AU2012227205B2 - System and method for advertising on a peer-to-peer network - Google Patents

Abstract

A system for advertising on a Peer-to-Peer network detects a search request of a node in 5 a Peer-to-Peer network. After detecting a search request, the system prepares an unsolicited response (e.g., advertisement) to the search request of the node. Once the unsolicited response is prepared, the system sends the unsolicited response to the node. For example, a Peer-to-Peer network node issues a search request and a system prepares an advertisement (e.g., an unsolicited response). After preparing the advertisement, the 10 system sends the advertisement to the Peer-to-Peer network node that issued the search request. The process of sending advertisements can be made to each node issuing a search request without discrimination. In one example, the system detects a search request of a node in a Peer-to-Peer network; prepares an advertisement in response to the search request of the node based on a predetermined search criteria; and sends the 15 advertisement to the node for advertising on the Peer-to-Peer network.

Description

AUSTRALIA Patents Act COMPLETE SPECIFICATION (ORIGINAL) Class Int. Class Application Number: Lodged: Complete Specification Lodged: Accepted: Published: Priority Related Art: Name of Applicant: Tiversa, Inc. Actual Inventor(s): Samuel P. Hopkins Address for Service and Correspondence: PHILLIPS ORMONDE FITZPATRICK Patent and Trade Mark Attorneys 367 Collins Street Melbourne 3000 AUSTRALIA Invention Title: SYSTEM AND METHOD FOR ADVERTISING ON A PEER-TO-PEER NETWORK Our Ref : 953871 POF Code: 775/492890 The following statement is a full description of this invention, including the best method of performing it known to applicant(s): -1- -1a SYSTEM AND METHOD FOR ADVERTISING ON A PEER-TO-PEER NETWORK RELATED APPLICATION(S) 5 This application is a divisional of AU 2008262281, the entire contents disclosure of which is incorporated herein by reference. BACKGROUND OF THE INVENTION Peer-to-Peer network users issue over 800 million searches a day compared to 10 the 250 million searches a day users issue on the World Wide Web. A Peer-to Peer network relies primarily on the computing power and bandwidth of participants in a network and are generally used for connecting nodes via connections. One use for such a network is sharing content files. Content files may contain audio, video, data, or other digital formats. The content is typically accessed in real-time data using Peer-to-Peer 15 technology. To access a Peer-to-Peer network for sharing, a user utilizes a Peer-to-Peer network software application that is capable of connecting to the Peer-to-Peer network. An example Peer-to-Peer network includes multiple nodes, where each node has a file server and a client capable of sending and receiving data, such as a "communication message" between nodes. A node is typically connected to other nodes 20 in a network. In some Peer-to-Peer networks, a node connects to other nodes over a communications path, such as the Internet or proxy. For example, Figure 1 shows a Peer to-Peer network connection capable of searching for shared files. To search on a Peer to-Peer network, a process issues a search request and an originating node sends the search request to receiving nodes (e.g., each node that the originating nodes is 25 connected). Each receiving node searches for a match and responds to the requesting node with location information for each match. Another variation of a Peer-to-Peer network is shown in Figure 3. In particular, Figure 3 shows a non-proxy loop network wherein each node is directly connected to another. In other Peer-to-Peer proxy networks, there may be multiple nodes as illustrated 30 in Figure 2. Figure 2 shows node A connected to node B and, in turn, node B is connected to node C. In this example, node A is not directly connected to node C. In use, node A issues a search request to node B and node B searches shared files for a G&1R71 -2 match. If a match is found, node B sends a response back to node A including a location for the shared file. After responding to node A, node B forwards node A's request to node C. In response, node C searches the shared files for a match and responds to node B with a location of each shared file. Node B then forwards a response back to node A. 5 Peer-to-Peer networks may also use a leaf node/main node proxy topology as illustrated in Figure 4. In this network variation, one or more nodes are classified as main nodes and the other nodes are classified as leaf nodes. A leaf node may only connect to main nodes and main nodes can connect to other main nodes. Thus, if a leaf node issues a search request, the leaf node sends the search request to a main node 10 connects to the leaf node. Upon receiving the search request, the main node forwards the request to each leaf node and main nodes connected to the requesting main node. The receiving main node forwards each search request to each of the leaf nodes that they are in connection with. In some cases, Peer-to-Peer networks can include millions of nodes that use a 15 large amount of bandwidth. To reduce the bandwidth used in operating such networks, many Peer-to-Peer networks restrict the "distance" of messages traveling the network (e.g., limit hops or Time to Live (TTL)). For example, a Peer-to-Peer network may be limited to performing only five hops as shown in Figure 5. For example, Node A may issue a search request to Node B. In turn, Node B passes the search request to Node C, ?0 and so forth until reaching Node F. Since, the Peer-to-Peer network is limited to five hops, the search requests end at Node F and do not pass to any additional nodes. It is useful to note that other mechanisms are also employed in networks for limiting the search capabilities of users. Figure 6 shows network nodes communicating over a transmission distance of 25 three nodes. In particular, node A 605 communicates with each node within the A circle 610. Similarly, node B 615 communicates with each node within the B circle 620. Likewise, node C 625 communicates with each node within the C circle 630 and with each node within the B circle 620 that is overlapping the C circle 630. However, no node can communicate with a non-overlapping area or within a corresponding circle. 30 Thus, there is a need to access nodes without regard to location while using unlimited search requests in a manner positive to business development.

-3 SUMMARY OF THE INVENTION Organizations and individuals risk disclosing information that should not be shared. To lower this risk, an organization or an individual locates information and identifies what information is private (e.g., should not be disclosed). After identifying 5 what information is private, the organization may take actions to prevent disclosure of the information. One way to prevent improper information sharing is by monitoring searches made in a file sharing network, such as a Peer-to-Peer network, for phrases, terms, or one or more criteria relating to an industry, organization, or company, such as a 10 company name or other nomenclature. A system and/or method thus can monitor for searches on a file sharing network, such as a Peer-to-Peer network. The Peer-to-Peer network includes multiple nodes which are in communication with each other. In operation, a node sends a search for a particular phrase indicative of information that should not be shared, such as the phrase "Acme Bank." Once the search is issued, the 15 network node obtains the search results from the Peer-to-Peer network, typically by obtaining a broadcast message. The network node then compares the searches to one or more criteria (e.g., a phrase) using a comparison technique, such as compare. If the one or more criteria matches the searches (e.g., criteria is "AcmeBank"), the network node updates the one or more criteria to include variations (e.g., "Acme Banks") of the 20 original. To do so, the network node employs pluralization or other algorithms known in the art to determine these additional variations of the searches. After updating the criteria, the network node issues new searches based on the updated criteria. As a result, the network node receives a response from the Peer-to-Peer network and creates a list of the resultant information from the new searches and stores 25 the resultant information in a database for further analysis. BRIEF DESCRIPTION OF THE DRAWINGS The foregoing will be apparent from the following more particular description of example embodiments of the invention, as illustrated in the 30 accompanying drawings in which like reference characters refer to the same parts QA71 -4 throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating embodiments of the present invention. Figure 1 is an example schematic view of a Peer-to-Peer network; Figure 2 is an example schematic view of a Peer-to-Peer proxy network; 5 Figure 3 is an example schematic view of a Peer-to-Peer, non-proxy, and loop network; Figure 4 is an example schematic view of a Peer-to-Peer leaf/main node network; Figure 5 is an example schematic view of a Peer-to-Peer network wherein 10 multiple nodes are connected and access is limited by network rules; Figure 6 shows an example network nodes communicating over a transmission distance of three nodes; Figure 7 is an example schematic view of an advertisement system communicating over multiple connections; 15 Figure 8 is an example flow diagram illustrating sending advertisements to a user; Figure 9 is an example flow diagram of an example advertisement system advertising to a user; Fig. 10 is an example block diagram depicting a communications network 20 monitoring searches on a Peer-to-Peer network to create a list according to example embodiments of the invention; Fig. I I is an example list of resultant information according to an example embodiments of the invention; Fig. 12 is an example block diagram depicting an example search packet 25 according to example embodiments of the invention; Fig. 13A is an example flow diagram depicting issuing searches on a network according to an example embodiments of the invention; Fig. 13B is an example criteria according to an example embodiments of the invention; 30 Fig. 14 is an example flow diagram depicting adding searches to a database according to an example embodiments of the invention; -5 Fig. 15 is an example flow diagram depicting an example monitoring process according to an example embodiments of the invention; and Fig. 16 is an example flow diagram illustrating creating of a list of searched 5 information on a Peer-to-Peer network according to example embodiments of the invention. DETAILED DESCRIPTION OF THE INVENTION A description of example embodiments of the invention follows. 10 In an embodiment, an advertisement system provides advertising to an unrestricted amount of users or nodes on a Peer-to-Peer network. The advertisement system can communicate with more users than a Peer-to-Peer node because there are no restrictions. Since the advertisement system can communicate with more nodes, the advertisement system can send advertisements to a larger group of Peer-to-Peer 15 networks. In operation, the advertisement system connects to a Peer-to-Peer network, detects searches or search queries made by nodes, and responds with advertising information to an advertisement location. The advertisement location is determined by the origination of the searches made by the nodes or users. Further, the 20 advertisement locations can be in the form of a filename, file, message, or a pointer to a file. The content of the advertisement location may include a product placement ad or a music or video file that contains an advertisement. The Advertising System may also allow an issued advertisement to be propagated to multiple users or nodes. If a user, for example, downloads an 25 advertisement (e.g., from a song), the advertisement spreads to other users as part of Peer-to-Peer network usage. For example, a first normal Peer-to-Peer user downloads an advertisement in the form of a music file from the Advertisement System. A second user issues a search for the music file and downloads it from the first user and receives the advertisement. This cycle continues over multiple points 30 on the network using the server/client model of the Peer-to-Peer network to distribute the file(s).

-6 Fig. 7 shows an example advertisement system 705 coupled to one or more network node in a Peer-to-Peer network. The advertisement system 705 includes a monitoring unit 710, a database 715, and a processor 720. The monitoring unit 705 detects search requests originated by a user located at a originating (requesting) 5 node. The receiving node searches for a match and responds to the originating node with location information for each match. A processor 720 in communication with the monitoring unit 710 prepares an advertisement in response to the search request and sends the advertisement to the user making the search request. The processor 720 retrieves the selected advertisement from a database 715. 10 In an embodiment, the advertisement system 705 may connect to main nodes, super nodes, ultra Peers, or other centralizing node without providing service directly to the nodes. These nodes may be configured from a central source and may share information, such as configuration information, among the nodes. For example, the nodes may connect to random nodes, or use a network topography 15 system to deduce the most efficient places to connect. In an embodiment, the advertisement system detects a search query from a user. The search query may be compared with predetermined criteria. If the search query and predetermined criteria either match or are related, the advertisement system responds by sending an advertisement to the user or node. For example, if a 20 user issued a search query for "Singer song X," the advertisement system sends an advertisement for Singer's next concert. On the other hand, if the advertisement system does not use a filter based on predetermined criteria, the advertisement system sends advertisements without regard to the topic in the search query. For example, the same "Singer song X" search would result in an advertisement for "Car 25 B." It is useful to note that predetermined criteria and search queries do not require and exact match. For example, a user may issue a search query for "Singer's Greatest Hits" and match predefined criteria of "Singer." Comparisons for predetermined criteria and search strings are made using inter string, complete string, partial string, fuzzy logic, patricia tree, or other useful 30 comparing technique. Comparisons can occur in parallel with other searches to increase throughput of the network (e.g., serial processing). If a match is made, the advertising system builds a response to the search request. The search response may -7 also include an IP address of the advertisement system, programming logic, other system information, or a Peer-to-Peer Identification (ID). An IP address uniquely identifies a user's internet presence and is composed of four bytes of information representing a domain name and an identification 5 number in that domain. By knowing the IP address of a user, an internet connection can be established with that user. Peer-to-Peer networks are characterized by dynamically-formed, self-organized and self-managed, robust, server-less communication peer networks (sometimes referred to as meshes). Each node is identified by a unique (within the mesh) peer ID. Each node shares bidirectional 10 connections with at least its nearest neighbors. Tracking Peer-to-Peer IDs is useful to the advertisement system because Peer-to-Peer IDs are not managed by a central authority, but rather assigned at random. Thus, the advertisement system can prepare a response to include any IP address or Peer-to-Peer ID by the information in the search response. For example, a user makes a search request at the originating 15 node for "Madonna CDs" in the Peer-to-Peer network. The advertisement system may store at least one stored object, such as "Madonna." The advertisement system makes a match between the stored object (e.g., Madonna) and the requested object (e.g., Madonna CDs) and then generates an advertisement, for example, Madonna's next concert. The advertisement system acquires the unique ID that is associated 20 with the originating node. The advertisement system is then able to respond to the user with the advertisement by knowing the originating node unique ID. Moreover, the advertisement system is capable of determining locations to provide advertisements. More specifically, the advertisement system connects to a Peer-to-Peer network having multiple connections in a manner where each 25 connection has no overlapping node(s). Specifically, the Advertisement system locates connection points by issuing a search from a first connection and detecting if the search appears on a second connection. If the search does not exist in the second connection, the two nodes are not connected. Alternatively, the Advertisement System connects to a Peer-to-Peer network at preferential points, 30 such as high traffic areas. The Advertisement could locate high traffic areas by monitoring the number of searches that are being issued from a certain area and comparing it to a threshold or second area.

-8 Figure 8 is a flow diagram illustrating a process of sending advertisements to a user in more detail. An advertisement system connects (805) to a Peer-to-Peer network. Next, the advertisement system waits (810) for issued search (815) on the Peer-to-Peer network. If the advertisement system is configured (820) to use pre 5 defined criteria, the advertisement system compares (825) the search query for matching criteria (830). In an embodiment, pre-defined criteria is a list of keywords that have been selected to be monitored for, and if matched would result in the advertisement system providing an advertisement to the searcher. For example, pre defined criteria can be a singer's name. Once the criteria is matched, the 10 advertisement system sends the advertisement to a user. If the advertisement system is not configured (820) to use pre-defined criteria, the advertisement system sends the advertisement to a user regardless of the search term issued by the user. The advertisement system can utilize any feature of the Peer-to-Peer network that would be able to provide information to the user. In an embodiment, an advertisement 15 system sends back a response where a document filename includes the advertisement message (e.g., "Purchase Singer ABC's Newest Record.doc"). Figure 9 is a flow diagram depicting and example embodiment issuing an advertisement to a user in an advertisement system. The advertisement system detects a search has issued and matches keywords that have been identified for 20 searching. An advertisement system creates a filename (905) containing the advertisement information. For example, the filename may be "Singer X.doc." At 910, the advertisement system creates a Peer-to-Peer (P2P) response packet containing the filename created in (905). The advertisement sends the response packet (910) via the P2P network to the P2P user that issued the search. The P2P 25 application, for the user who issued the search, receives (920) the response packet. The P2P application then extracts the filename from the response packet (925) and displays the filename (which is an advertisement) to the user as a downloadable file (930). Today, organizations and individuals risk disclosing information that should 30 not be shared. To lower this risk, an organization or an individual locates information and identifies what information is private (e.g., should not be disclosed). After identifying what information is private, the organization may take actions to -9 prevent disclosure of the information. One way to prevent the improper information sharing is by monitoring searches made in a network, such as a Peer-to-Peer network, for phrases, terms, or one or more criteria relating to an industry, organization, or company, such as a company name or other nomenclature. 5 Fig. 10 is a block diagram depicting a communications network 1000 monitoring searches 1010, 1020 on a Peer-to-Peer network to create a list according to example embodiments of the invention. In particular, a network node 1040 monitors searches issued on a Peer-to-Peer network 1012. The Peer-to-Peer network 1012 includes node a 1005, node b 1015, and node c 1025, which are in 10 communication with each other. In operation, node a 1005 sends search 1010 to node b 1015. Similarly, node b 1015 sends search b 1020 to node c 1025. For example, node a 1005 and node b 1015 may issue searches 1010, 1020 for the phrase "Acme Bank." Once the search is issued, the network node 1040 obtains the searches 1010, 1020 from the Peer-to-Peer network 1012, typically by obtaining a 15 broadcast message associated with the searches 1010, 1020. After obtaining the searches 1010, 1020, the network node 1040 compares the searches 1010, 1020 to one or more criteria 1060 (e.g., a phrase) using a comparison technique, such as compare. If the one or more criteria 1060 matches the searches 1010, 1020 (e.g., criteria is "AcmeBank"), the network node 1040 updates the one or more criteria 20 160 to include variations (e.g., "Acme Banks") of the searches 1010, 1020. To do so, the network node 1040 employs pluralization or other algorithms known in the art to determine these additional variations of the searches 1010, 1020. After updating the criteria 1060, the network node 1040 issues new searches 1050a-b based on the updated criteria. As a result, the network node 1040 receives a 25 response from the Peer-to-Peer network 1012 and creates a list of the resultant information 1055a-b from the new searches 1050a-b and stores the resultant information 1055a-b in a database 1045 for analysis. In a preferred embodiment, the network node 1040 receives a response, including the resultant information 1055a-b, from the Peer-to-Peer network 1012. 30 An example resultant information 1055a is shown in Fig. 11. In particular, Fig. 11 shows the resultant information 1055a as a TCP/IP packet that contains contain a 16 byte descriptor id 1107, a payload descriptor id 1119, a time to live value (normally -10 3) 1137, a hops value 1142 (normally 0), a payload length 1147, and a payload 1152. The payload typically includes the number of file titles contained in the payload, the TCP/IP port, an IP address, host speed, the result set with a file index, a file size, a file name, and a servent ID number. In an embodiment, the resultant information 5 can also include the name and size of a file, and the IP address of the computer that has the file. It should be understood that a servent is a peer-to-peer network node, which has the features of both a server and a client. Other configurations for the resultant information 1055a are also possible. Referring back now to Fig. 10, an analysis node 1080 may receive the list 10 1070, which allows an operator or software logic 1090 to identify patterns of searched information in the list 1070. The software logic 1090, for example, determines information, such as a shared folder that contains sensitive or private information, which would be improper to share. That is, the information may be shared inadvertently or by a malicious act or virus. For example, a person may 15 inadvertently shared a dispute letter that contains personal information, such as a credit card number. A user may search for these dispute letters and acquire the credit card number. That is, the user may issue a search and receive a dispute letter, which relates to a credit card purchase for a credit card owner. In the dispute letter, the credit card owner includes the credit card number and/or other personal 20 information. Thus, the user can now view and potentially use the credit card owner's credit card number and/or other personal information. In other examples, the Peer-to-Peer network 1012 software may have a software bug that permits the sharing of files or information. Likewise, a user's computer may have a virus or worm that connects to the Peer-to-Peer network 1012 25 and shares information without the user's knowledge, such as inadvertent share folder 1018 in node b 1015. Regardless of the reason for sharing, a user can issue a search including terms that target an organization or individual, such as "Acme Bank dispute letter" or "John Smith credit card." Allowing access to sensitive or private information, via searching, can result in risks to an organization, national security, or 30 other users. It should be understood that embodiments of the invention are not limited to using a database, such as database 1045, and embodiments of the invention can also - 11 store the list in a report, on the network node 1040, or in some other suitable location or memory. Other configurations are also possible. It should be further understood that other configurations of the Peer-to-Peer network 1012 are also possible. For example, one or more nodes can be classified as 5 main nodes and the other nodes can be classified as leaf nodes. A leaf node connects to main nodes and main nodes can connect to other main nodes. Thus, if a leaf node issues a search request, the leaf node sends the search request to a main node connects to the leaf node. Upon receiving the search request, the main node forwards the request to each leaf node and main nodes connected to the requesting 10 main node. The receiving main node forwards each search request to each of the leaf nodes that they are in connection with. Embodiments of the present invention can also obtain resultant information from leaf nodes searches as well. Moreover, it should be understood that the analysis node 1080 and software logic 1090 are optional components of the communications network 1000 and embodiments can be 15 employed without these components. Fig. 12 is a block diagram depicting an example search packet 1200 according to example embodiments of the invention. In particular, the search packet 1200 contains a 16 byte descriptor id 1205, a payload descriptor id 1210, a time to live value 1215, a hops value 1220, a payload length of the search term 1225, a 20 search term 1230, and a minimum speed the user accepts 1235. In a preferred embodiment, a network node, such a network node 1040 of Fig. 10, creates a report based on the searches in a search packet 1200. The report can include a listing of all the searches that match criteria including duplicates. Alternatively, the report can include a listing of the search term 1225 that matched the criteria without duplicates. 25 For reports that include duplicates, a number corresponding to the number of searches a particular search term 1225 can be stored. Using the number of searches for a particular search term 1225 can be useful in determining a pattern as described below. In an embodiment, the report can also includes each search term 1225 and a corresponding 16 byte descriptor id 1205. 30 Fig. 13A is a flow diagram depicting issuing searches on a network according to an example embodiment of the invention. In particular, Fig. q3A shows a process 1300 for monitoring organization information, via monitoring - 12 searches, issuing searches, and obtaining a response. The process 1300 monitors a Peer-to-Peer network for searches that match one or more criteria 1305 by using a network node to obtain Peer-to-Peer network broadcast messages. In an preferred embodiment, the process uses comparison techniques, such as compare, a fuzzy 5 logic match, or other comparison technique known in the art, via a programming language, such as C++ or Visual Basic. Using other programming languages or comparison techniques is also possible. In an example embodiment, the programming language considers account punctuation, such as abbreviations, and pluralization to either modify the search term, modify the one or more criteria, or 10 add additional criteria search terms. For example, if a search term is "Acme Banks", the process remove the "s" at the end of "Banks" to expand the results. That is, the process 1300 includes multiple criteria search terms, such as "Acme Bank" and "Acme Banks." Consider the following example. The process 1300 monitors a network for a 15 search term or phrase (e.g., "Acme Bank") by extracting the search term from a Peer-to-Peer network search packet, such as search packet 1200 of Fig. 12. After extracting the search term, the search term can be compared to criteria using compare, intrastring, fuzzy logic match, or other comparison technique(s). More specifically, the process 1300 determines if the one or more criteria is matched 1310. 20 If there is no match, the process 300 returns to monitoring 1315 for new searches, otherwise the process 1300 continues. More specifically, the process 1300 obtains or receives one or more searches from a Peer-to-Peer network relating to an organization (e.g., "Acme Bank") or individual. The process 1300 compares the one or more searches one or more criteria. The one or more criteria, for example, may 25 be a predefined keyword, set of keywords, or a subset of keywords and may be stored in a database, a computer program, a list, a report, memory, or other suitable storage device. In an embodiment, an organization or other users defines the one or more criteria with search terms. For example, an organization defines the one or more 30 criteria, which corresponding to an organization, such as a company name, address, brand name(s), name(s) of executive management, addresses, or other representative criteria (or keyword). Example criteria 1350 is shown in Fig. 13B. More - 13 specifically, the example criteria 1350 shows search terms issued by suspicious individuals on a network. After issuing the one or more searches, the process 1300 returns to a monitoring phase 1325. The example criteria 1350 is typically a listing of terms or phrases that match the organizations keywords specified by human 5 resources, consumer, agents, or a computer. In an embodiment, the defining the one or more criteria can be manually entered by the organization or other user. In an embodiment, the process 1300 monitors issued searches and matches the issued searches to existing criteria and adds the searches as additional criteria. 10 Continuing with Fig. 1 3A, if the criteria is matched, the process 1300 issues one or more searches onto the Peer-to-Peer network 1320. The process 1300 issues searches by using one of the following: a Peer-to-Peer software application, a non Peer-to-Peer system, or a system that has access to a Peer-to-Peer node for issuing searches. In an embodiment, the searches are issued via a Transmission Control 15 Protocol and an Internet Protocol (TCP/IP) packet. A TCP/IP packet typically contains a 16 byte descriptor identifier, a payload descriptor identifier of 128, a time to live value (normally 3), a hops value (normally 0), a payload length with the length of the search term, a search term, and a minimum speed a user is accepting. In an embodiment, a process 1400 adds one or more searches to memory as 20 illustrated in Fig. 14. The process 1400 monitors a Peer-to-Peer network for one or more searches that match the one or more criteria 1405. The process 1400 determines if the one or more criteria matches 1410. If there is a match, the process 1400 adds the searches to a list 1420. If the list contains an organization name related to a customer as provided in the criteria, the process 1400 determines that the 25 user may be malicious and targeting their customers. The process 1400 determines such behavior exist by using metrics, such as the number of searches received or the complexity of the search. More specifically, if a user searches for the phrase "Acme Bank Statements," a determination is made that the user is attempting to find bank statement information. The process 1400 adds the record of the searches (and/or the 30 actual searches) to memory 1400 and returns to a monitoring phase 1425 to identify additional searches. If, however, there is no criteria match, the process 1400 returns to a monitoring phase 1410 without adding searches to memory.

- 14 A monitor process 1500 as shown in Fig. 15 allows an organization to protect against unwanted or improper information sharing. In a preferred embodiment, a monitor system in the monitor process 1500 monitors a Peer-to-Peer network and monitors the Peer-to-Peer network for a word or phrase 1505 based on 5 a configuration. In an embodiment, the configuration can be manually entered by an operator of the monitor system or predetermined in some other manner. A Peer-to Peer user issues a search for the word or phrase 1510. In turn, the monitoring system detects a search on the Peer-to-Peer network and compares the search to the word or phrase 1515. Further, the monitoring system detects that the search matches 10 the certain word or phrase and issues the search onto the network 1520. For example, by monitoring the searches of a "rogue" user, a bank records the search response to identify a rogue user in the future. Thus, the bank is capable of identifying if a potential problem may exist. The monitoring system may record responses to a database and/or download files that match the issued search in 15 computer memory, a database, or on a printed media 1525. In a preferred embodiment, the monitoring system can use TCP/IP to connect to the host and download the file. It should be understood that searches can be issued via TCP/IP packets or other transmission packet. In an embodiment, the monitoring system issues a "Push" message, which 20 instructs the file host to connect to the monitoring system and upload the file. Thus, the monitoring circumvents any host firewall preventing transfer of the message. A push message can be a TCP/IP packet that would contain a 16 byte descriptor id, a payload descriptor id of 64, a time to live value (normally 3), a hops value (normally 0), Payload length, and a payload. The payload includes a servent identifier, file 25 index, IP address of the Monitoring System, and the TCP/IP port of the Monitoring System. Fig. 16 is a flow diagram illustrating creating a list of searched information on a Peer-to-Peer network according to example embodiments of the invention. A process 1600 obtains one or more searches from a Peer-to-Peer network at 1605. At 30 1610, the process 1600 compares the one or more searches to one or more criteria to determine if there are any matches. At 1615, the process 1600 updates the one or more criteria to include variations or other permutations of the one or more searches.

- 15 At 1620, the process 1600 issues the one or more searches to the network, based on updated criteria, to obtain resultant information. At 1625, the process 1600 determines the resultant information associated with the one or more searches. At 1630, the process creates a list of the resultant information for analysis. 5 It should be understood that the resultant information can be in the form of a list, report, a database report, or other suitable presentation. Further, as explained above, software logic can be used to identify patterns in the searched/resultant information based on the one or more criteria. Alternatively, the resultant information can be reviewed by an analyst to identify any patterns/risks. For 10 example, an analyst or software logic identifies a large number of searches relating to personal or business information for a particular executive in an organization in the resultant information. The large number of searches relating to this executive indicates a possible identity theft or other potential risk. In one embodiment, an Advertising System is a hardware system, such as a 15 computer, thin appliance, ASIC based device or other similar device. The hardware system may be programmed with specific logic or programming code (e.g., software). Further, the hardware system may also be connected to a physical network either directly or via a gateway. Moreover, the hardware system uses programming logic for transmitting and receiving on physical networks and Peer to 20 Peer networks. Programming logic is a software program or other solution including procedural information. In a convenient embodiment, the advertising system includes a subsystem for connecting to a network, a second system for processing the searches, and a third system for sending the advertisement. For further convenience, the Advertisement 25 System changes its IP address and/or its Peer-to-Peer network identifier to avoid detection on the Internet, appear as more than one node, or as a different node. It should be understood that any of the processes disclosed herein, such as sending advertisements or the flow diagram of Fig. 8, may be implemented in the form of hardware, firmware, or software. If implemented in software, the software 30 may be processor instructions in any suitable software language and stored on any form of computer readable medium. The processor instructions are loaded and - 16 executed by a processor, such as a general purpose or application specific processor, that, in turn, performs the example embodiments disclosed herein. It should also be understood that an advertisement system may be configured as a single high performance device, one or more devices sharing information and 5 workload, or a group of devices that operate independently. Further, the advertisement system may consist of a network of Peer-to-Peer client nodes configured to advertise and utilize the Peer-to-Peer network to share files. The advertisement system may also contain, programming logic such as software or software embedded in hardware. In an embodiment, the network of Peer-to-Peer 10 nodes can be configured to advertise each shared file, such as video or audio commercials, that matches an advertisement search query. The Peer-to-Peer nodes could also be configured to respond with files that are video or audio commercials that do not match the user's search query, and in effect advertise to each of the user's issuing searches. 15 While this invention has been particularly shown and described with references to example embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims.

Claims (15)

1. A method for monitoring searches made in a computer network comprising: storing criteria representing information for which access is requested in a file 5 sharing network; detecting a search request of a node the file sharing network; comparing the detected search request to the criteria; if the search request matches the criteria, generating updated criteria based on variations of the detected search 10 request; issuing a new search on the file sharing network using the updated criteria; and storing a response to the new search. 15

2. The method of claim I wherein the response to the new search includes a unique identifier.

3. The method of claim I wherein the response to the new search includes a network address of a node responding to the new search. 20

4. The method of claim I wherein the response to the new search includes a shared file folder location identifier.

5. The method of claim I wherein the updated criteria further includes private 25 information that an organization or individual intends should not be shared on the file sharing network.

6. The method of claim 1 wherein the updated criteria further includes search terms expected to be issued by suspicious and/or rogue individuals. 30

7. The method of claim I wherein the updated criteria further includes variations and/or permutations of one or more searches. -M71 -18

8. The method of claim I wherein the variations of the detected search request comprise account punctuation, abbreviations, and/or pluralization. 5

9. The method of claim 1 wherein the new search comprises a push message instructing a responding node to upload a file.

10. The method of claim I wherein the file sharing network is a peer-to-peer network. 10

11. A system to monitor searches made in a computer network comprising: a storage device configured to store criteria representing information requested in a file sharing network; a monitoring unit configured to detect a search request of a node in the file sharing network; 15 a processor coupled to the monitoring unit and configured to compare the detected search request to the criteria; if the search request matches the criteria, generate updated criteria based on variations of the detected search request; 20 cause a new search to be issued on the file sharing network using the updated criteria; and store a response to the new search.

12. The system of claim 11 wherein the response to the new search includes a unique 25 identifier.

13. The system of claim 12 wherein the unique identifier includes a network address of a node responding to the new search. 30

14. The system of claim 12 wherein the unique identifier includes a shared file folder location. 953R71 -19

15. The system of claim I1 wherein the updated criteria further includes private information that an organization or individual intends should not be shared on the file sharing network. A53R71