RU2786353C1 - System and method for providing content to the user - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to a system and method for providing content to the user based on a category identified on the user’s device using categorization rules. In the claimed solution, a search query and the site name are intercepted in the browser on the user's device; the hash and type of the intercepted search query and the site name are determined and sent to the cloud security server; the popularity counter of the received data are incremented, if the popularity threshold is exceeded, the cloud security server requests the intercepted request and the site name explicitly; the intercepted request and the site name explicitly are transmitted to the cloud security server; the intercepted request and the name of the site are categorized on the cloud security server and the rules for determining the content category and content are transmitted to the user’s device; the category of content on the user’s device is determined using the content category definition rule and the content is displayed to the user.

EFFECT: ensuring the confidentiality of user data due to the possibility of locally determining the category of content for the user without the need for remote storage of this information.

6 cl, 3 dwg

Description

Technical field

The invention relates to solutions for enhancing user anonymity, and more particularly to systems and methods for displaying content to a user based on a content category identified on the user's device using categorization rules.

State of the art

Currently, the variety of computer systems and their use by users for various purposes is growing. Computers and mobile devices have become an integral part of life. Users use various devices to exchange messages by e-mail, communicate in instant messengers and social networks, use devices for online payment and payment using POS-terminals of various goods and services, register on various resources (shop websites, media hosting, public services and other ) for timely receipt of notifications, participation in bonus programs and loyalty programs, for receiving online services.

Each user registration on the mentioned resources requires the transfer of some personal data about the user. Often you need to provide a phone number, email address, username, user age. At the same time, to protect user data, the processing of personal data must comply with the law, for example, in the Russian Federation it is regulated by Federal Law No. 152, in European countries - GDPR (General Data Protection Regulation). Individual states in the US have also enacted laws to regulate the processing of personal data, such as the California Consumer Privacy Act or CCPA.

However, the regulation of the processing of personal data cannot always protect user data from the actions of intruders. There are cases when large companies and well-known online resources leaked users' personal data. For example, the eBay online store leaked data on 145 million user accounts (https://www.cnbc.com/2014/05/22/hackers-raid-ebay-in-historic-breach-access-145 -mln-records.html).

In addition, contextual advertising is currently being developed, while marketing materials are displayed to the user based on his interests. Existing systems and methods provide for the storage of user profiles, formed taking into account the interests of the user. User profiles often contain categories that can be identified by the user's activity on the Internet, for example, when the user uses search tools on various sites and servers to search for information, goods or services.

Thus, US10812604B2 describes a system and method for combining a plurality of Internet access devices with a common user profile to target Internet content or advertising.

Publication US9053497B2 describes a system and method for targeting advertising to groups with strong ties in a social network.

The results of targeting and profiling are stored in the mentioned known inventions in a remote cloud server.

In the event that user profiles are leaked as a result of malicious actions, such categories corresponding to the user can harm the user, as they can reveal information about the user that he himself would not want to be made public. For example, information about the user's health or interests.

The present invention solves the mentioned problem in determining the categories of the user, while the category of the user is determined locally and is not stored in the cloud server. In the event of a data leak from the cloud server, data about the user's interests will not be available to attackers.

The essence of the invention

The present invention is intended to provide content to a user based on a category identified on the user's device using categorization rules.

The technical result of the present invention is the implementation of the claimed purpose.

According to one of the implementation options, a method is provided for providing the requested digital content to the user by determining the category of the provided content on the user's computing device, comprising the steps of: using an interception tool executing using a processor on the user's computing device, the search query and site name are intercepted in the browser and transmitting them to the content provider; using a content providing means executing by means of a processor on the user's computing device, determining the hash and type of the intercepted search query and site name, which are transmitted to the cloud security server; incrementing on the cloud security server the popularity counter of the received data, wherein: if the popularity threshold is exceeded, the cloud security server explicitly requests the intercepted request and the site name; transmitting, using the content provider, the intercepted request and the site name explicitly to the cloud security server; using the cloud security server, categorizing the intercepted request and the site name, and transmitting the content category determination rules and the content to the content providing means; the content providing means determines the content category if the content category determination rule is executed on the user's computing device, and displays the content on the computing device to the user according to the determined category.

According to another particular implementation variant, a method is provided in which categorization is performed by assigning tags to intercepted requests and site names.

According to another particular implementation variant, a method is provided in which the content category determination rule contains at least one logical condition operating on a type (domain, query) and a tag.

According to another particular implementation variant, a system is provided for providing requested digital content by a user on a user's computing device, where the system includes at least a cloud security server and one user's computing device, which contains at least one processor, one memory, one input and output device, wherein: at least one processor of one computing device of the user is configured to: intercept the search query and site name in the browser; determining the hash and type of the intercepted search query and site name; checking the presence in memory and applying the rule for determining the content category for the corresponding hash and type, while in the absence of the necessary rule, it interacts with the cloud security server, during which: it transmits the hash and type of the intercepted search request, receives a request to provide the intercepted request explicitly and the site name according to the transmitted hash and the type of the intercepted search query and the site name, explicitly transmits the intercepted query and the site name, obtains the content category determination rule and the content; providing, by means of the output device, content to a user based on the content category determination rule; wherein the cloud security server is configured to interact with at least one user computing device, during which: receives data from the user computing device in the form of a hash and type of intercepted search query and site name, increments the popularity counter of the received data, while if the threshold popularity exceeded, requests the intercepted request and the site name explicitly from the user's computing device; categorizes the intercepted request and the site name explicitly, generates a rule for determining the content category based on the categorization, transmits the rule for determining the content category and the content to the user's computing device.

In yet another particular embodiment, a system is provided that categorizes by assigning tags to intercepted requests and site names.

According to another particular implementation variant, a system is provided in which a content category determination rule contains at least one logical condition operating on a type (domain, query) and a tag.

Brief description of the drawings

Additional objects, features and advantages of the present invention will become apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

Fig. 1 displays the structure of the system for providing content to the user.

Fig. 2 displays the way the content is presented to the user.

Fig. 3 is an example of a general purpose computer system on which the present invention may be implemented.

Description of embodiments of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The gist of the description is nothing but specific details provided to assist a person skilled in the art in a thorough understanding of the invention, and the present invention is defined only within the scope of the appended claims.

The system means and remote server in the present invention refers to real devices, systems, components, groups of components implemented using hardware, such as integrated circuits (English application-specific integrated circuit, ASIC) or field-programmable gate arrays (English field- programmable gate array, FPGA) or, for example, in the form of a combination of software and hardware, such as a microprocessor system and a set of software instructions, as well as on neuromorphic chips (English neurosynaptic chips). The functionality of these system tools can be implemented exclusively by hardware, as well as in the form of a combination, where part of the functionality of the system tools is implemented by software, and some - by hardware. In some embodiments, some or all of the means may be executed on a general purpose computer processor (eg, as depicted in FIG. 3 ). In this case, the components (each of the means) of the system can be implemented both within the framework of one computing device, and spaced between several interconnected computing devices.

Fig. 1 displays the structure of the system for providing content to the user.

The system for providing content to a user consists of at least an interceptor 120 , a content provider 130 , and a cloud security server 140 (hereinafter referred to as the cloud server 140 ).

Digital content (English digital content) - information of various kinds, provided (for example, displayed) to the user. Digital content can be provided to the user in the form of text, images, various media formats (audio and video), as well as other known options for providing information. Further in the text, the attribute content is used.

In the preferred embodiment, the interceptor 120 and the content provider 130 operate on the user's computing device 100 '. In one embodiment, interceptor 120 and content provider 130 are components of a security application (eg, an antivirus application). An example of the user's computing device 100 is a computer, laptop, tablet, smartphone, and other devices. An example of cloud server 140 is Kaspersky Security Network (KSN).

The interceptor 120 is designed to intercept user requests in the browser 110 running on the user's computing device 100 . The interception of requests is carried out by the interception tool 120 both from the request input form on search sites (for example, "google.com", "yandex.ru", "yahoo.com"), and from the address bar of the browser 110 (modern browsers allow using the address bar without explicitly specifying the address as a search element, while the address bar corresponds to a GET request). In one implementation, interceptor 120 intercepts requests sent to the server (POST requests). In yet another implementation, the interceptor 120 intercepts the names of the sites that the user accesses through the browser 110 .

For example, the user types in the search bar of the browser 110 the phrase "how to protect passwords from theft and what software to use" and performs the specified search query. Goes to the sites "securitylab.ru", "anti-malware.ru". Interceptor 120 intercepts said requests and site names. The interceptor 120 passes the intercepted requests and site names to the content provider 130 .

In general, the content provider 130 is for providing marketing materials to the user. In a particular case, the content provider 130 is for providing informational materials.

In one implementation, the content provider 130 is configured to determine the content category based on the intercepted requests and site names. The determination of the category of intercepted requests and site names occurs using the content category determination rules received by the content providing engine 130 from the cloud server 140 (the functionality of the cloud server 140 in the framework of the present invention will be described below). The rules for determining the content category are generally stored in the memory of the user's computing device 100 .

The content category definition rules generally contain at least one logical condition that operates on a type (domain, query) and a tag. An example rule will be discussed below.

In the event that the content provider 130 was unable to determine the content category based on the intercepted requests and site names using the content category determination rules, it processes the intercepted requests and site names by calculating their hashes and type, and sends the computed data to the cloud server 140 .

For the example mentioned above, the content provider 130 processes the search query by extracting key terms. From the original phrase, the content provider 130 leaves the key term "secure passwords", calculates its hash, sets the type to "search query". The site names are also processed by the content provider 130 , domains are calculated from the site names (if the site "securitylab.ru\article1" is intercepted, then "securitylab.ru" remains after the calculation), then the hash is calculated, the type "domain" is assigned.

Thus, the content provider130 transmits cloud server140data:

• Hash = sha256("protect passwords"), type = search request;

• Hash = sha256("anti-malware.ru"), type = domain;

• Hash = sha256("securitylab.ru"), type = domain.

In a particular implementation, the content provider 130 transmits a fuzzy hash to the cloud server 140 so that variations of the key term "protect passwords", "protect passwords", "protect password" and other variations have the same hash.

If from cloud server140 an explicit request for data has been received, then if any of the users completes the request “how to protect passwords” or similar (with the phrase “protect passwords”), the content provider130 transmits cloud server140data in explicit form, namely:

Hash = sha256("protect passwords"), type = search request, original = "protect passwords".

If from cloud server140 a request has been received to provide data in an explicit form, then if any of the users visits the site "securitylab.ru", the content provider130 transmits cloud server140data in explicit form, namely:

Hash = sha256("securitylab.ru"), type = domain, original = "securitylab.ru".

In the event that the content provider 130 was able to determine the content category based on the intercepted requests and site names using the rules for determining the content category, the content provider 130 does not transmit the content category to the cloud server 140 , but selects from the content received from the cloud server 140 (for example, all marketing materials) content corresponding to the category (one or more materials) and displays it to the user.

cloud server140 gets computed hashes and type of intercepted requests and site names from content providers130 various users. For a pair of hash and cloud server type140 increments the popularity counter. If the popularity counter exceeds the specified threshold value, the cloud server140 marks the hash and type pair with a note that the pair is "allowed to be sent explicitly". Thus, as mentioned above, if any of the users completes the request "how to protect passwords" and / or if any of the users access the site "securitylab.ru", the content provider130 transmits cloud server140explicit data. cloud server140for those data whose explicit form field (original from the examples above) is filled in, performs categorization by assigning tags to intercepted requests and site names. So, for the example above:

• the domain receives the tag "news" and "security";

• the request receives the tag "security", "password".

The categorization is performed by the cloud server 140 using data categorization methods known in the art. After performing categorization, the cloud server 140 does not explicitly request data from other users for the intercepted query and site name.

Using the tags obtained as a result of categorization and information from customers interested in distributing content, the cloud server 140 creates rules for determining the category of content.

In another embodiment, the cloud server140based on categorization results receives ready-made content definition rules from customers.

In one implementation, the rule is created in the cloud server 140 by an information security specialist based on the requirements of customers interested in distributing content.

The content category determination rule, as mentioned above, generally contains at least one logical condition operating on a type (domain, query) and a tag. An example of a rule would be the following.

For the target audience of users interested in the security of computing devices, it is necessary to disseminate information about the product "Kaspersky password manager". The customer sends information to the cloud server 140 to create a content categorization rule or the rule itself. The rule will work if the user fulfills the conditions:

• at least N times visits domains with "security" tags;

• at least M times made a request with the tags "security" and "password".

Also, the cloud server 140 is designed to store said rules for determining the category of content and transmit said rules to the means of providing content 130 to the computing devices of users 100 .

Also, the cloud server 140 transmits to the content deliverers 130 on the computing devices of the users 100 the content (generally all marketing materials) to be displayed to the user depending on the category identified by the content deliverer 130 using the category determination rule.

Thus, for users who fulfill the conditions described above, the content-providers 130 on their computing devices 100 display the content, namely information about the "Kaspersky password manager" product.

In the preferred implementation, cloud server 140 removes the IP address of user 100 's computing device upon receipt of data.

Fig. 2 displays the structure of the way content is provided to the user.

In step 210 , the interceptor 120 , running on the computing device of the user 100 , intercepts search queries and site names in the browser 110 and passes them to the content provider 130 . In one implementation, search queries are intercepted from the address bar of the browser. In yet another implementation, search queries are intercepted from a query input form on search sites. The interceptor 120 is discussed in more detail in the description of Fig . 1 .

In step 220 , the content provider 130 running on the user's device 100 transmits the hash and type of the intercepted search queries and site names to the cloud server 140 . In one embodiment, key terms are extracted from the search query. In yet another implementation, domains are extracted from site names. The content provider 130 is discussed in more detail in the description of FIG . 1 .

At step 230 , the popularity counter of the received data is incremented on the cloud server 140 , while:

• if the popularity threshold is exceeded, the cloud server 140 requests intercepted requests and explicit site names;

• if the popularity threshold is not exceeded, repeat step step 230 .

At step 240 , the intercepted requests and site names are explicitly transmitted by the content provider 130 to the cloud server 140 . Cloud server 140 is discussed in more detail in the description of Fig.1 .

At step 250 , using the cloud server 140 , based on the intercepted requests and site names, they are explicitly categorized and transmitted to the content provider 130 , the rules for determining the content category and content. In one implementation, categorization is performed by assigning tags to intercepted requests and site names. In another implementation, the content category definition rule contains at least one logical condition operating on a type (domain, query) and a tag.

At step 260 , by means of the content providing means 130 , if the content category determination rule is executed, display the content to the user on the user's computing device 100 in accordance with the determined category. In one embodiment, the content is marketing materials. In another embodiment, the content is information materials.

Fig. 3 shows an example of a general purpose computer system, a personal computer or a server 20 ', comprising a central processing unit 21 ', system memory 22 ', and a system bus 23 ', which contains various system components including memory associated with the central processing unit 21 '. The system bus 23 is implemented as any bus structure known in the art, in turn comprising a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. The system memory contains read only memory (ROM) 24 , random access memory (RAM) 25 . The main input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of a personal computer 20 , for example, at the time of booting the operating system using ROM 24 .

The personal computer 20 in turn comprises a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31 such as CD-ROM, DVD -ROM and other optical storage media. The hard disk 27 , the magnetic disk drive 28 , the optical drive 30 are connected to the system bus 23 via the hard disk interface 32 , the magnetic disk interface 33 , and the optical drive interface 34 , respectively. Drives and related computer storage media are non-volatile means of storing computer instructions, data structures, program modules, and other personal computer data 20 .

The present description discloses an implementation of a system that uses a hard disk 27 ', a removable magnetic disk 29 ', and a removable optical disk 31 ', but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer-readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55 .

The computer 20 has a file system 36 that stores the recorded operating system 35 as well as additional software applications 37 , other program modules 38 and program data 39 . The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40 , mouse 42 ). Other input devices (not shown) may be used: microphone, joystick, game console, scanner, etc. Such input devices are typically connected to the computer system 20 through a serial port 46 , which in turn is connected to the system bus, but may be connected in other ways, such as through a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48 '. In addition to the monitor 47 , the personal computer may be equipped with other peripheral output devices (not shown), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment using a network connection to another or more remote computers 49 . The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the nature of the personal computer 20 shown in FIG. 3 . Other devices may also be present in the computer network, such as routers, network stations, peer-to-peer devices, or other network nodes.

The network connections may form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local network 50 via a network adapter or network interface 51 . When using networks, personal computer 20 may use a modem 54 or other means to communicate with a wide area network, such as the Internet. The modem 54 , which is an internal or external device, is connected to the system bus 23 via the serial port 46 . It should be clarified that network connections are only indicative and are not required to represent the exact network configuration, i.e. in fact, there are other ways to establish a connection by technical means of communication from one computer to another.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention defined by the formula. A person skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (29)

1. A method for providing the requested digital content to a user by determining the category of the provided content on the user's computing device, comprising the steps of: a) intercepting the search query and the site name in the browser with the help of an intercepting tool executing by means of a processor on the user's computing device and transmitting them to the content providing means; b) using the content providing means, executing by means of a processor on the user's computing device, determine the hash and type of the intercepted search query and site name, which are transmitted to the cloud security server; c) increment the received data popularity counter on the cloud security server, while: • if the popularity threshold is exceeded, the cloud security server explicitly requests the intercepted request and the site name; • if the popularity threshold is not exceeded, repeat step b); d) transmit, using the content provider, the intercepted request and the site name explicitly to the cloud security server; e) using the cloud security server, categorize the intercepted request and the site name, and transmit to the content providing means the rules for determining the content category and the content; e) using the content providing means, determining the content category in case the content category determination rule is executed on the user's computing device, and displaying the content on the computing device to the user in accordance with the determined category. 2. The method of claim 1, wherein categorization is performed by assigning tags to intercepted requests and site names. 3. The method of claim 2, wherein the content category determination rule comprises at least one logical condition operating on a type (domain, query) and a tag. 4. The system for providing the requested digital content by the user on the user's computing device, where the system includes at least a cloud security server and one user's computing device, which contains at least one processor, one memory, one input and output device, while: at least one processor of one user computing device is configured to: • interception in the browser of the search query and site name; • determining the hash and type of the intercepted search request and site name; • checking the presence in memory and applying the rule for determining the category of content for the corresponding hash and type, while in the absence of the necessary rule, the processor interacts with the cloud security server, during which: ○ passes the hash and type of the intercepted search query, ○ receives a request to explicitly provide the intercepted query and site name according to the transmitted hash and type of the intercepted search query and site name, ○ passes the intercepted request and the site name explicitly, ○ Gets the content category definition rule and the content; • providing, by means of an output device, content to a user based on a content category determination rule; wherein the cloud security server is configured to interact with at least one user computing device, during which: • receives data from the user's computing device in the form of a hash and type of intercepted search query and site name, • increments the popularity counter of the received data, and if the popularity threshold is exceeded, requests the intercepted request and the site name explicitly from the user's computing device; • categorizes the intercepted request and the site name explicitly, • generates a rule for determining the category of content based on the categorization, • transmits the content category determination rule and the content to the user's computing device. 5. The system according to claim 4, in which categorization is performed by assigning tags to intercepted requests and site names. 6. The system of claim 4, wherein the content category determination rule comprises at least one logical condition operating on a type (domain, query) and a tag.

Images