Systems and methods for facilitating recognition of a device and/or an instance of an app invoked on a device

Abstract

A system of classifying devices and/or app instances a new or returning divides attributes generated from observations received from an uncharacterized device/software app into base-fingerprint attributes and predictor attributes, where the two kinds of attributes have different longevities. Predictor attribute tuples from attribute tuples having the same base fingerprint as the base fingerprint corresponding to the uncharacterized device/app, and the predictor attribute tuple corresponding to the uncharacterized device/app are analyzed using a machine learned predictor function to obtain a final fingerprint. Machine learning techniques such as logistic regression, support vector machine, and artificial neural network can provide a predictor function that can decrease the conflict rate of the final fingerprint and, hence, the utility thereof, without significantly affecting the accuracy of classification.

What is claimed is: 
     
         1 . A method comprising:
 receiving, by at least one computing device, software application instance data from one or more client devices, the software application instance data corresponding to one or more software application instances currently installed or executing on the one or more client devices;   based at least in part on the software application instance data, generating, by the at least one computing device, a plurality of attributes associated with the one or more software application instances, wherein the plurality of attributes includes:
 (i) base-fingerprint attributes comprising cookie data of the one or more software application instances that have a first half-life measure of longevity greater than or equal to a threshold value, and 
 (ii) predictor attributes comprising cookie data of the one or more software application instances that have a second half-life measure of longevity less than the threshold value; 
   generating, using a machine learning algorithm, by the at least one computing device and based on the plurality of attributes, a set of difference vectors and a target vector;   computing, by the at least one computing device, a difference between the prediction vector and the target vector;   computing, by the at least one computing device, an aggregate error based on the difference;   modifying, by the at least one computing device, a function applied to the set of difference by updating the function parameter from an initial value to a new value that decreases the aggregate error; and   authenticating, by the at least one computing device, a further client device using the modified function.   
     
     
         2 . The method of  claim 1 , wherein the threshold value is measured in days. 
     
     
         3 . The method of  claim 1 , wherein the function comprises an activation function of an artificial neural network, the activation function being selected from: a linear function, a sigmoid function, a hyperbolic tangent function, or an even step-wise function. 
     
     
         4 . The method of  claim 1 , wherein decreasing the aggregate error based on maximizing a distance between a separator function included in the function, and a support vector. 
     
     
         5 . The method of  claim 1 , wherein:
 a first group of attribute values is associated with a first software application instance;   a second group of corresponding attribute values is associated with a second software application instance; and   generating, by the at least one computing device, a set of difference vectors and the target vector based on generating a difference vector by comparing, for each attribute in the first group of attribute values, a value from the first group with a value from the second group.   
     
     
         6 . The method of  claim 5 , further comprising:
 receiving, by the at least one computing device, a first group of observations associated with the first software application instance;   generating by the at least one computing device, the first group of attribute values from at least one observation from the first group of observations;   receiving, by the at least one computing device, a second group of observations associated with the second software application instance; and   generating, by the at least one computing device, the second group of attribute values from at least one observation from the second group of observations.   
     
     
         7 . The method of  claim 5 , further comprising determining, by the at least one computing device, that the second software application instance and the first software application instance correspond to two invocations of a single software application, by comparing respective values of an instance identifier associated with the first and second software application instances. 
     
     
         8 . A non-transitory computer readable medium including instructions that when processed by a computing system cause the computing system to perform operations comprising:
 receiving, by at least one computing device, software application instance data from one or more client devices, the software application instance data corresponding to one or more software application instances currently installed or executing on the one or more client devices;   based at least in part on the software application instance data, generating, by the at least one computing device, a plurality of attributes associated with the one or more software application instances, wherein the plurality of attributes includes:
 (i) base-fingerprint attributes comprising cookie data of the one or more software application instances that have a first half-life measure of longevity greater than or equal to a threshold value, and 
 (ii) predictor attributes comprising cookie data of the one or more software application instances that have a second half-life measure of longevity less than the threshold value; 
   generating, using a machine learning algorithm, by the at least one computing device and based on the plurality of attributes, a set of difference vectors and a target vector;   computing, by the at least one computing device, a difference between the prediction vector and the target vector;   computing, by the at least one computing device, an aggregate error based on the difference;   modifying, by the at least one computing device, a function applied to the set of difference by updating the function parameter from an initial value to a new value that decreases the aggregate error; and   authenticating, by the at least one computing device, a further client device using the modified function.   
     
     
         9 . The non-transitory computer readable medium of  claim 8 , wherein the threshold value is measured in days. 
     
     
         10 . The non-transitory computer readable medium of  claim 8 , wherein the function comprises an activation function of an artificial neural network, the activation function being selected from: a linear function, a sigmoid function, a hyperbolic tangent function, or an even step-wise function. 
     
     
         11 . The non-transitory computer readable medium of  claim 8 , wherein decreasing the aggregate error based on maximizing a distance between a separator function included in the function, and a support vector. 
     
     
         12 . The non-transitory computer readable medium of  claim 8 , wherein:
 a first group of attribute values is associated with a first software application instance;   a second group of corresponding attribute values is associated with a second software application instance; and   generating, by the at least one computing device, a set of difference vectors and the target vector based on generating a difference vector by comparing, for each attribute in the first group of attribute values, a value from the first group with a value from the second group.   
     
     
         13 . The non-transitory computer readable medium of  claim 12 , wherein the operations further comprise:
 receiving, by the at least one computing device, a first group of observations associated with the first software application instance;   generating by the at least one computing device, the first group of attribute values from at least one observation from the first group of observations;   receiving, by the at least one computing device, a second group of observations associated with the second software application instance; and   generating, by the at least one computing device, the second group of attribute values from at least one observation from the second group of observations.   
     
     
         14 . The non-transitory computer readable medium of  claim 12 , wherein the operations further comprise determining, by the at least one computing device, that the second software application instance and the first software application instance correspond to two invocations of a single software application, by comparing respective values of an instance identifier associated with the first and second software application instances. 
     
     
         15 . A computing system comprising:
 a memory configured to store instruction;   a processor, coupled to the memory, configured to process the stored instructions to:
 receive software application instance data from one or more client devices, the software application instance data corresponding to one or more software application instances currently installed or executing on the one or more client devices; 
 based at least in part on the software application instance data, generate a plurality of attributes associated with the one or more software application instances, wherein the plurality of attributes includes:
 (i) base-fingerprint attributes comprising cookie data of the one or more software application instances that have a first half-life measure of longevity greater than or equal to a threshold value, and 
 (ii) predictor attributes comprising cookie data of the one or more software application instances that have a second half-life measure of longevity less than the threshold value; 
 
 generate, using a machine learning algorithm and based on the plurality of attributes, a set of difference vectors and a target vector; 
 compute a difference between the prediction vector and the target vector; 
 compute an aggregate error based on the difference; 
 modify a function applied to the set of difference by updating the function parameter from an initial value to a new value that decreases the aggregate error; and 
 authenticate a further client device using the modified function. 
   
     
     
         16 . The computing system of  claim 15 , wherein the function comprises an activation function of an artificial neural network, the activation function being selected from: a linear function, a sigmoid function, a hyperbolic tangent function, or an even step-wise function. 
     
     
         17 . The computing system of  claim 15 , wherein decreasing the aggregate error based on maximizing a distance between a separator function included in the function, and a support vector. 
     
     
         18 . The computing system of  claim 15 , wherein:
 a first group of attribute values is associated with a first software application instance;   a second group of corresponding attribute values is associated with a second software application instance; and   the processor is further configured to generate a set of difference vectors and the target vector based on generating a difference vector by comparing, for each attribute in the first group of attribute values, a value from the first group with a value from the second group.   
     
     
         19 . The computing system of  claim 18 , wherein the processor is further configured to:
 receive a first group of observations associated with the first software application instance;   generate the first group of attribute values from at least one observation from the first group of observations;   receive a second group of observations associated with the second software application instance; and   generate the second group of attribute values from at least one observation from the second group of observations.   
     
     
         20 . The computing system of  claim 18 , wherein the processor is further configured to determine that the second software application instance and the first software application instance correspond to two invocations of a single software application, by comparing respective values of an instance identifier associated with the first and second software application instances.