Method and Apparatus for Combining Traffic Analysis and Monitoring Center in Lawful Interception

• US 20090007263A1
• Filed: 05/18/2006
• Published: 01/01/2009
• Est. Priority Date: 05/18/2006
• Status: Active Grant

• Current Assignee: Cyberbit Ltd.
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: Frenkel, Assaf, Weinberg, Adam, Ofek, Yossi, Ben-Aroya, Eyal
• Granted Patent: US 7,770,221 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

A method and apparatus for integrating intercepted information with information obtained from an at least one data retention source, the method comprising receiving intercepted information from an interception source, receiving information from a data retention source, and analyzing the information received from the data retention source, in association with the intercepted information. The intercepted information can comprise meta data related to the intercepted communications, and/or the contents of the communication themselves. This enables a user such as a law enforcement agency to reveal possibly indirect connections between target entities s wherein the connections involve non-target entities. The method and apparatus combine interception and content analysis methodologies with traffic analysis techniques.

Claims

1. A method for integrating intercepted communication traffic data or communication traffic content with an at least one stored record, the method comprising the steps of:

receiving intercepted communication traffic data or communication traffic content from an interception source;

receiving an at least one stored record from a data retention source; and

analyzing the at least one stored record in association with the intercepted communication traffic data or communication traffic content.

2. The method of claim 1 wherein the at least one stored record is a communication traffic stored record.

3. The method of claim 1 wherein the at least one stored record is a non-communication traffic stored record.

4. The method of claim 3 wherein the at least one stored record is any of the group consisting of a customer record, a financial record, or a travel record.

5. The method of claim 1 further comprising a querying step for querying the data retention source.

6. The method of claim 1 further comprising a data retrieval step according to one or more criteria.

7. The method of claim 1 wherein the stored record comprises information which is a response to a query addressed to the data retention source.

8. The method of claim 1 further comprising a display step for displaying information to a user.

9. The method of claim 8 wherein the display step displays any one of the following:

an at least one result associated with the analyzing step, raw data, or information related to an operation performed by the user.

10. The method of claim 8 wherein the display step provides graphic presentation of information.

11. The method of claim 10 wherein the graphic representation comprises an at least one connection map.

12. The method of claim 8 wherein the display step provides textual presentation of information.

13. The method of claim 1 further comprising an abstraction step for eliminating information from the at least one stored record.

14. The method of claim 13 wherein the information being eliminated is identifying information.

15. The method of claim 1 further comprising a formatting step for formatting intercepted communication traffic data or communication traffic content or at least one stored record.

16. The method of claim 1 further comprising a storing step for storing intercepted communication traffic data or communication traffic content, or an at least one stored record.

17. The method of claim 16 wherein the storing step stores the intercepted communication traffic data or communication traffic content, or the at least one stored record in a database.

18. An apparatus for integrating intercepted communication traffic data or communication traffic content with at least one stored record, the apparatus comprising:

an at least one storage device for storing the intercepted communication traffic data or communication traffic content or the at least one stored record;

an at least one server comprising an at least one engine for processing information stored in the storage device;

an at least one computing platform comprising an at least one display device for displaying to a user an at least one result obtained by the at least one engine; and

an at least one connection to an at least one service provider database.

19. The apparatus of claim 18 wherein the at least one engine is any of the group of:

an analysis engine;

a query engine;

a filtering engine;

or a security engine.

20. The apparatus of claim 18 further comprising an at least one interception engine for capturing an at least one record from the at least one service provider database.

21. The apparatus of claim 18 wherein the storage device is associated with a monitoring center database or with a call detail record database or with an internet protocol detail record.

22. A computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising:

receiving intercepted communication traffic data or communication traffic content from an interception source;

receiving an at least one stored record from a data retention source; and

analyzing the at least one stored record in association with the intercepted communication traffic data or communication traffic content.