Differentiating a User from Multiple Users Based on a Determined Pattern of Network Usage

• US 20100100618A1
• Filed: 10/22/2008
• Published: 04/22/2010
• Est. Priority Date: 10/22/2008
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: KUHLKE, Matthew, Toebes, John, Gatzke, Alan Darryl, Jouret, Guido, Jacobs, Philip Clifford
• Application Number:
  US12/256,000
• Publication Number:
  US 20100100618A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

In one embodiment, a method comprises detecting, by an apparatus, first network activity within a time interval on at least a first user device at a user premises, the first user device usable by first and second users; determining from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern; detecting, by the apparatus, second network activity on the first user device at the user premises following the time interval; and selectively identifying the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

Claims

1. A method comprising:

detecting, by an apparatus, first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises;

determining by the apparatus from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

detecting, by the apparatus, second network activity on the first user device at the user premises following the time interval; and

selectively identifying by the apparatus the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

2. The method of claim 1, wherein the determining includes:

first determining the first network activity includes at least one of video navigation selection commands from the first user device, or addressable video streams presented at the user premises in response to the video navigation selection commands,

second determining the first pattern as a first identifiable sequence of at least a first subset of the addressable video streams, and

third determining the second pattern as a second identifiable sequence of at least a second subset of the addressable video streams.

3. The method of claim 2, wherein:

the selectively identifying includes determining the second network activity includes at least one of second video navigation selection commands from the first user device, at least a third subset of the addressable video streams presented in response to the second video navigation selection commands, or second addressable video streams presented at the user premises in response to the second video navigation selection commands;

the method further comprising identifying each of the addressable video streams presented at the user premises by at least one of a video provider identifier specifying a video provider supplying the corresponding addressable video stream, metadata describing the corresponding addressable video stream, or a channel guide identifier identifying the addressable video stream as a prescribed video channel guide.

4. The method of claim 1, wherein the determining includes:

first determining the first network activity as including hypertext transport protocol (HTTP) requests specifying respective first destination websites reachable by the apparatus via an Internet Protocol (IP) based wide area network,

second determining the first pattern as a first identifiable sequence of at least a first subset of the HTTP requests, and

third determining the second pattern as a second identifiable sequence of at least a second subset of the HTTP requests;

wherein the selectively identifying includes determining the second network activity includes at least a third subset of the HTTP requests.

5. The method of claim 1, further comprising identifying first and second portions of the time interval based on:

detecting the first pattern from the first user device having a first determined input frequency followed by a first detected idle interval; and

detecting the second pattern from the first user device following the determined idle interval and having a second determined input frequency followed by a second detected idle interval;

the first portion identified as containing the first pattern occurring before the first detected idle interval and the second portion identified as between the first detected idle interval and second detected idle interval.

6. The method of claim 5, wherein the first and second idle intervals are identified based on a determined absence of any user input to the first user device, including any keystroke input, speech input, or pointing device movement to the first user device.

7. The method of claim 1, wherein the selectively identifying includes determining the correlation between the first pattern of network usage and a determined third pattern of network usage within the second network activity.

8. The method of claim 7, wherein:

the detecting of the second network activity is detected relative to a second time interval following the first time interval;

the selectively identifying including determining a second correlation between a first portion of the time interval and the second time interval, the first pattern of network usage associated with the first user within the first portion of the time interval and the second pattern of network usage associated with the second user within a second portion of the time interval, the second correlation relative to at least one of a time of day, a day of week, or a duration of the first pattern relative to a duration of the third pattern.

9. The method of claim 1, further comprising the apparatus supplying the identification of the second network activity as performed by the first user based on at least one of:

the apparatus receiving a request, from the first user device during the second network activity, for a network service reachable by the apparatus, appending to the request a user identifier, and forwarding the request with the user identifier to the network service;

or

the apparatus receiving the request and forwarding the request without the user identifier to the network service, a receiving a query from the network service, and the apparatus responding to the query by supplying to the network service the user identifier.

10. The method of claim 1, wherein the determining includes:

first determining the first network activity includes an identifiable group of network services requested by the first user device and reachable by the apparatus, each network service having a corresponding transport layer port identifier,

second determining the first pattern as a first identified subset of the identifiable group, and

third determining the second pattern as a second identified subset of the identifiable group;

wherein the selectively identifying includes determining the second network activity as including at least a third subset of the network services.

11. The method of claim 1, further comprising generating an updated first pattern of network usage associated with the first user based on merging the first pattern of network usage with the second network activity in response to identifying a second network activity as performed by the first user.

12. An apparatus comprising:

a device interface circuit configured for detecting first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises; and

a processor circuit configured for determining from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

the device interface circuit further configured for detecting second network activity on the first user device at the user premises following the time interval;

the processor circuit further configured for selectively identifying the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

13. The apparatus of claim 12, wherein:

the first network activity is determined by the processor circuit as including at least one of video navigation selection commands from the user device, or addressable video streams presented at the user premises in response to the video navigation selection commands;

the processor circuit configured for determining the first pattern as a first identifiable sequence of at least a first subset of the addressable video streams, and the second pattern as a second identifiable sequence of at least a second subset of the addressable video streams.

14. The apparatus of claim 13, wherein the processor circuit is configured for:

determining the second network activity as including at least one of second video navigation selection commands from the first user device, at least a third subset of the addressable video streams presented in response to the second video navigation selection commands, or second addressable video streams presented at the user premises in response to the second video navigation selection commands; and

identifying each of the addressable video streams presented at the user premises by at least one of a video provider identifier specifying a video provider supplying the corresponding addressable video stream, metadata describing the corresponding addressable video stream, or a channel guide identifier identifying the addressable video stream as a prescribed video channel guide.

15. The apparatus of claim 12, wherein:

the first network activity is determined by the processor circuit as including hypertext transport protocol (HTTP) requests specifying respective first destination websites reachable by the apparatus via an Internet Protocol (IP) based wide area network;

the processor circuit configured for determining the first pattern as a first identifiable sequence of at least a first subset of the HTTP requests, and the second pattern as a second identifiable sequence of at least a second subset of the HTTP requests;

the second network activity detected by the processor circuit as including at least a third subset of the HTTP requests.

16. The apparatus of claim 12, wherein the processor circuit is configured for identifying first and second portions of the time interval based on:

detecting the first pattern from the first user device having a first determined input frequency followed by a first detected idle interval; and

detecting the second pattern from the first user device following the determined idle interval and having a second determined input frequency followed by a second detected idle interval;

the first portion identified by the processor circuit as containing the first pattern occurring before the first detected idle interval and the second portion identified by the processor circuit as between the first detected idle interval and second detected idle interval.

17. The apparatus of claim 16, wherein the processor circuit is configured for identifying the first and second idle intervals based on a determined absence of any user input to the first user device, including any keystroke input, speech input, or pointing device movement to the first user device.

18. The apparatus of claim 12, wherein the processor circuit is configured for determining the correlation between the first pattern of network usage and a determined third pattern of network usage within the second network activity.

19. The apparatus of claim 18, wherein the processor circuit is configured for:

detecting the second network activity relative to a second time interval following the first time interval; and

determining a second correlation between a first portion of the time interval and the second time interval, the first pattern of network usage associated with the first user within the first portion of the time interval and the second pattern of network usage associated with the second user within a second portion of the time interval, the second correlation relative to at least one of a time of day, a day of week, or a duration of the first pattern relative to a duration of the third pattern.

20. The apparatus of claim 12, wherein the processor circuit is configured for supplying the identification of the second network activity as performed by the first user based on at least one of:

the processor circuit determining a request, received by the device interface circuit from the first user device during the second network activity, for a network service reachable by the apparatus, the processor circuit appending to the request a user identifier, and the device interface circuit forwarding the request with the user identifier to the network service;

or

the device interface circuit receiving the request and forwarding the request without the user identifier to the network service, the device interface circuit receiving a query from the network service, and the processor circuit responding to the query by supplying to the network service the user identifier.

21. The apparatus of claim 12, wherein:

the first network activity is determined by the processor circuit as including an identifiable group of network services requested by the first user device and reachable by the apparatus, each network service having a corresponding transport layer port identifier;

the processor circuit configured for determining the first pattern as a first identified subset of the identifiable group, and determining the second pattern as a second identified subset of the identifiable group;

the second network activity determined by the processor circuit as including at least a third subset of the network services.

22. The apparatus of claim 12, wherein the processor circuit is configured for generating an updated first pattern of network usage associated with the first user based on merging the first pattern of network usage with the second network activity in response to identifying a second network activity as performed by the first user.

23. An apparatus comprising:

a device interface circuit configured for detecting first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises; and

means for determining from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

the device interface circuit further configured for detecting second network activity on the first user device at the user premises following the time interval;

the means for determining further configured for selectively identifying the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

24. Logic encoded in one or more tangible media for execution and when executed operable for:

detecting, by an apparatus executing the logic, first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises;

determining by the apparatus from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

detecting, by the apparatus, second network activity on the first user device at the user premises following the time interval; and

selectively identifying by the apparatus the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

25. A method comprising:

detecting, by an apparatus, first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises;

determining by the apparatus from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

detecting, by the apparatus, second network activity on a second user device at the user premises following the time interval; and

selectively identifying by the apparatus the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.

26. An apparatus comprising:

a device interface circuit configured for detecting first network activity within a time interval on at least a first user device at a user premises, the first user device usable by at least first and second users and distinct from the apparatus, the apparatus positioned at the user premises; and

a processor circuit configured for determining from the first network activity a first pattern of network usage associated with the first user and a second pattern of network usage associated with the second user, the second pattern distinct from the first pattern;

the device interface circuit further configured for detecting second network activity on a second user device at the user premises following the time interval;

the processor circuit further configured for selectively identifying the second network activity as performed by the first user based on a determined correlation between the second network activity and the first pattern of network usage.