Network identity clustering

• US 20080285464A1
• Filed: 05/17/2007
• Published: 11/20/2008
• Est. Priority Date: 05/17/2007
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Katzir, Ziv
• Granted Patent: US 7,882,217 B2
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer-implemented method for communication analysis includes monitoring communication sessions, which are conducted by entities in a communication network. Identifiers that identify the entities are extracted from the monitored sessions. The identifiers extracted from the sessions are grouped in respective identity clusters, each identity cluster identifying a respective entity. A subset of the identity clusters, which includes identifiers that identify a target entity, is merged to form a merged identity cluster that identifies the target entity. An activity of the target entity in the communication network is tracked using the merged identity cluster.

Claims

1. A computer-implemented method for communication analysis, comprising:

monitoring communication sessions, which are conducted by entities in a communication network;

extracting from the monitored sessions identifiers that identify the entities;

grouping the identifiers extracted from the sessions in respective identity clusters, each identity cluster identifying a respective entity;

merging a subset of the identity clusters, which comprise identifiers that identify a target entity, to form an merged identity cluster that identifies the target entity; and

tracking an activity of the target entity in the communication network using the merged identity cluster.

2. The method according to claim 1, wherein the entities comprise individual users of the communication network.

3. The method according to claim 1, wherein the identifiers comprise at least one identifier type selected from a group of types consisting of an Internet Protocol (IP) addresses, a Media Access Control (MAC) address, a Uniform Resource Identifier (URI), a path identifier in a tunneling protocol, a line identifier, a username, an e-mail addresses, a chat nickname, a nickname of an instant messaging application, a username of a peer-to-peer application, a username of a conferencing application, an International Mobile Subscriber Identity (IMSI), a Mobile Station Integrated Services Digital Network (MSISDN), an International Mobile Equipment Identity (IMEI), a Temporary Mobile Subscriber Identity (TMSI), a Voice over Internet Protocol (VoIP) identifier and a telephone number.

4. The method according to claim 1, wherein merging the subset of the identity clusters comprises iteratively searching the identity clusters in order to identify the identity clusters that identify the target entity, and progressively merging the identified identity clusters with one another.

5. The method according to claim 1, wherein merging the subset of the identity clusters comprises identifying in the identity clusters first and second identity clusters comprising a common identifier, and merging the first and second identity clusters.

6. The method according to claim 5, wherein the common identifier has a first validity period in the first identity cluster and a second validity period in the second identity cluster, and wherein merging the first and second identity clusters comprises merging the clusters responsively to verifying that the first validity period overlaps the second validity period.

7. The method according to claim 6, wherein the common identifier comprises a short-lived identifier having a short validity period, wherein the first identity cluster comprises a first long-lived identifier, wherein the second identity cluster comprises a second long-lived identifier different from the first long-lived identifier, and wherein verifying that the first validity period overlaps the second validity period comprises associating the first and second long-lived identifiers with the target entity based on the common short-lived identifier.

8. The method according to claim 1, wherein at least one of the communication sessions comprises a composite session, which comprises multiple sub-sessions having a shared identifier that is common to all the sub-sessions, and wherein extracting and grouping the identifiers comprise identifying the sub-sessions of the composite session using the shared identifier, extracting the identifiers from the identified sub-sessions and grouping the identifiers extracted from the sub-sessions in a respective identity cluster.

9. The method according to claim 1, wherein grouping the identifiers comprises estimating likelihoods that the identifiers grouped in each identity cluster identify the respective entity, and assigning respective scores based on the likelihoods to the grouped identifiers in the identity cluster.

10. The method according to claim 1, wherein merging the subset of the identity clusters comprises estimating likelihoods that the merged identity clusters in the subset identify the target entity and assigning respective scores based on the likelihoods to the merged identity clusters.

11. The method according to claim 1, wherein at least some of the sessions are conducted between service consumers and respective service providers, and wherein extracting the identifiers comprises identifying the service consumers and the service providers, assigning the identifiers that identify the service consumers a first confidence level and assigning the identifiers that identify the service providers a second confidence level lower than the first confidence level.

12. The method according to claim 11, wherein assigning the first and second confidence levels comprises refraining from using the identifiers that identify the service providers.

13. The method according to claim 1, wherein tracking the activity comprises tracking a geographical location of the target entity.

14. The method according to claim 1, wherein merging the identity clusters comprises constructing multiple identity clusters corresponding to respective entities, and wherein tracking the activity comprises determining and presenting one or more relationships between the entities.

15. The method according to claim 1, wherein the communication network comprises first and second communication networks of respective different first and second communication domains, wherein monitoring the communication sessions comprises monitoring a first communication session conducted by the target entity in the first communication network and a second communication session conducted by the target entity in the second communication network, and wherein merging the subset of the identity clusters comprises merging first and second identity clusters derived respectively from the first and second communication sessions into the merged identity cluster.

16. The method according to claim 15, wherein the first communication network comprises a computer communication network and wherein the second communication network comprises a telephony network.

17. Apparatus for communication analysis, comprising:

an interface, which is arranged to accept data of communication sessions conducted by entities in a communication network; and

a processor, which is arranged to extract from the data identifiers that identify the entities, to group the identifiers in identity clusters, each identity cluster identifying a respective entity, to merge a subset of the identity clusters, which comprise identifiers that identify a target entity, to form an merged identity cluster that identifies the target entity, and to track an activity of the target entity in the communication network using the merged identity cluster.

18. The apparatus according to claim 17, wherein the entities comprise individual users of the communication network.

19. The apparatus according to claim 17, wherein the identifiers comprise at least one identifier type selected from a group of types consisting of an Internet Protocol (IP) addresses, a Media Access Control (MAC) address, a Uniform Resource Identifier (URI), a path identifier in a tunneling protocol, a line identifier, a username, an e-mail addresses, a chat nickname, a nickname of an instant messaging application, a username of a peer-to-peer application, a username of a conferencing application, an International Mobile Subscriber Identity (IMSI), a Mobile Station Integrated Services Digital Network (MSISDN), an International Mobile Equipment Identity (IMEI), a Temporary Mobile Subscriber Identity (TMSI), a Voice over Internet Protocol (VoIP) identifier and a telephone number.

20. The apparatus according to claim 17, wherein the processor is arranged to iteratively search the identity clusters in order to identify the identity clusters that identify the target entity, and to progressively merge the identified identity clusters with one another.

21. The apparatus according to claim 17, wherein the processor is arranged to identify in the identity clusters first and second identity clusters comprising a common identifier, and to merge the first and second identity clusters.

22. The apparatus according to claim 21, wherein the common identifier has a first validity period in the first identity cluster and a second validity period in the second identity cluster, and wherein the processor is arranged to merge the first and second identity clusters responsively to verifying that the first validity period overlaps the second validity period.

23. The apparatus according to claim 22, wherein the common identifier comprises a short-lived identifier having a short validity period, wherein the first identity cluster comprises a first long-lived identifier, wherein the second identity cluster comprises a second long-lived identifier different from the first long-lived identifier, and wherein the processor is arranged to associate the first and second long-lived identifiers with the target entity based on the common short-lived identifier.

24. The apparatus according to claim 17, wherein at least one of the communication sessions comprises a composite session, which comprises multiple sub-sessions having a shared identifier that is common to all the sub-sessions, and wherein the processor is arranged to identify the sub-sessions of the composite session using the shared identifier, to extract the identifiers from the identified sub-sessions and to group the identifiers extracted from the sub-sessions in a respective identity cluster.

25. The apparatus according to claim 17, wherein the processor is arranged to estimate likelihoods that the identifiers grouped in each identity cluster identify the respective entity, and to assign respective scores based on the likelihoods to the grouped identifiers in the identity cluster.

26. The apparatus according to claim 17, wherein the processor is arranged to estimate likelihoods that the merged identity clusters in the subset identify the target entity, and to assign respective scores based on the likelihoods to the merged identity clusters.

27. The apparatus according to claim 17, wherein at least some of the sessions are conducted between service consumers and respective service providers, and wherein the processor is arranged to identify the service consumers and the service providers, to assign the identifiers that identify the service consumers a first confidence level and to assign the identifiers that identify the service providers a second confidence level lower than the first confidence level.

28. The apparatus according to claim 27, wherein the processor is arranged to refrain from using the identifiers that identify the service providers.

29. The apparatus according to claim 17, wherein the processor is arranged to track a geographical location of the target entity using the merged identity cluster.

30. The apparatus according to claim 17, wherein the processor is arranged to construct multiple identity clusters corresponding to respective entities, and to determine and present one or more relationships between the entities using the identity clusters.

31. The apparatus according to claim 17, wherein the communication network comprises first and second communication networks of respective different first and second communication domains, wherein the interface is arranged to accept the data of respective first and second communication sessions conducted by the target entity in the first and communication networks, and wherein the processor is arranged to merge first and second identity clusters, which are derived respectively from the first and second communication sessions, into the merged identity cluster.

32. The apparatus according to claim 31, wherein the first communication network comprises a computer communication network and wherein the second communication network comprises a telephony network.

33. A computer software product for communication analysis, the product comprising a computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer to accept data of communication sessions conducted by entities in a communication network, to extract from the data identifiers that identify the entities, to group the identifiers in identity clusters, each identity cluster identifying a respective entity, to merge a subset of the identity clusters, which comprise identifiers that identify a target entity, to form an merged identity cluster that identifies the target entity, and to track an activity of the target entity in the communication network using the merged identity cluster.