Processing multiple network address observations

• US 10,536,428 B2
• Filed: 07/11/2014
• Issued: 01/14/2020
• Est. Priority Date: 07/12/2013
• Status: Active Grant

• Current Assignee: Skyhook Wireless Incorporated (Liberty Broadband Corp.)
• Original Assignee: Skyhook Wireless Incorporated (Liberty Broadband Corp.)
• Inventors: Alizadeh-Shabdiz, Farshid, Brachet, Nicolas, Dancus, Andrei, Jones, Russel Kipp, Morgan, Edward James, Polak, George, Steger, Christopher, Sutton, Richard
• Primary Examiner(s): Williams, Clayton R
• Assistant Examiner(s): Robinson, Christopher B
• Application Number:
  US14/329,449
• Publication Number:
  US 20150019758A1
• Time in Patent Office: 2,013 Days
• Field of Search: None
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/0846 based on copy from other elements
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 61/4505 using standardised directories; using standardised directory access protocols
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

In one embodiment, a processing technique is provided that utilizes multiple network address observations. One or more records are obtained that maintain network address observations, each network address observation associating one or more attributes with a network address observed by one or more source devices. Multiple network addresses from the network address observations are clustered into one or more discrete groups of network addresses based on a clustering criteria. For a selected group of network addresses, an association is formed associating one or more refined attributes derived from the selected group with an individual network address that is a member of the selected group.

Claims

1. A method for processing network address observations to produce associations in a database, comprising:

capturing network address observations of multiple different network addresses, each network address observation captured by a source device or a network node of a network and associating one or more attributes with a network address;

clustering, by a network address to attribute association system executed on one or more electronic devices, the network address observations into one or more discrete groups that represent states of the network addresses, wherein a state is a distinct mode of operation or allocation of a network address and at least a subset of the multiple different network addresses have multiple states, the clustering based on at least one of a common location, time, user or device being associated with the network address observations;

for a selected group of network address observations that represents a state of the network addresses,

deriving, by the network address to attribute association system, one or more refined attributes based on network address observations of the selected group, the one or more refined attributes including an estimated location for the group, and

associating, by the network address to attribute association system, the one or more refined attributes derived from network address observations of the selected group with an individual network address;

producing, by the network address to attribute association system, an association between the one or more refined attributes and the individual network address in a profile maintained in the database, the database stored on a storage device of the one or more electronic devices; and

providing an output to a service provider that includes the one or more refined attributes in response to the individual network address.

2. The method of claim 1, wherein the network address is an Internet Protocol (IP) address associated with the source device.

3. The method of claim 1, wherein the clustering determines one or more times at which the subset of the multiple different network addresses that have multiple states transition between ones of the multiple states.

4. The method of claim 1, wherein the clustering is based on a common location being associated with the multiple different network address observations.

5. The method of claim 1, wherein the clustering is based on a common time being associated with the multiple different network address observations.

6. The method of claim 1, wherein the clustering is based on a common user or device being associated with the multiple different network address observations.

7. The method of claim 1, further comprising:

receiving one or more new network addresses; and

adding the one or more new network addresses to a group of network addresses that includes the individual network address.

8. The method of claim 7, wherein the refined attributes include a classification criteria, and the method further comprises:

classifying the one or more new network addresses as belonging to a classification based on the classification criteria.

9. The method of claim 8, wherein the one or more new network addresses is an individual new network address and the classification criteria includes a measure of likelihood that the individual new network address belongs to the classification.

10. The method of claim 8, wherein one or more new network addresses is a group of new network addresses, and the classification criteria includes a measure of likelihood that the group of new network addresses belong to the classification.

11. The method of claim 8, wherein one or more new network addresses is an individual new network address, and the classification criteria includes a measure of likelihood that a group of new network addresses that the individual new network address is a member of belongs to the classification.

12. The method of claim 8, wherein the classification represents a segment.

13. A method for processing network address observations to produce associations in a database, comprising;

capturing network address observations, the network address observations captured by a source device or a network node of a network and associating one or more attributes with a network address;

determining, by a network address to attribute association system executed on one or more electronic devices, states of the network address, each state representing a distinct mode of operation or allocation of the network address, wherein the network address has multiple distinct modes of operation or allocations;

separately associating, by the network address to attribute association system, at least one refined attribute derived from the network address observations with each state of the network address, the at least one refined attribute including an estimated location; and

producing, by the network address to attribute association system, an association between the at least one refined attribute and the respective state of the network address in a profile maintained in the database, the database stored on a storage device of the one or more electronic devices; and

providing an output to a service provider that includes the one or more refined attributes in response to the network address.

14. The method of claim 13, wherein the network address is an Internet Protocol (IP) address associated with the source device.

15. The method of claim 13, wherein the determining states further comprises:

determining one or more times at which the one or more network addresses transition between states of the multiple states.

16. A non-transitory electronic-device readable medium having executable instructions stored thereon, the executable instructions when executed by one or more processors of one or more electronic devices operable to:

capture network address observations of multiple different network addresses, each network address observation captured by a source device or a network node of a network and associating one or more attributes with a network address;

cluster the network address observations into one or more discrete groups that represent states of network addresses, wherein a state is a distinct mode of operation or allocation of a network address and at least a subset of the multiple different network addresses have multiple states;

for a selected group, associate one or more estimated locations derived from network address observations of the selected group with an individual network address;

produce, an association in a database between the one or more estimated locations and the individual network address; and

providing an output to a service provider that includes the one or more estimated locations in response to the individual network address.

17. The non-transitory electronic-device readable medium of claim 16, wherein the network address is an internet protocol (IP) address associated with the source device.