RU2775824C2 - Method and system for detecting abnormal visits to websites - Google Patents

Abstract

FIELD: search engines.

SUBSTANCE: inventions group relates to detection of anomalous behavior when searching the Internet and, in particular, to detection of web hosts with abnormal website visits. The method is executed on a server and comprises the steps of obtaining a web search history for a plurality of users via a communication network based on search queries from a plurality of client devices; forming a web history graph in which each vertex represents a web host from the web search history, with vertices connected to other vertices by edges, each having an edge weight determined based on the number of users who visited both hosts connected by this edge; clustering graph vertices based on edge weights and forming a plurality of vertex clusters; obtaining user activity data corresponding to these vertex clusters and associated with a plurality of users visiting web hosts associated with these vertex clusters; determining, for each vertex cluster, the associated web hosts in that cluster based on user activity data; removal from the graph of each vertex cluster containing web hosts associated based on user activity data; and storing, for each web host associated with the cluster remaining in the graph, an indicator that the web host is associated with abnormal website visits.

EFFECT: improving the reliability of the search engine by increasing the reliability of the results.

21 cl, 10 dwg

Description

The field of technology to which the invention relates

[001] The present technology generally relates to detecting anomalous Internet browsing behavior, and more specifically, to a method and system for detecting web hosts with abnormal web site visits.

State of the art

[002] The amount of information available on various Internet resources has grown exponentially over the past decades. Several solutions have been developed to help the typical user find the information they need. One such solution is a search engine. Examples are search engines GOOGLE™, YANDEX™, YAHOO!™, etc. The user may access the search engine interface and submit a search query related to information to be found on the Internet. In response to a search query, the search engine provides a ranked list of search results. The ranked list of search results is generated based on various ranking algorithms used by the particular search engine used by the user to search. The general goal of such ranking algorithms is to present the most relevant search results at the top of the ranked list, while the less relevant search results may appear in less prominent positions in the ranked list (the least relevant search results are at the bottom of the ranked list).

[001] Search engines usually provide good tools for processing a search query when the user knows in advance what to search for. In other words, if the user is interested in information about the most popular places in Italy (ie, if the search topic is known), he can send the search query "The most popular places in Italy?". In response, the search engine returns a ranked list of Internet resources that are potentially relevant to the search query. The user can view a ranked list of search results to obtain the required information regarding places to visit in Italy. If the user is not satisfied with the search results for any reason, he can perform a second search, for example, with a more precise search term, such as "The most popular places in Italy in summer?", "The most popular places in southern Italy?", " The most popular destinations for a romantic getaway in Italy?

[002] When a user submits a search query, the search engine generates a list of relevant web resources (based on the analysis of web resources viewed by the crawler, indications of which are stored in the crawler database as posting lists, etc.). The search engine then ranks the resulting list of search results. Listing and/or ranking of search results can be performed using various means, for example, by executing a machine learning algorithm (MLA, Machine Learning Algorithm). The MLA algorithm ranks a list of search results based on their relevance to the search query. The MLA algorithm is "trained" to predict the relevance of a search result to a search query based on a large number of "features" associated with the search result and indications of past user behavior with search results when submitting similar search queries in the past.

[003] When ranking a list of search results, various factors are taken into account, such as recorded web search history. Web search history indicates which search results have been selected by users who have previously submitted the same or a similar search query. It is assumed that the web hosts previously selected by users who submit such requests are the most relevant web hosts for that search query. In order to provide the user with the most useful information, it is advisable to assign web hosts previously selected by users to a higher rank.

[004] Website promoters are aware that web search history affects the ranking of search results. Some unscrupulous actors try to increase the rank of a website by inviting users to submit certain queries and, after receiving a ranked list of search results, select certain results. Unscrupulous actors can pay users to perform searches. As a result of these anomalous website visits, relevant web hosts may be ranked higher in responses to a query even if these web hosts are of low relevance. But if the user is given irrelevant results, user satisfaction with the search engine decreases.

[005] US9092510 (Google Inc., issued July 28, 2015) describes a search results ranking system that may include a defense against spammers that generate fraudulent "clicks" aimed at increasing the rank of specific search results. The safeguard may be implemented using a user model describing the correct behavior of the user over time so that such fraudulent "clicks" can be ignored in the ranking process. Fraudulent clicks can also be detected based on an abnormal distribution of click positions, click duration, or clicks per minute, per hour, or per day.

[006] US2008/0172271 (NHN Corporation, issued Jan. 15, 2008) describes tracking a user's actions after selecting a website to detect an invalid "click". An invalid "click" is a "click" performed by a user with malicious intent or through the use of an automated script (script) or computer program. The actions taken by the user after selecting a search ad are collected, stored and compared with the average behavior pattern on this website. Based on these comparison results, an invalid "click" made by the user is determined.

[007] "Search Engine Click Spam Detection Based on Bipartite Graph Propagation" (published in Proceedings of WSDM '14, The 7th ^ACM International Conference on Web Search and Data Mining, February 24, 2014) describes a system and method, which can be used to identify "click spam" generated by search engines or similar tools in order to increase the rank of a web page in search engine optimization. The method includes modeling user actions, taking into account the time intervals during which they are performed, in order to determine possible fraudulent users, as well as using a graph generation algorithm to display the characteristics of the alleged fraudulent user's session in order to better identify other fraudulent users.

Disclosure of invention

[008] The developers of the present technology have discovered at least one technical problem associated with known solutions.

[009] The present technology relates to detecting anomalous Internet browsing behavior in general, and in particular to methods and systems for detecting web hosts with abnormal web site visits. As described above, various unscrupulous actors may seek to influence the position of a web host on a search engine results page (SERP, Search Engine Results Page) For example, a user may be prompted to enter a certain query in a search engine and, after receiving the SERP page, select a specific web host on the SERP page. The developed methods are designed to detect anomalous behavior when searching the Internet.

[0010] Operators of search engines such as Google™, Yandex™, Bing™, Yahoo™, etc., have access to a large amount of web search history data with search results obtained in response to user queries. The web history contains records with information about web hosts on the SERP page selected by the user. Web history can be used to identify anomalous web browsing behavior.

[0011] When browsing the Internet, users typically visit a sequence of naturally related web hosts. Naturally related web hosts may share a common theme. For example, if a user visits a first web host providing football news, then that user may then visit a second web host providing a football club home page. In this example, the topic of both web hosts is about football, and therefore they are connected in a natural way. Users receiving instructions from an unscrupulous actor may visit web hosts that are not naturally connected. To detect anomalous website visits, web browsing history can be analyzed to identify users who have visited unnaturally related web hosts.

[0012] This may collect user activity data describing the user's browsing history. Web hosts not naturally related by a common theme can be linked based on user activity data. Even if the web hosts are not thematically related, similar groups of users can visit both web hosts. Topically unrelated web hosts can be related by the fact that these web hosts are accessed by a group of users. User activity data can be analyzed to determine the association of web hosts. To identify web hosts with abnormal website visits, web hosts may first be filtered based on their natural association based on a common topic, and then these web hosts may be further filtered based on their association based on user activity data.

[0013] According to non-limiting embodiments of the present technology, a web search history graph or portion of a web search history may be generated. The graph contains vertices and edges connecting the vertices. Each edge is connected to two vertices. Each vertex represents a web host in the web history. Each edge in the graph is assigned an edge weight. An edge weight is determined for each edge based on the number of users visiting both the web host of the first vertex connected to that edge and the web host of the second vertex connected to that edge.

[0014] According to its restrictive embodiments of the present technology, once a graph is generated, one or more topics are determined for each graph vertex. Themes are based on the content of the top web host. The topics of the related nodes are then compared to determine the naturally related node web hosts. If an edge connects two vertices with naturally related hosts, then that edge is removed from the graph.

[0015] After the graph is formed, the vertices of the graph are clustered based on the weight of the edge. As a result, vertex clusters are defined in which individual users have visited several hosts. The hosts in each cluster are analyzed to determine if the hosts in the cluster are connected based on user activity data. User activity data describes users' web browsing history, such as web hosts visited by users and/or user behavior when visiting web hosts. If hosts in a cluster are determined to be linked based on user activity data, then the cluster is removed. The remaining clusters, in which web hosts are not linked based on user activity data, are believed to have had anomalous website visits. The rank of web hosts associated with abnormal website visits on SERP pages may be reduced. Abnormal website visits can be removed from your web history.

[0016] In accordance with the first aspect of the present technology, a method for determining web hosts with abnormal website visits is implemented. The method is performed by a server and includes: obtaining a web search history for a plurality of users; forming a web history graph in which each vertex represents a web host in the web search history, the vertices being connected to other vertices by edges, each having an edge weight determined based on the number of users visiting both hosts connected by that edge; clustering graph vertices based on edge weights and thus forming a plurality of vertex clusters; obtaining user activity data corresponding to these vertex clusters and associated with a plurality of users visiting web hosts associated with these vertex clusters; determining, for each vertex cluster, the associated web hosts in that cluster based on user activity data; removal from the graph of each vertex cluster containing web hosts associated based on user activity data; and storing, for each web host associated with the cluster remaining in the graph, an indicator that the web host is associated with abnormal website visits.

[0017] In some embodiments of the method, prior to clustering graph vertices, it further includes determining for each graph vertex one or more topics corresponding to that vertex and removing from the graph edges connecting two vertices with related topics.

[0018] In some embodiments of the method, determining one or more topics for each graph vertex includes querying a database of topics associated with the web host corresponding to that vertex.

[0019] In some embodiments of the method, it further includes: receiving a search query; generating, based on the search query, a search engine results page with a ranked set of web hosts matching the search query; and a reduction in the web host rank on the search engine results page associated with abnormal website visits.

[0020] In some embodiments of the method, it further includes: obtaining a search query; generating, based on the search query, a search engine results page with a ranked set of web hosts matching the search query; and removing from the search engine results page a web host associated with abnormal website visits.

[0021] In some embodiments, the method further includes deleting from the web search history data corresponding to web hosts associated with abnormal website visits.

[0022] In some embodiments of the method, it further includes determining a plurality of user IDs corresponding to abnormal website visits and storing for each of them an indicator that the user ID is associated with abnormal website visits.

[0023] In some embodiments of the method, the user activity data includes a web search history.

[0024] In some embodiments of the method, the user activity data includes web browser usage data.

[0025] In some embodiments of the method, the user activity data contains web script data.

[0026] In some embodiments of the method, it further includes determining the weight of each edge based on the number of matching search queries entered by users who have visited both hosts connected by the edge.

[0027] In accordance with another aspect of the present technology, a system is implemented for identifying web hosts with abnormal website visits. The system includes a processor and a computer-readable physical storage medium containing instructions. The processor, when executing instructions, is capable of: receiving a web search history corresponding to a plurality of users; generate a web history graph in which each vertex represents a web host in the web search history, with vertices connected to other vertices by edges, each having an edge weight determined based on the number of users who visited both hosts connected by that edge; perform graph vertex clustering based on edge weights and thus form a plurality of vertex clusters; obtain user activity data corresponding to these vertex clusters and associated with a plurality of users who have visited web hosts associated with these vertex clusters; determine, for each vertex cluster, the associated web hosts in that cluster based on user activity data; remove from the graph each vertex cluster containing web hosts connected based on user activity data; and store, for each web host associated with the cluster remaining in the graph, an indicator that this web host is associated with abnormal website visits.

[0028] In some embodiments of the system, the processor, when executing instructions, is further capable of determining for each vertex of the graph one or more topics corresponding to this vertex, and removing from the graph edges connecting two vertices with related topics.

[0029] In some embodiments of the system, the processor, when executing instructions, is further capable of: receiving a search query; generate, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and lower the rank of the web host associated with abnormal website visits on the search engine results page.

[0030] In some system embodiments, the processor, when executing instructions, is further capable of: receiving a search query; generate, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and remove from the search engine results page a web host associated with abnormal website visits.

[0031] In some embodiments of the system, the processor, when executing instructions, is further capable of removing from the web search history data corresponding to web hosts associated with abnormal website visits.

[0032] In some embodiments of the system, the processor, when executing instructions, is further capable of: determining a plurality of user identities corresponding to abnormal website visits, and storing for each of them an indicator that the user id is associated with abnormal website visits.

[0033] In some embodiments of the system, the processor, when executing instructions, is further capable of determining the weight of an edge based on the number of matching requests entered by users visiting both web hosts connected by that edge.

[0034] In accordance with another aspect of the present technology, a method for determining web hosts with abnormal website visits is implemented. The method is executed on a server and includes: obtaining a web search history for a plurality of users; for each web host in the search history: determine, based on the web search history, a list of other web hosts visited by users who visited this web host, and remove other web hosts that have a natural relationship with this web host from the list of others web hosts; based on lists of other web hosts, clustering unnaturally related web hosts and thus forming a plurality of vertex clusters; obtaining user activity data corresponding to these vertex clusters and associated with a plurality of users visiting web hosts associated with these vertex clusters; removing clusters containing web hosts related to each other based on user activity data; and storing, for each web host associated with the remaining clusters, an indicator that the web host is associated with abnormal website visits.

[0035] In some embodiments of the method, removing other web hosts that have a natural association with a given web host includes performing, for each other web host in a list of other web hosts, a comparison of one or more topics corresponding to the given web host. , with one or more themes corresponding to another web host.

[0036] In some embodiments of the method, it further includes: receiving a search query; generating, based on the search query, a search engine results page with a ranked set of web hosts matching the search query; and a reduction in the web host rank on the search engine results page associated with abnormal website visits.

[0037] In the context of the present description, the term "server" means a computer program executed by appropriate hardware and capable of receiving requests (for example, from electronic devices) via a network and fulfill these requests or initiate their execution. The hardware may be one physical computer or one computer system, which is not essential to the present technology. In the present context, the expression "server" does not mean that every task (e.g. received command or request) or some specific task is received, executed or started by the same server (i.e. the same software and/or hardware ). This expression means that any number of software or hardware can receive, send, perform or initiate the execution of any task or request or the results of any tasks or requests. All of these software and hardware may be a single server or multiple servers, both of which are meant by the expression "at least one server".

[0038] In the context of the present description, the term "electronic device" means any computer hardware capable of executing programs suitable for solving the task. Thus, some (non-limiting) examples of electronic devices include personal computers (desktops, laptops, netbooks, etc.), smartphones and tablets, and network equipment such as routers, switches, and gateways. It should be noted that in this context, a device functioning as an electronic device may also function as a server in relation to other electronic devices. The use of the term "electronic device" does not preclude the use of multiple electronic devices to receive, send, perform or initiate any task or request, or the results of any tasks or requests or steps of any method described herein.

[0039] In the context of the present description, the term "database" means any structured set of data, regardless of its specific structure, database management software or computer hardware for storing this data, using them, or providing them with use in another way. The database may reside on the same hardware as the process for storing or using the information stored in the database, or the database may reside on separate hardware such as a dedicated server or multiple servers.

[0040] In the context of the present description, the expression "information" includes information of any kind or type that can be stored in a database. Thus, information includes audiovisual works (images, films, sound recordings, presentations, etc.), data (location data, numerical data, etc.), text (opinions, comments, questions, messages, etc.). .d.), but not limited to documents, spreadsheets, etc.

[0041] In the context of the present description, the term "computer usable storage medium" means media of any kind and form, including RAM, ROM, disks (CD-ROMs, DVDs, floppy disks, hard disks, etc.), USB -drives, solid state drives, tape drives, etc.

[0042] In the context of the present description, unless explicitly indicated otherwise, the information element itself can be an indication of an information element, as well as a pointer, link, hyperlink, or other indirect means by which the recipient of data can find a place in the network, memory , database, or other machine-readable storage medium from which the information element can be retrieved. For example, a reference to a document may include the document itself (i.e., its contents), or the reference may be a unique document descriptor pointing to a file on a specific file system, or some other means to indicate a network location to the recipient of the data. , a memory address, a table in a database, or another location where the file can be accessed. It should be apparent to one skilled in the art that the level of detail required for such an indication depends on the amount of prior clarification regarding the interpretation of the information exchanged between the sender and recipient of the data. For example, if it is known before the communication between the sender and the recipient that the reference to the information element is the database key for the element in a certain table of the predefined database containing this information element, then in order to efficiently transmit this information element to the recipient, it is enough to send the database key data, even if the information element itself is not transmitted between the sender and receiver of the data.

[0043] In the context of the present description, the numerals "first", "second", "third", etc. are used only to indicate the difference between the nouns they refer to, but not to describe any specific relationship between these nouns. For example, it should be clear that the use of the terms "first server" and "third server" does not imply any particular order, type, chronology, hierarchy, or classification of, in this case, servers, and that their use (by itself) does not imply a "second server" in every situation. In addition, as occurs herein in another context, reference to a "first" element and a "second" element does not exclude that the two elements may in fact be the same element. Thus, for example, in some cases the "first" server and the "second" server may be the same software and/or hardware, and in other cases they may be different software and/or hardware.

[0044] Each embodiment of the present technology relates to at least one of the above goals and/or aspects, but not necessarily all of them. It should be understood that some aspects of the present technology, associated with an attempt to achieve the above goal, may not meet this goal and/or may meet other goals not explicitly mentioned here.

[0045] Additional and/or alternative features, aspects, and advantages of embodiments of the present technology are contained in the following description, in the accompanying drawings, and in the claims.

Brief description of the drawings

[0046] The following description is provided for a better understanding of the present technology, as well as other aspects and their features, and should be used in conjunction with the attached drawings.

[0047] FIG. 1 shows elements and features of a computing device according to embodiments of the present technology.

[0048] FIG. 2 is a diagram of a system implemented in accordance with non-limiting embodiments of the present technology.

[0049] FIG. 3 is a diagram of a typical communication between users and a search server according to embodiments of the present technology.

[0050] FIG. 4 is a diagram of abnormal communication between users and a search server according to embodiments of the present technology.

[0051] FIG. 5 and 6 is a flow diagram of a method for determining web hosts with abnormal website visits performed in the FIG. 2 system according to some non-limiting embodiments of the present technology.

[0052] In FIG. 7 shows a web search history according to embodiments of the present technology.

[0053] FIG. 8 is a graph of the web search history shown in FIG. 7 according to embodiments of the present technology.

[0054] FIG. 9 shows the graph shown in Fig. 8 after filtering according to embodiments of the present technology.

[0055] FIG. 10 shows clusters formed using the graph shown in FIG. 9 according to embodiments of the present technology.

Implementation of the invention

[0056] The examples and conventions provided herein are intended to provide a better understanding of the principles of the present technology, and not to limit its scope to such specifically given examples and terms. It is obvious that specialists in the art are able to develop various methods and devices that are not explicitly described or shown, but implement the principles of the present technology within its essence and scope.

[0057] In addition, to facilitate a better understanding, the following description may contain simplified implementations of the present technology. Those skilled in the art will appreciate that various embodiments of the present technology can be significantly more complex.

[0058] In some cases, useful examples of modifications to the present technology are also provided. They contribute to understanding, but also do not define the scope or boundaries of the present technology. The presented list of modifications is not exhaustive and a person skilled in the art can develop other modifications within the scope of this technology. In addition, if modifications are not described in some cases, this does not mean that they are impossible and / or that the description contains the only possible implementation of one or another element of the present technology.

[0059] Moreover, the description of principles, aspects, and embodiments of the present technology, as well as specific examples thereof, are intended to cover their structural and functional equivalents, whether they are currently known or will be developed in the future. For example, it should be apparent to those skilled in the art that any block diagrams described herein correspond to conceptual representations of illustrative circuit diagrams that implement the principles of the present technology. It should also be obvious that any flowcharts, process diagrams, state transition diagrams, pseudocodes, etc. correspond to various processes that may be represented on a computer-readable physical storage medium and may be performed by a computer or processor, whether such a computer or processor is explicitly shown or not.

[0060] The functions of the various elements shown in the drawings, including any functional unit labeled "processor" or "graphics processing unit", may be implemented using specialized hardware, as well as using hardware capable of executing the corresponding software. If a processor is used, these functions may be performed by a single dedicated processor, a single shared processor, or multiple individual processors, some of which may be shared. In some embodiments of the present technology, the processor may be a general purpose processor such as a central processing unit (CPU) or a specialized processor such as a graphics processing unit (GPU). In addition, explicit use of the term "processor" or "controller" should not be construed as referring solely to the hardware capable of executing the software and may refer to, but is not limited to, digital signal processor (DSP) hardware, network processor, ASIC (ASIC), Field Programmable Gate Array (FPGA), Software ROM, RAM, and NVRAM. Other hardware, general purpose and/or custom, may also be contemplated.

[0061] Software modules, or simply modules that are intended to be implemented in software, may be represented here as any combination of flowchart elements or other elements indicating the steps of a process and/or containing a textual description. Such modules may be implemented in hardware, as shown or implied.

[0062] In the following, in light of the foregoing principles, some non-limiting examples are provided to illustrate various embodiments of aspects of the present technology.

[0063] FIG. 1 depicts a computing device 100 suitable for use with some embodiments of the present technology. Computing device 100 includes various hardware elements including one or more single or multi-core processors collectively represented by processor 110, graphics processor 111, solid state drive 120, RAM 130, display interface 140, and I/O interface 150.

[0064] Communication between various elements of computing device 100 may be via one or more internal and/or external buses 160 (such as a PCI bus, Universal Serial Bus, IEEE 1394 FireWire bus, SCSI bus, Serial-ATA bus, etc. .), to which various hardware elements are connected electronically.

[0065] I/O interface 150 may be connected to touch screen 190 and/or one or more internal and/or external buses 160. Touch screen 190 may be part of a display. In some embodiments, the touch screen 190 is a display. Touch screen 190 may also be referred to as screen 190. In the FIGS. 1 embodiments, the touch screen 190 includes touch hardware 194 (e.g., pressure-sensitive cells embedded in the display screen to detect physical interaction between the user and the display) and a sensor I/O controller 192 that communicates with the display interface 140 and /or one or more internal and/or external buses 160. In some embodiments, the input/output interface 150 may be connected to a keyboard (not shown), mouse (not shown), or touch pad (not shown) that provide user interaction with computing device 100 in addition to or instead of touch screen 190.

[0066] According to embodiments of the present technology, solid state drive 120 stores software instructions suitable for loading into RAM 130 and execution by processor 110 and/or graphics processor 111. The software instructions may, for example, be included in a library or application.

[0067] Computing device 100 may be a server, desktop computer, tablet, smartphone, personal digital assistant, or any device capable of implementing the present technology, as one of skill in the art would understand.

[0068] FIG. 2 depicts system 200 implemented in accordance with non-limiting embodiments of the present technology. System 200 includes a first client device 210, a second client device 215, a third client device 220, and a fourth client device 225 connected to the communication network 205 by respective communication lines 245. The system 200 includes a search engine server 230, an analysis server 235, and an abnormal website visit detection server 240 connected to the communication network 205 by respective communication lines 245 .

[0069] The first client device 210, the second client device 215, the third client device 220, the fourth client device 225, the search engine server 230, the analysis server 235, and/or the anomalous website visit detection server 240 may be the computing devices 100 and/ or comprise elements of computing devices 100. For example, the first client device 210 may be implemented as a smartphone, the second client device 215 may be implemented as a laptop, the third client device 220 may be implemented as a smartphone, the fourth client device 225 may be implemented as a laptop. tablet form. In some non-limiting embodiments of the present technology, communications network 205 may be the Internet. In other embodiments of the present technology, communication network 205 may be implemented differently, such as an arbitrary wide area network, local area network, private network, and so on.

[0070] The implementation of the link 245 is not particularly limited, but depends on the implementation of the first client device 210, the second client device 215, the third client device 220, and the fourth client device 225. By way of non-limiting example, in those embodiments of the present technology where at least one of the client devices, such as the first client device 210, the second client device 215, the third client device 220, and the fourth client device 225, is implemented as a wireless communication device (such as a smartphone), a line 245 may be implemented as a wireless link (such as a 3G network link, a 4G network link, Wireless Fidelity or ^WiFi® for short, ^Bluetooth® , etc.). In those instances where at least one of the client devices, such as first client device 210, second client device 215, third client device 220, and fourth client device 225, is implemented as a laptop, smartphone, or tablet computer, link 245 may be both wireless (such as Wireless Fidelity or WiFi ^® , Bluetooth ^® etc. for short) and wired (such as an Ethernet-based connection).

[0071] It should be obvious that the embodiments of the first client device 210, the second client device 215, the third client device 220, the fourth client device 225, the communication line 245 and the communication network 205 are for illustration only. Other specific implementation details of the first client device 210, second client device 215, third client device 220, fourth client device 225, link 245, and network 205 will be apparent to those skilled in the art. The above examples do not limit the scope of the present technology in any way.

[0072] Although FIG. 2 shows only four client devices 210, 215, 220, and 225, it is contemplated that any number of client devices 210, 215, 220, and 225 may be connected to system 200. It is also contemplated that, in some embodiments, system 200 may be connected to tens or hundreds of thousands of client devices 210, 215, 220 and 225.

[0073] The aforementioned search engine server 230 is also connected to the communication network 205 . The search engine server 230 may be implemented as a conventional computer server. In one embodiment of the present technology, search engine server 230 may be implemented as a Dell™ PowerEdge™ server running a Microsoft™ Windows Server™ operating system. The search engine server 230 may be implemented using any other suitable hardware and/or software and/or firmware, or a combination thereof. In the present non-limiting embodiment of the present technology, the search engine server 230 is a single server. In other non-limiting embodiments of the present technology, the functions of the search engine server 230 may be distributed among multiple servers. In some embodiments of the present technology, the search engine server 230 is controlled and/or administered by a search engine operator. Alternatively, search engine server 230 may be managed and/or administered by a service provider.

[0074] In general, the search engine server 230 (a) performs a search, (b) parses and ranks the search results, (c) aggregates the results, and generates a SERP page to send to an electronic device (such as a first client device 210, a second client device 215, third client device 220 and fourth client device 225).

[0075] The search engine server 230 for performing searches is not subject to any particular restrictions. A number of methods and means are known to those skilled in the art for performing searches using the search engine server 230, so the structural elements of the search engine server 230 are only described in general terms. The search engine server 230 may maintain a search log database 250 .

[0076] In some embodiments of the present technology, the search engine server 230 may perform multiple searches, including but not limited to general search and vertical search.

[0077] As will be known to those skilled in the art, search engine server 230 is capable of performing general web searches. The search engine server 230 is also capable of performing one or more vertical searches such as image vertical search, music vertical search, video vertical search, news vertical search, map vertical search, and so on. As will be known to those skilled in the art, search engine server 230 is also capable of performing a crawler algorithm whereby search engine server 230 crawls the Internet and indexes visited websites in one or more index databases, such as search log database 250.

[0078] The search engine server 230 is capable of generating a ranked list of search results including general web search results and vertical web search results. There are many algorithms for ranking search results that can be implemented by the server 230 of the search engine.

[0079] As a non-limiting example, some well-known methods for ranking search results in terms of the degree of relevance to a search query made by a user are based on some or all of the following criteria: (a) the popularity of a given search query or corresponding answer when performing searches, ( b) the number of results provided, (c) the presence of defining terms (such as "images", "movies", "weather", etc.) in the query, (d) the frequency of other users using this search query with defining terms, ( e) the frequency with which other users performing similar searches select a particular resource or particular vertical search results when presenting results using the SERP page. The search engine server 230 may calculate and assign a relevancy score (based on the various criteria presented above) for each search result obtained from a search query made by the user, and also generate a SERP page where the search results are ranked according to their relevance scores. In this embodiment, the search engine server 230 may execute a plurality of machine learning algorithms to rank documents and/or generate features to rank documents.

[0080] The search engine server typically maintains a search log database 250 . In general, search log base 250 may maintain an index 255, query log 260, and user activity log 265.

[0081] The index 255 is for indexing documents such as web pages, images, PDF files, Word™ documents, PowerPoint™ documents viewed (or discovered) by the search engine server 230 crawler. When a user of the first client device 210, the second client device 215, the third client device 220, or the fourth client device 225 enters a query and performs a search on the search engine server 230, the search engine server 230 parses the index 255 and retrieves documents containing the query terms, and then ranks them according to the ranking algorithm.

[0082] The query log 260 is for recording searches performed using the search engine server 230 . Specifically, the query log 260 stores search query terms (ie, search words) and their corresponding search results. It should be noted that the query log 260 may be maintained in an anonymized form, and search queries cannot be associated with the users who submitted those search queries.

[0083] In particular, the query log 260 may contain a list of queries with terms, with information about the documents listed by the search engine server 230 in the list in response to the query, and with a timestamp, and it may also contain a list of users identified using anonymous identifiers (or no identifiers at all), and the relevant documents selected by them after sending the request. In some embodiments, the query log 260 may be updated each time a new search is performed on the search engine server 230. In other embodiments, the query log 260 may be updated at predetermined times. In some embodiments of the invention, there may be multiple copies of the query log 260, each corresponding to the query log 260 at different points in time.

[0084] The user activity log 265 may be associated with the request log 260 and contain user activity parameters tracked by the analysis server 235 after the user has submitted a request and selected one or more documents on the SERP page on the search engine server 230. In a non-limiting example, the user activity log 265 may contain a link to a document that can be identified using an identification number or a Uniform Resource Locator (URL) and a list of requests, each associated with a plurality of user activity parameters, as described in more detail below. In general, many user activity parameters can be tracked and combined by the analysis server 235 and, in some embodiments of the invention, they can be captured for each individual user.

[0085] Non-limiting examples of user activities tracked using the user activity log 265 include (but are not limited to) the following:

- success/failure: whether or not a document was selected from the response to the search query;

- residence time: the time spent by the user on the document before returning to the SERP page;

- long/short click: whether the user's action on the document was long or short compared to the user's action on other documents on the SERP page.

[0086] Of course, the above list is not exhaustive and that it may include other types of user actions without departing from the boundaries of the present technology. In some embodiments, analysis server 235 may combine user activity data (which in a non-limiting example may include user activity for each hour) and generate user activity for storage in user activity log 265 in a format suitable for implementing the present technology. (which, in a non-limiting example, could be user activities for a predetermined time period of 3 months). In other embodiments of the invention, user activity log 265 may store raw user activity data so that it can be retrieved and aggregated by search engine server 230 and/or analysis server 235 and/or anomalous website visit detection server 240 and/or or another server (not shown) in a format suitable for implementing the present technology.

[0087] In some embodiments, the request log 260 and user activity log 265 may be implemented as a single log. The information stored in the request log 260 and in the user activity log 265, implemented as a single log or multiple logs, forms a web search history 270 .

[0088] The aforementioned analysis server 235 is also connected to the communication network 205 . The analysis server 235 may be implemented as a conventional computer server. In one embodiment of the present technology, the analysis server 235 may be implemented as a Dell™ PowerEdge™ server running a Microsoft™ Windows Server™ operating system. Obviously, the analysis server 235 may be implemented using any other suitable hardware and/or application software and/or firmware, or a combination thereof. In the present non-limiting embodiment of the present technology, the analysis server 235 is a single server. In other non-limiting embodiments of the present technology, the functions of the analysis server 235 may be distributed among multiple servers. In other embodiments of the invention, the functions of the analysis server 235 may be wholly or partially performed by the server 230 of the search engine. In some embodiments of the present technology, the analysis server 235 is controlled and/or administered by a search engine operator. Alternatively, the analysis server 235 may be managed and/or administered by another service provider.

[0089] In general, the analysis server 235 is designed to track user actions with search results provided by the search engine server 230 in response to user requests (for example, made by users of the first client device 210, the second client device 215, the third client device 220, or the fourth client device 225 ), based on the data stored in the user activity log 265 .

[0090] Non-limiting examples of user action parameters generated by the analysis server 235 include (but are not limited to) the following:

- coefficient of "clicks" (CTR, Click-Through Rate): the ratio of the number of cases of selecting an element to the number of impressions (demonstrations) of the element;

- session duration: average session duration in seconds;

- logarithmic duration of the session: the average logarithmic value of the duration of the session;

- requests: the number of requests sent by the user;

- "clicks": the number of transitions made by the user;

- the number of "clicks" per request: the average number of clicks per request for the user;

- daily active users (DAU, Daily Active Users): the number of unique users interacting with the service during the day;

- average number of sessions per day per user (S/U): u S(u) |u|, where S(u) - number of user u sessions per day, |u| - the total number of users for this day;

- average number of unique requests per session (UQ/S): s UQ(s) |s|, where UQ(s) - number of unique requests in session s, |s| - the total number of sessions for this day;

- average session length per user (SL/U): the total number of requests per session, averaged over each user;

- percentage of navigation requests per user (%-Nav-Q/U): navigation positions: if more than n % of all navigation requests for a request are concentrated on the first three URLs, this request is considered navigational. Otherwise, it is treated as informational. The value of n can be set to 80;

- average query length per user (QL/U): the number of words in a user query;

- average success rate per user (QSuccess/U): a user request is considered successful if the user selects one or more results and stays on any of them for more than 30 seconds;

- average interval between requests per user (QI/U): the average time interval between two consecutive user requests during a user session;

- residence time: the time spent by the user on the document before returning to the SERP page.

[0091] Of course, the above list is not exhaustive and may include parameters for the actions of other types of users without going beyond the boundaries of the present technology.

[0092] The analysis server 235 may send the tracked user activity parameters to the search engine server 230 for storage in the user activity log 265 . In some embodiments, the analysis server 235 may store user activity parameters and related search results locally in a user activity log (not shown). In other non-limiting embodiments of the present technology, the functions of the analysis server 235 and the search engine server 230 may be performed by a single server.

[0093] The aforementioned abnormal website visit detection server 240 is also connected to the communication network 205 . The anomalous website visit detection server 240 may be implemented as a conventional computer server. In one embodiment of the present technology, the anomalous website visit detection server 240 may be implemented as a Dell™ PowerEdge™ server running a Microsoft™ Windows Server™ operating system. Obviously, the web site visit detection server 240 may be implemented using any other suitable hardware and/or application software and/or firmware, or a combination thereof. In the present non-limiting embodiment of the present technology, the abnormal website visit detection server 240 is a single server. In other non-limiting embodiments of the present technology, the functions of the anomalous website visit detection server 240 may be distributed among multiple servers. In the context of the present technology, the methods and system described herein may be implemented in part on a server 240 for detecting abnormal website visits. In some embodiments of the present technology, the web site visit detection server 240 is managed and/or administered by a search engine operator. Alternatively, the web site visit detection server 240 may be managed and/or administered by another service provider.

[0094] In general, the abnormal website visit detection server 240 is designed to detect abnormal website visits. As described in more detail below, the abnormal website visit detection server 240 may, for example, analyze the web search history 270 (stored in the request log 260 and/or in the user activity log 265) to determine requests and/or visits to websites. that have been influenced by a malicious actor.

[0095] FIG. 3 is a diagram of a typical communication between users and a search engine server 230. As described above, the search engine server 230 generates a SERP page in response to a query received from a user. The SERP page may be influenced by previous user behavior, such as data stored in web history 270 .

[0096] As shown in FIG. 3, the user 310 sends a request by transmitting 341 to the search engine server 230. The search engine server 230 then delivers the SERP page by transmitting 342 to the user 310. As described above, the search engine server 230 stores various information about the interaction between the user 310 and the search engine server 230, such as the web hosts on the SERP page previously selected by the user 310.

[0097] The user 320 then sends the same request as the user 310 by passing 343 to the search engine server 230. Upon receipt of the request, the search engine server 230 sends the SERP page to the user 320 by transmitting 344. The SERP page sent to the user 320 may be influenced by the previous actions of the user 310. For example, the rank of the last web host selected by the user 310 may be promoted on the SERP page, sent to user 320. It is assumed that the last web host selected by user 310 was considered by user 310 as the most relevant web host on the SERP page.

[0098] User 330 then sends the same request as users 310 and 320 to search engine server 230 by sending 345. In response to the request, search engine server 230 generates and delivers a SERP page to user 330 by sending 346. user 330 may be influenced by the behavior of users 310 and 320. Thus, search engine server 230 may continuously refine the rank of search results based on recorded user behavior. User behavior can be analyzed to determine the web hosts on the SERP page that were viewed as the most relevant by users. These web hosts can then be given a higher rank on future SERP pages, improving user satisfaction as the most relevant results are presented to high-ranking users on SERP pages.

[0099] FIG. 3 is a diagram of the natural search behavior. In FIG. 4 shows how an unscrupulous actor can influence the SERP pages provided by the search engine server 230. In the anomalous communication diagram shown in FIG. 4, the search falsification server 450 influences the behavior of users 410 and 420. The search falsification server 450 may provide instructions to users 410 and 420. The instructions may indicate which search queries should be entered and which search results should be selected on the SERP pages. Users 410 and 420 may be rewarded for following instructions issued by the search falsification server 450.

[00100] The user 410 sends a request according to the indications of the search falsification server 450 to the search engine server 230 by transmission 441. In response to this request, the search engine server 230 sends the SERP page to the user 410 by transmission 442. The user 410 then, based on the indications of the falsification server 450 search engine visits one or more web hosts by selecting links on the SERP page. Thus, the search falsification server 450 influences the web search history 270 by providing instructions on the behavior of the user 410. The website visits made by the user 410 are referred to here as anomalous website visits. Unlike natural human behavior, such anomalous website visits are made according to the instructions of an unscrupulous actor, i.e. server 450 falsifying search results in this case.

[00101] User 420 sends the same request as user 410 to search engine server 230 by sending 443. Search engine server 230 responds to the request by sending the SERP page to user 420 by sending 444. The ranking on the SERP page sent to user 420 may influence the behavior of the user 410, depending on the server 450 falsification of search results. Like user 410, user 420 interacts with the SERP page as instructed by the search falsification server 450. The search falsification server 450 may prompt the user 420 to select a web host whose owner has paid the person operating the search falsification server 450 to increase the rank of the search result for that web host.

[00102] The user 430, not instructed by the search falsification server 450, sends the same request as the users 410 and 420 to the search engine server 230 by transmission 445. The search engine server 230 then sends the SERP page to the user 430 by transmission 446. The SERP page sent to user 430 is affected by the previous behavior of users 410 and 420. The web host that users 410 and 420 have chosen according to the instructions of the search falsification server 450 has a higher rank in the SERP page provided to user 430 due to abnormal web visits. sites by users 410 and 420. By controlling the behavior of users 410 and 420, the search fraud server 450 has influenced the SERP page obtained by the user 430. The user 430 is now more likely to select the web host promoted by the search fraud server 450 because this web host the host has a higher rank on the page SERP obtained by user 430. Method 500, described in more detail below and in FIG. 5 is designed to analyze web browsing history in order to detect abnormal user behavior, such as the behavior of users 410 and 420.

[00103] Method (non-limiting embodiment)

[00104] FIG. 5 and 6 is a flow diagram of a method 500 implemented in accordance with non-limiting embodiments of the present technology.

[00105] Step 505: Get web history.

[00106] Method 500 begins at step 505. Data describing previous requests and user actions, such as web history 270, may be obtained there. The web search history may be stored in a query log 260, a user activity log 265, and/or other stores of recorded data. In FIG. 7, described in more detail below, is an example of a retrieved web history. The web history may contain user identifiers (UID, User Identifier), requests sent by each user, and web hosts selected by users after receiving SERP pages in response to their requests.

[00107] Web search history 270 may be obtained from one or more databases. For example, as described in FIG. 2, web search history 270 may be obtained from a search log database 250 that may be maintained by search engine server 230. The retrieved web history may correspond to the specified time window. For example, a web search history 270 for the previous six months may be obtained. The retrieved web history 270 may correspond to a specified location or region. For example, a web history corresponding to North America may be obtained. One or more database queries can be used to retrieve the web history. The request may specify a time period, region, and/or other filters to be applied to the web search history.

[00108] Step 510: generating a web search history graph.

[00109] Upon receipt of the web search history 270, at step 510, a graph may be generated. In FIG. 8, described in more detail below, is an example of a web search history graph. Each web host in the web search history 270 may be included in the graph as a vertex. A threshold number of visits can be used to filter the web hosts included in the graph. For example, web hosts with fewer than 500 unique visitors may not be included as nodes in the graph. A graph can contain edges, each of which connects two vertices. An edge can connect two vertices visited by a user with the same UID. For example, if the web history indicates that the user visited the websites engadget.com and gizmodo.com, then the edge connecting these two vertices should be included in the graph.

[00110] Although a graph is described here, it should be understood that other data structures can be used to parse web search history. For each web host in the web history, a list of other web hosts visited by users with the same UIDs as the users who visited that web host can be generated.

[00111] Step 515: Assign an edge weight to each edge in the graph.

[00112] Each edge in the graph generated in step 510 can be assigned an edge weight in step 515. The weight of an edge can indicate the number of UIDs of users who visited both web hosts connected by this edge. For example, if 50 users have visited both hosts connected by this edge, the weight of this edge may be assigned a value of 50. The weight of an edge may be assigned based on the number of matching search queries entered by users visiting both hosts connected by this edge. For example, if two users with UIDs enter the same search query and then select both web hosts in the SERP page generated in response to that query, then the weight of the edge connecting the two web hosts can be increased.

[00113] The weight of an edge with a larger value indicates that both web hosts connected by this edge had more of the same visitors. Related web hosts, such as web hosts with similar topics, should have large edge weights connecting them. It is generally assumed that users visit several thematically related web hosts. For example, the web hosts newyorker.com and nytimes.com are likely to have relatively high edge weights connecting them, since both websites are related to New York City and news.

[00114] Step 520: Get a topic for each vertex in the graph.

[00115] In step 520, for each vertex in the graph, one or more topics can be obtained and/or determined. The MLA algorithm can be used to determine one or more topics for each vertex in the graph. The MLA algorithm may be trained to determine one or more topics based on information relevant to the web host, such as metadata, page content, and/or other information. The trained MLA algorithm may be fed with the web host address, metadata, page content, and/or other information relevant to the web host. The MLA algorithm can produce one or more topics. The MLA algorithm can be a natural language processing (NLP, Natural Language Processing) model, such as a model based on latent semantic analysis (LSA, Latent Semantic Analysis), probabilistic latent semantic analysis (pLSA, Probabilistic Latent Semantic Analysis), Word2vec model , the global vectors algorithm for word representation (GloVe, Global Vectors for Word Representation) or Latent Dirichlet Allocation (LDA).

[00116] To obtain topics, a topic database (not shown) can be queried. The theme database may be managed by the search engine server 230 . The web host corresponding to the vertex can be reported to the topic database in the request, and the topic database can provide one or more topics corresponding to this web host.

[00117] Topics may be determined based on web host content, web host metadata, web search history 270, and/or other data related to the web host. Themes can indicate the content of the content displayed by the web host. It should be understood that topics can be retrieved from a database and/or generated in real time.

[00118] Step 525: Remove edges between vertices with related topics.

[00119] In step 525, edges connecting two web hosts with the same or similar topics may be removed from the graph. All edges in the graph connecting pairs of web hosts with the same or similar topics can be removed. For example, if the Word2vec model is used to define topics, then a vector can be defined for each of the web hosts. For vectors, the proximity of the cosines of their angles can be determined. If the cosine proximity satisfies a threshold cosine distance, such as a predetermined threshold cosine distance, then the topics may be considered close. Edges defined as having the same or similar topics correspond to web hosts with a natural connection. After these edges are removed, any remaining edges in the graph connect pairs of web hosts that are not naturally connected. In FIG. 9, described in more detail below, shows the graph after removing the edges connecting two vertices with related topics.

[00120] In step 510, instead of a graph for each web host in the web history, lists of other web hosts visited by users with the same UIDs can be generated. If lists of other web hosts have been generated, at step 525, other web hosts from the list that have a topic associated with this web host can be removed.

[00121] Step 530: Clustering vertices based on edge weights.

[00122] In step 530, clustering of vertices in the graph may be performed. Clustering can be done based on edges and edge weights. Any clustering algorithm may be used, such as a k-tree spanning tree algorithm, a minimum spanning tree algorithm, a common nearest neighbors algorithm, and/or any other suitable clustering algorithm. In FIG. 10, described in more detail below, is an example of clusters formed from a graph.

[00123] In some cases, vertices may be included in only one cluster. In other cases, vertices may be included in several clusters. Some of the vertices may not be clustered with other vertices. For example, if all edges for a certain vertex were removed in step 525, then that vertex may not be included in any of the clusters. Vertices that are not clustered may not be taken into account in further analysis.

[00124] Step 535: Get user activity data.

[00125] In step 535, user activity data may be obtained. The resulting user activity data may correspond to the web hosts in the cluster. The user activity data can be filtered to narrow down the resulting user activity data to the data corresponding to the web hosts in the cluster. Queries can be used to obtain user activity data corresponding to web hosts in the cluster.

[00126] User activity data may describe user behavior corresponding to web hosts in a cluster. User activity data may include data from request log 260 and user activity log 265, web browser captured data, web script captured data such as cookies, and/or other data describing user interactions with web hosts. User activity data may indicate web hosts visited by users, actions taken by users while visiting web hosts, the order in which users navigated to web hosts, and/or other web browsing history data.

[00127] The resulting user activity data may be limited to a specific period of time, for example, it may be user activity data recorded over the past six months. The resulting user activity data may be limited to a geographic region, for example, it may be user activity data corresponding to users in China.

[00128] Step 540: Selecting the first cluster.

[00129] In step 540, the first vertex cluster is selected. In this case, any of the clusters can be selected. Random selection, ordered selection, or any other suitable selection method may be used. For example, the largest cluster may be selected first.

[00130] Step 545: determining associated hosts in the selected cluster.

[00131] At step 545, the user activity data may be analyzed to determine if the hosts in the cluster are connected. Although hosts in a cluster may not have associated topics, user activity data may indicate that the corresponding group of users visited web hosts in that cluster. If the user activity data indicates that the web hosts in a cluster are related, visits to the web hosts in that cluster are considered regular website visits.

[00132] To determine if the websites are related based on user activity data, this user activity data can be analyzed to determine if the corresponding user group has visited web hosts in that cluster. For example, many users who are interested in golf may also be interested in boating. At 530, a cluster could be formed containing golf-related web hosts and boating-related web hosts. Although golf-related web hosts and boating-related web hosts are not related thematically, user activity data may indicate that a significant proportion of users browsing golf-related web hosts are browsing and web hosts related to boating. In this case, the cluster can be determined as connected based on user activity data.

[00133] The user activity data analyzed in step 545 may be a dataset describing the activities of thousands of users, hundreds of thousands of users, and so on. The size of the data set can be chosen such that abnormal website visits make up a relatively small portion of the user activity data, eg, less than five percent of the user activity data.

[00134] Step 550: Deleting a cluster with associated web hosts.

[00135] If at step 545 it was determined that the cluster contains web hosts associated based on user activity data, then at step 550 this cluster can be deleted. If the web hosts in a cluster are linked based on user activity data, then the web traffic distributed between these web hosts is assumed to be consistent with natural user activity and not anomalous website visits. If the traffic that forms the cluster is considered natural, then the web hosts in that cluster are not associated with abnormal website visits. Such a cluster may no longer be considered and/or an indication may be maintained that the cluster is not associated with abnormal website visits.

[00136] At step 550, such a cluster may be completely or partially removed. For example, a web host with no anomalous website visits may be in a cluster with other web hosts with anomalous website visits. If it is determined that a web host does not have abnormal website visits, that web host can be separated from the rest of the cluster. It is also possible that after implementing a system for detecting abnormal website visits, a web host may be subject to abnormal website visits in order to lower that web host's rank on the SERP page. If such a situation is expected, then the web host can be removed from the cluster so that abnormal website visits do not lead to a decrease in the rank of this web host.

[00137] Step 555: Determine if there are remaining clusters for analysis.

[00138] After deleting the cluster in step 550, or if the web hosts in the cluster were not determined in step 545 to be related based on user activity data, it is determined in step 555 if there are still vertex clusters to analyze. If all vertex clusters have been parsed at step 545, the method proceeds to step 610, described below. If there is another cluster to analyze, method 500 proceeds to step 560

[00139] Step 560: Selecting the next cluster for analysis.

[00140] In step 560, the next vertex cluster is selected for analysis. As in step 540, the vertex clusters may be selected in any order. The selected next vertex cluster is a vertex cluster not yet analyzed in step 545. After selecting the next cluster, method 500 proceeds to step 545, which determines if the web hosts in the next cluster are connected.

[00141] Step 610: Store an abnormal website visit indicator for web hosts in the remaining clusters.

[00142] After the clusters associated based on user activity data are removed in step 550, the remaining clusters are considered clusters of web hosts with abnormal website visits. The web hosts in the remaining clusters are filtered twice, first at steps 520 and 525 by determining the web hosts' natural association due to having similar topics, and then by determining the web host association based on user activity data. The visits to the web hosts filtered and remaining at step 610 are likely to have been influenced by an external source, such as the search falsification server 540 . Users could be paid to visit web hosts in the remaining clusters. Various actions can be taken to counter these anomalous website visits, such as those described in steps 610, 620, and 630.

[00143] At 610, an indicator may be stored for each web host in the remaining clusters. Web hosts may be flagged as web hosts with abnormal website visits. Indicators may be stored in a database such as index 225. UIDs associated with abnormal website visits may be determined, for each of which an indicator may be stored indicating that the UID is associated with abnormal web visits. -sites.

[00144] Step 620: Decrease the rank of web host search results in the remaining clusters.

[00145] Because the web hosts in the remaining clusters have abnormal website visits, they may rank higher on the SERP pages than if they had no abnormal website visits. To correct for this, at step 610, web hosts from the remaining clusters may be lowered in the SERP pages, or these web hosts may not be included in the SERP pages at all.

[00146] When generating the SERP page, the features stored in step 610 can be used to determine if the web host has abnormal website visits. If a web host is determined to have abnormal website visits, that web host may be downgraded on the SERP page or that web host may be removed from the SERP page.

[00147] Step 630: Delete web history data for web hosts in the remaining clusters.

[00148] In step 630, web browsing history data and/or user activity data corresponding to abnormal website visits may be deleted. To counteract the impact of anomalous website visits on search results, activities associated with anomalous website visits can be removed from all logs. Alternatively, the activities may not be removed, but marked as anomalous activities. By removing activities associated with abnormal website visits, results can be generated for SERP pages that are not affected by abnormal website visits. UIDs associated with anomalous website visits can be identified and all activities associated with those UIDs can be removed from the logs. Method 500 may then be completed at step 640.

[00149] FIG. 7-10 show a non-limiting example of the application of method 500. FIG. 7 shows an example web search history 700. Web history 700 is an example of a web history that can be obtained at step 505 of method 500. In web history 700, each entry contains a UID corresponding to the user who entered the search query, the query entered by that user, and web hosts. selected by the user on the SERP page. It should be understood that web search history 700 is only an example and that, as described above with respect to query log 260, other information may be included in web search history 700.

[00150] As described above with respect to method 500, a graph may be generated based on a web search history. In FIG. 8 shows a graph 800 generated using the web search history 700 shown in FIG. 7. Each web host in the web search history 700 represents a vertex in graph 800. The edges connecting the vertices indicate two web hosts visited by the same user. For example, as shown in web history 700, the websites Newyorkbookranks.com and Freedoghairadvice.com were visited by user UID 855921. Because the two web hosts were visited by the same user, they are connected by an edge in graph 800.

[00151] As described in steps 520 and 525 of method 500, edges between web hosts having related topics can be removed. In FIG. 9 shows a filtered graph 900, which is a graph 800 with edges removed connecting vertices with related topics. For example, in graph 800, the hosts Booklist.com and Constructionbooks.com are connected by an edge. Both of these web hosts are related to the theme of "book". Since these hosts have related topics, the edge connecting these hosts has been removed in column 900.

[00152] As described in step 530 of method 500, vertices may be grouped based on edge weight to form vertex clusters. In FIG. 10 shows clusters formed from graph 900. Three clusters are formed from graph 900: 1010, 1020, and 1030. Some of the vertices of graph 900, such as the vertex corresponding to the Constructionbooks.com web host, are not included in any of the clusters 1010 , 1020, and 1030 because those vertices have no edges remaining in graph 900.

[00153] As described in steps 535-560 of method 500, clusters may be filtered based on user activity data. For example, cluster 1030 may be filtered based on user activity data. In the example shown, the Mealreplacement.org and Workoutadvice.com web hosts are not thematically related. However, user activity data may indicate that users who visit the Workoutadvice.com web host also frequently visit the Mealreplacement.org web host. Therefore, these web hosts are connected based on user activity data. Cluster 1030 may be removed as user activities associated with these web hosts can be considered normal activities. The remaining clusters 1010 and 1020 may contain web hosts with abnormal website visits. As described in steps 610-630 of method 500, various steps can be taken to counter abnormal visits to these hosts' websites, such as lowering the rank of search results.

[00154] As shown in FIG. 7-10, two-level filtering is performed on the web search history. First, the edges connecting thematically related web hosts can be removed. User activity data can then be used to filter out clusters formed from web hosts associated based on user activity. Performing first-level filtering, which removes edges connecting thematically related vertices, may require less computation than performing second-level filtering, which removes clusters that are related based on user activity data.

[00155] Although the embodiments described above are given with reference to specific steps performed in a certain order, it should be understood that these steps can be combined, separated, or that their order can be changed without departing from the boundaries of the present technology. At least some of these steps may be performed in parallel or sequentially. Accordingly, the order and grouping of steps is not limiting to the present technology.

[00156] It is obvious that not all of the technical effects mentioned in this description should be present in every embodiment of the present technology. For example, there may be embodiments of the present technology where the user does not receive some of these technical effects, or other implementations where the user receives other technical effects or there is no technical effect.

[00157] Some of the steps and transmitted or received signals are well known in the art and are therefore omitted in some parts of the description for simplicity. Signals may be transmitted or received using optical means (such as a fiber optic connection), electronic means (such as a wired or wireless connection), and mechanical means (such as based on pressure, temperature, or any other suitable physical parameter).

[00158] For a person skilled in the art, possible changes and improvements to the above-described embodiments of the present technology may be obvious. The foregoing description is for illustrative purposes only and is not intended to limit the scope of the invention. The scope of protection of this technology is determined solely by the scope of the appended claims.

Claims (66)

1. A method for correcting the operation of a search engine by identifying web hosts with abnormal visits to websites in a search engine, which is performed on a server and includes: - obtaining on the server the web search history for a plurality of users via a communication network based on search queries from a plurality of client devices; - generation by the server of a web history graph in which each vertex represents a web host from the web search history, the vertices being connected to other vertices by edges, each having an edge weight determined based on the number of users visiting both hosts connected by this edge; - clustering by means of a graph vertex server based on edge weights and forming a plurality of vertex clusters; - receiving on the server data about the actions of users corresponding to these vertex clusters and associated with a set of users who visited web hosts associated with these vertex clusters; - determination by the server for each cluster of vertices of the associated web hosts in this cluster based on data about user actions; - removal by the server from the graph of each vertex cluster containing web hosts associated based on user activity data; and - storing by the server, for each web host associated with the cluster remaining in the graph, an indicator that this web host is associated with abnormal website visits. 2. The method according to claim 1, characterized in that before clustering the vertices of the graph, it additionally includes: - definition for each vertex of the graph of one or more topics corresponding to this vertex; and - removal from the graph of edges connecting two vertices with related topics. 3. The method of claim 2, wherein determining one or more topics for each vertex of the graph includes querying a database of topics associated with the web host corresponding to that vertex. 4. The method according to p. 1, characterized in that it additionally includes: - receiving a search query; - generating, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and - a decrease in the web host rank on the search engine results page associated with abnormal website visits. 5. The method according to p. 1, characterized in that it additionally includes: - receiving a search query; - generating, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and - removal from the search engine results page of a web host associated with abnormal website visits. 6. The method of claim. 1, characterized in that it further includes deleting from the web search history data corresponding to web hosts associated with abnormal website visits. 7. The method according to p. 1, characterized in that it additionally includes: - determining a set of user identifiers corresponding to abnormal website visits; and - maintaining for each of them an indicator that this user ID is associated with abnormal website visits. 8. The method according to claim 1, characterized in that the user activity data contains a web search history. 9. The method according to claim 1, characterized in that the data on user actions contains data on the use of a web browser. 10. The method according to claim 1, characterized in that the user activity data contains web scenario data. 11. The method of claim 1, further comprising determining a weight for each edge based on the number of matching searches entered by users who have visited both hosts connected by that edge. 12. A system for correcting the operation of a search engine by determining web hosts with abnormal visits to websites, containing a processor and a machine-readable physical storage medium containing commands, while the processor is configured to perform the following actions when executing commands: - obtaining a web search history for a plurality of users via a communication network based on search queries from a plurality of client devices; - forming a web history graph, in which each vertex represents a web host from the web search history, with vertices connected to other vertices by edges, each of which has an edge weight determined based on the number of users visiting both hosts connected this edge; - clustering of graph vertices based on edge weights and formation of a set of vertex clusters; - obtaining by means of the communication network data about the actions of users corresponding to these vertex clusters and associated with a plurality of users who have visited web hosts associated with these vertex clusters; - determination for each cluster of vertices of associated web hosts in this cluster based on user activity data; - removal from the graph of each vertex cluster containing web hosts connected based on user activity data; and - storing for each web host associated with the cluster remaining in the graph, an indicator that this web host is associated with abnormal website visits. 13. The system according to claim 12, characterized in that the processor is additionally configured to perform the following actions when executing commands: - definition for each vertex of the graph of one or more topics corresponding to this vertex; and - removal from the graph of edges connecting two vertices with related topics. 14. The system according to claim 12, characterized in that the processor is additionally configured to perform the following actions when executing commands: - receiving a search query; - generating, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and - a decrease in the web host rank on the search engine results page associated with abnormal website visits. 15. The system according to claim 12, characterized in that the processor is additionally configured to perform the following actions when executing commands: - receiving a search query; - generating, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and - removal from the search engine results page of a web host associated with abnormal website visits. 16. The system according to claim 12, characterized in that the processor is additionally configured to perform the following action when executing commands: deleting from the web search history data corresponding to web hosts associated with abnormal website visits. 17. The system according to claim 12, characterized in that the processor is additionally configured to perform the following actions when executing commands: - determining a set of user identifiers corresponding to abnormal website visits, and - storing for each of them an indication that this user ID is associated with abnormal visits to websites. 18. The system according to claim 12, characterized in that the processor is further configured to perform the following action when executing instructions: determining the weight of an edge based on the number of matching requests entered by users who visited both web hosts connected by this edge. 19. A method for correcting the operation of a search engine by identifying web hosts with abnormal visits to websites, performed on a server and including: - obtaining on the server the history of web searches for a plurality of users via a communication network based on search queries from a plurality of client devices; - for each web host from the search history: - determining by the server, based on the web search history, a list of other web hosts visited by users who visited this web host; and - removal by the server of other web hosts having a natural connection with this web host from the list of other web hosts; - clustering by means of a server of naturally unrelated web hosts and the formation of a plurality of vertex clusters based on lists of other web hosts; - receiving on the server through the communication network data about the actions of users corresponding to these vertex clusters and associated with a plurality of users who visited web hosts associated with these vertex clusters; - removal by the server of clusters containing web hosts associated with each other based on user activity data; and - storing by the server for each web host associated with the remaining clusters, an indicator that this web host is associated with abnormal website visits. 20. The method of claim. 19, characterized in that the removal of other web hosts that have a natural connection with this web host, includes performing for each other web host from the list of other web hosts, comparing one or more topics corresponding to this web host, with one or more themes corresponding to another web host. 21. The method according to claim 19, characterized in that it further includes: - receiving a search query; - generating, based on this search query, a search engine results page with a ranked set of web hosts corresponding to this search query; and - a decrease in the web host rank on the search engine results page associated with abnormal website visits.

Images