Patent ID: 7958228

Claim:
A computer-implemented method for constructing network activity profiles, comprising: obtaining a plurality of records of network activities originating from an activity source, the activity source corresponding to a particular user account, network browser or application program, on the network, and each record corresponding to an interaction by the activity source with a network resource via the network, wherein each record comprises at least a network endpoint address associated with a physical device, the physical device providing access to the network and the network endpoint address used in the interaction between the activity source and the network resource, and wherein each record further comprises an indication of a time of the interaction by the activity source with the network resource; for each record, determining one or more record geographical locations corresponding to the network endpoint address associated with the physical device by mapping the network endpoint address to the geographical location or locations, wherein the determined record geographical location(s) are based in part on a selected desired level or levels of geographic precision; associating the determined record geographical location or locations with that record; and constructing at least one profile for the activity source based on the plurality of records and at least one geographical location associated with the plurality of records, wherein each profile comprises a time-based behavior pattern associated with the at least one geographical location.