Twitter, Inc.

Dasient, Inc.

Ameet Ranadive

Shariq Rizvi

Neilkumar Murli Daswani

Tufan Demir

Michael Gagnon

Santosh Kumar Kancha

Xiaochuan Qin

Abhishek Shrivastava

Yimin Wu

Gerald E Eisenhaur

Wenchang Zhou

Bill Darrow

Travis Lull

Tom Larson

Lei Zhang

Sandeep Pandey

Chinmoy Dutta

Ke Zhou

Vibhor Rastogi

Junjun Li

Wanchen Lu

Milind Mahajan

Gerry Eisenhaur

A system for online conversion attribution. The system includes a short uniform resource locator (URL) service programmed to, in response to receiving a short URL from a device: provide a cookie that includes a short URL ID to the device, and provide a short URL descriptor including the short URL ID to a user mapping service. The system further includes the user mapping service programmed to receive the short URL descriptor, receive a social media descriptor including a social media ID, map the short URL ID to the social media ID using the short URL descriptor and the social media descriptor, and attribute, using the mapping, a conversion on a website accessed using the device based upon receipt of the short URL ID from the device.

Method and system for online conversion attribution

Behavioral analysis of a mobile application is performed to determine whether the application is malicious. During analysis, various user interactions are simulated in an emulated environment to activate many possible resulting behaviors of an application. The behaviors are classified as hard or soft signals. A probability of the application being malicious is determined through combining soft signals, and the application is classified as malicious or non-malicious. Users of the application, the developer of the application, or a distributor of the application are notified of the application classification to enable responsive action.

Behavioral scanning of mobile applications

A method for conversion attribution. The method includes obtaining a first identifier associated with a first device, obtaining a second identifier associated with a second device, bridging the first identifier and the second identifier based on a determination, made by a probabilistic classifier, that the first identifier and the second identifier are associated with a common user, and attributing, using the bridge, a conversion on a website accessed using the second device.

Method and system for identifying users across mobile and desktop devices

Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.

Malicious advertisement detection and remediation

Behavioral analysis of a mobile webpage is performed to determine whether the webpage is malicious. During analysis, the webpage is visited by an emulated mobile device to cause behaviors to occur which may be malicious. The behaviors occurring after accessing the webpage are stored. The behaviors are classified as hard or soft signals. A probability of the webpage being malicious is determined through combining soft signals, and the webpage is classified as malicious or non-malicious. Users of the webpage, the developer of the webpage, or a distributor of the webpage are notified of the webpage classification to enable responsive action.

Detecting malware in mobile sites

Diversity information associated with a set of advertisement tags is determined. Example ways of determining diversity include determining a list of distinct Uniform Resource Locators, determining a list of distinct domains, and determining whether an advertisement includes one or more dynamic elements. Scans are adaptively performed based on the determined diversity information. Scanning is performed more frequently for advertisement tags having higher associated diversities and scanning is performed less frequently for advertisement tags having lower associated diversities.

Scanning ad content for malware with varying frequencies

Remediating a suspicious element in a web page is disclosed. An indication of a suspicious element is received. A quarantine instruction is sent to a server of the web page. One example of a quarantine instruction is an instruction to block the page from being served. Another example of a quarantine instruction in as instruction to block an element of the page from being served.

Mitigating malware

Detecting a suspicious element in a web page is disclosed. The page is analyzed, such as through static analysis and/or dynamic analysis techniques. A suspicious element in the page is detected. A report that includes a copy of at least a portion of the suspicious element is provided as output.

Monitoring for problems and detecting malware

Growing community of inventors

San Francisco, CA, United States of America

Ameet Ranadive