Internet activity, internet connectivity and nearby Wi-Fi and local network device presence monitoring sensor

• US 10,257,295 B1
• Filed: 07/27/2016
• Issued: 04/09/2019
• Est. Priority Date: 07/29/2015
• Status: Active Grant

• Current Assignee: Alarm.com Inc. (Alarm.com Holdings, Inc.)
• Original Assignee: Alarm.com Inc. (Alarm.com Holdings, Inc.)
• Inventors: Alpert, Charles Richard, Perry, Roy Franklin, Trundle, Stephen Scott, Slavin, Alison Jane
• Primary Examiner(s): Dailey, Thomas J
• Application Number:
  US15/220,622
• Time in Patent Office: 986 Days
• Field of Search: None
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users

Abstract

In some implementations, a system can monitor Internet activity, internet connectivity, and nearby Wi-Fi and local network presence associated with a local network. Internet activity data of a network of a property over a particular period of time is initially obtained. Occupancy data from one or more devices associated with the property is then obtained. The occupancy data indicates a physical presence of people within the property over the particular period of time. An abnormality associated with the network of the property is then identified based on the obtained Internet activity data and the obtained occupancy data. An indication of the abnormality associated with the network of the property is then provided in response to identifying the abnormality associated with the network.

Claims

1. A method performed by one or more computers, the method comprising:

obtaining network activity data on a device within a property over a particular time period,

obtaining, occupancy data indicating a physical presence of people within the property over the particular time period;

determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied; and

in response to determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied, providing an indication to a user that network security within the property is likely to be breached.

2. The method of claim 1, wherein the occupancy data indicating the physical presence of people within the property over the particular time period comprises data indicating whether individuals that are identified to be associated with the device are physically present within the property.

3. The method of claim 1, wherein the network activity data on the device comprises:

data indicating outgoing connection requests from the device to webpages;

IP addresses associated with the devices connected over the network; and

a bandwidth utilization of the network over the particular time period.

4. The method of claim 1, wherein determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied comprises:

determining that obtained network activity data indicates an abnormally high activity for the device over the network of the property;

determining, based on the obtained presence data, that the device has not been physically used within the property over the particular time period; and

in response to determining that the device has not been physically used within the property over the particular period of time, determining that the abnormally high activity for the device is likely caused by computer malware.

5. The method of claim 1, wherein determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied comprises:

determining that obtained network activity data indicates an abnormally high activity for the device over the network of the property;

identifying a user that has previously been associated with the device within the property;

determining, based on the obtained occupancy data, that the user has not been physically present within the property over the particular time period; and

determining that the obtained network activity data indicates that the device was used by an unauthorized user during the particular time period.

6. The method of claim 1, wherein the indication comprises:

a destination IP address associated with the device;

one or more time stamps corresponding to one or more incoming connections from the destination IP address over the network of the property; and

an indication that the device is infected with computer malware.

15. The method of claim 1, wherein obtaining, from one or more devices associated with the property, occupancy data indicating a physical presence of people within the property over the particular time period comprises:

obtaining video taken by a camera within the property; and

determining that the video indicates that a person was not physically present in the property during the particular time period.

16. The method of claim 15, wherein determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied comprises:

determining that the network activity data for the device within the property indicates an abnormal increase in network traffic for the device while video from a camera within the property indicates that no one is physically present at the property.

7. A system comprising:

one or more computers; and

one or more storage devices storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising;

obtaining network activity data on a device within a property over a particular time period,

obtaining, occupancy data indicating a physical presence of people within the property over the particular time period;

determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied; and

in response to determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied, providing an indication to a user that network security within the property is likely to be breached.

8. The system of claim 7, wherein the occupancy data indicating the physical presence of people within the property over the particular time period comprises data indicating whether individuals that are identified to be associated with the device are physically present within the property.

9. The system of claim 7, wherein the network activity data on the device comprises:

data indicating outgoing connection requests from the device to webpages;

IP addresses associated with the devices connected over the network; and

a bandwidth utilization of the network over the particular time period.

10. The system of claim 7, wherein determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied comprises:

determining that obtained network activity data indicates an abnormally high activity for the device over the network of the property;

determining, based on the obtained presence data, that the device has not been physically used within the property over the particular time period; and

in response to determining that the device has not been physically used within the property over the particular period of time, determining that the abnormally high activity for the device is likely caused by computer malware.

11. A non-transitory computer-readable storage device encoded with computer program instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

obtaining network activity data on a device within a property over a particular time period,

obtaining, occupancy data indicating a physical presence of people within the property over the particular time period;

determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied; and

in response to determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied, providing an indication to a user that network security within the property is likely to be breached.

12. The non-transitory computer-readable storage device of claim 11, wherein the occupancy data indicating the physical presence of people within the property over the particular time period comprises data indicating whether individuals that are identified to be associated with the device are physically present within the property.

13. The non-transitory computer-readable storage device of claim 11, wherein the network activity data on the device comprises:

data indicating outgoing connection requests from the device to webpages;

IP addresses associated with the devices connected over the network; and

a bandwidth utilization of the network over the particular time period.

14. The non-transitory computer-readable storage device of claim 11, wherein determining (i) that the network activity data for the device within the property indicates abnormal network traffic for the device and (ii) that the abnormal network traffic occurred over the particular time period for which the occupancy data indicated that the property was unoccupied comprises:

determining that obtained network activity data indicates an abnormally high activity for the device over the network of the property;

determining, based on the obtained presence data, that the device has not been physically used within the property over the particular time period; and

in response to determining that the device has not been physically used within the property over the particular period of time, determining that the abnormally high activity for the device is likely caused by computer malware.