categorization requests for the content pointer will result in a category result.

Abstract: A method and system for providing network based malware detection in a service provider network is disclosed. Transmission control protocol (TCP) packets defining originating from an access device coupled to the service provider network defining a TCP session between a computing device coupled to the access device, and a destination coupled to the service provider network are received. An operating system identifier (OS ID) associated with the TCP session and the computing device is determined. If malware is present in the TCP session and an associated malware ID is determined by comparing a malware signature to the one or more TCP packets. An alert identifying a network address associated with the access device, the malware ID and the OS ID associated with TCP session that generated the alert can then be generated.

Abstract: A method and apparatus are provided for identifying and tracking multiple computer user sessions associated with a network address translation (NAT) device coupled to a computer network. Data packets originating from the NAT device containing a request to a destination server coupled to the computer network are received. A client source address associated with the data packets is determined where the source address associated with the NAT device. One or more session entries associated with the client source address can then be determined, wherein the session entries are stored in system state information. A session signature can then be determined based one or more characteristics defined by the data packet header information and/or request header information in the one or more data packets, the session signature uniquely identifying one of the multiple computer user sessions coupled to the NAT device.

Abstract: A method and apparatus for character differentiation based on pattern recognition is provided. A sequence of events is received that have been generated from a given session or connection and determines if the sequence of events is likely to have come from an existing, known character, or if the events are from a previously unknown character. A character identifier (ID) is tagged onto (i.e. associated with) the event for further processing in another system that can, for example, provide different content based on the identified character and an associated preference profile.

Abstract: A system and method for generating feature vectors of documents in different languages are provided. The feature vectors provide scores associated with keywords defined in a base language for use by a profiler for generating or updating a user profile. The system and method use a plurality of keyword sets comprising: a base language keyword set comprising a plurality of base language keywords each associated with a respective identifier (ID); and a second language keyword set comprising a plurality of second language keywords each corresponding in meaning to a respective one of the base language keywords and associated with the ID of the corresponding base language keyword. One of a plurality of tokenizers is selected to parse a document based on the language of the document and to generate the feature vector using the keyword set of the corresponding language.

Abstract: A method for categorization using multiple categories including obtaining multiple uniform resource locators (URLs) associated with the multiple categories, collecting multiple web pages identified by the multiple URLs, generating vocabulary terms based on the multiple web pages, generating an N-gram file including the multiple vocabulary terms, generating multiple classified URLs by labeling the plurality of URLs based on the multiple categories, generating multiple feature vectors by processing the classified URLs and the multiple web pages against the N-gram file, generating a categorization model by applying a machine learning algorithm to the multiple feature vectors, and loading a classifier with the categorization module and the N-gram file.

Abstract: A method for generating a behavioral model for a targeted advertisement category (TAC), including: obtaining click stream data including ad-clicks and events preceding the ad-clicks and performed on web pages; assigning features having categories and keywords associated with the web pages to the events; identifying an ad-click of the ad-clicks and a subset of the events preceding the ad-click that result in the ad-click, where the subset of the events is associated with at least one feature; generating an aggregated event sequence by aggregating the ad-click and the subset of the events; selecting, in response to the at least one feature being associated with the TAC, a training data set including at least the aggregated event sequence; generating the behavioral model for the TAC by applying a learning algorithm to a portion of the training data set; and evaluating performance of built models and select model based on performance result.

Abstract: A system, a method and a computer readable medium for anonymizing collected data associated with one or more data owners is provided. An identifier is received and a hash process is performed using the identifier and a cryptographic salt to produce a hash output. The hash output is associated with an anonymous identifier. The anonymous identifier is then associated with the data. The anonymized data may then be provided to one or more third party processors for processing an analysis.

Abstract: A method and apparatus for character differentiation based on pattern recognition is provided. A sequence of events is received that have been generated from a given session or connection and determines if the sequence of events is likely to have come from an existing, known character, or if the events are from a previously unknown character. A character identifier (ID) is tagged onto (i.e. associated with) the event for further processing in another system that can, for example, provide different content based on the identified character and an associated preference profile.

Abstract: A system and method for selecting an accompanying content, such as an advertisement, for presentation with a main content, such as a web page is described. The system and method provide a profile of the main content that is used when selecting the accompanying content. The main content profile may be used to select the accompanying content when the main content is requested by a user for which little or no profile information is available. The main content profile is based on the content consumption history of a group of users for which profile information is available.

Abstract: A system and method are provided for delivering targeted content to a subscriber coupled to a service provider network. Network application data generated by the subscriber is received and processed by a network application element deployed in the service provider network associated with a network identifier of the subscriber's computing device. The network application data is generated from user interaction with a server coupled to the service provider network or through a public communication network. The network application data is converted to web events associated with the network identifier. The web events are filtered to remove irrelevant data from received web events. A subscriber profile can then be generated base upon the filtered web events associated with the subscriber. Targeted content can then be delivered to the subscriber based upon the subscriber's profile.

Abstract: A method and system for profiling a user based upon a user's previous on-line actions is provided. The profile provides a characterization of the user's preferences based upon a received user event. The user event identifying event identification information and a user identifier. A look-up in a cached web map is performed to retrieve classification information associated with the event identification information. A user profile is retrieved or created for the user identifier. Profile update information is generated based upon the retrieved classification information for the user event, to identify how the user is to be updated based upon the retrieved classification information and defined profiling rules. The user profile is updated and stored for access by an external advertising server. The classification information provides a text-score record comprising a text string and a score defined in relation to a lexical ontology comprising a hierarchy of categories.