SYSTEM AND METHOD FOR DETERMINING COMMONLY USED COMMUNICATION TERMINALS AND FOR IDENTIFYING NOISY ENTITIES IN LARGE-SCALE LINK ANALYSIS

• US 20120015626A1
• Filed: 09/24/2011
• Published: 01/19/2012
• Est. Priority Date: 04/28/2010
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Corem, Yochai, Segal, Muli, Goldfarb, Eithan
• Granted Patent: US 8,364,147 B2
• Time in Patent Office: Days
• US Class Current: 455/405
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04M 2201/18 Comparators
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

Methods and systems for determining mobile communication terminals (mobiles) that have a common user, or that have a group of users in common. The methods and systems examine change-of-association events of mobiles operating in a network, and correlate the events to determine common mobiles, i.e., mobiles that have the same or similar change-of-association events. The events described are generated by the mobiles themselves automatically, by virtue of the fact that the mobiles are operating in the network. There is thus no need for, and the embodiments described herein do not require, user intervention to generate the events.

Claims

1. A method, comprising:

obtaining at least one first indication of a first communication terminal changing from being associated with a first group of cells of a cellular network to a second group of cells of the network;

computing a correlation between the at least one first indication and second indications of candidate communication terminals changing from being associated with the first group of cells of the cellular network to the second group of cells of the network; and

responsively to the correlation, identifying from among the candidate communication terminals at least one second communication terminal that is associated with the first communication terminal.

2. The method according to claim 1, wherein the first group of cells comprises cells of the network having a common first location area code (LAC) and wherein the second group of cells comprises cells of the network having a common second LAC different from the common first LAC.

3. The method according to claim 1, and comprising generating the at least one first indication in response to a first request transmitted by the first communication terminal, and generating the second indications in response to second requests transmitted by the candidate terminals.

4. The method according to claim 3, wherein the first group of cells comprises cells of the network having a common first location area code (LAC) and wherein the second group of cells comprises cells of the network having a common second LAC different from the common first LAC, and wherein the first request comprises a first location update request (LUR) generated in response to the first communication terminal changing from being associated with the first group to the second group, and wherein the second requests comprise second LURs generated in response to the second communication terminals changing from being associated with the first group to the second group.

5. The method according to claim 4, and comprising analyzing activity of the first and the candidate communication terminals in the network so as to itemize interfering cells associated with at least one of the first communication terminal and the candidate communication terminals, and wherein computing the correlation comprises performing the correlation absent the interfering cells.

6. The method according to claim 5, wherein the interfering cells are itemized in response to determining that at least one of the first and the candidate communication terminals is in a vicinity of a border between the first group and the second group.

7. The method according to claim 5, wherein the interfering cells are itemized in response to determining that a periodic LUR is transmitted by at least one of the first and the candidate communication terminals.

8. The method according to claim 5, wherein the interfering cells are itemized in response to determining that the percentage of time spent by at least one of the first and the candidate communication terminals in a given cell of the first and second group of cells is greater than a predefined threshold percentage.

9. The method according to claim 1, wherein the first communication terminal and the at least one second communication terminal have a single user in common.

10. The method according to claim 1, wherein the first communication terminal and the at least one second communication terminal have a plurality of users who travel over a common path.

11. The method according to claim 1, wherein computing the correlation comprises determining that the first communication terminal changing from being associated with the first group of cells to the second group of cells occurs within a preset time interval of the candidate communication terminals changing from being associated with the first group of cells to the second group.

12. The method according to claim 1, wherein computing the correlation comprises assigning a weight to the correlation in response to a number of occurrences wherein the first communication terminal and the at least one second communication terminal change from being associated with the first group of cells to being associated with the second group of cells.

13. Apparatus, comprising:

an interface which is configured to receive indications of communication terminals changing an association with groups of cells in a cellular network; and

a processor which is configured to;

obtain at least one first indication of a first communication terminal changing from being associated with a first group of cells of the cellular network to a second group of cells of the network,

compute a correlation between the at least one first indication and second indications of candidate communication terminals changing from being associated with the first group of cells of the cellular network to the second group of cells of the network, and

responsively to the correlation, identify from among the candidate communication terminals at least one second communication terminal that is associated with the first communication terminal.

14. The apparatus according to claim 13, wherein the first group of cells comprises cells of the network having a common first location area code (LAC) and wherein the second group of cells comprises cells of the network having a common second LAC different from the common first LAC.

15. The apparatus according to claim 13, and comprising the processor generating the at least one first indication in response to a first request transmitted by the first communication terminal, and generating the second indications in response to second requests transmitted by the candidate terminals.

16. The apparatus according to claim 15, wherein the first group of cells comprises cells of the network having a common first location area code (LAC) and wherein the second group of cells comprises cells of the network having a common second LAC different from the common first LAC, and wherein the first request comprises a first location update request (LUR) generated in response to the first communication terminal changing from being associated with the first group to the second group, and wherein the second requests comprise second LURs generated in response to the second communication terminals changing from being associated with the first group to the second group.

17. The apparatus according to claim 16, and comprising the processor analyzing activity of the first and the candidate communication terminals in the network so as to itemize interfering cells associated with at least one of the first communication terminal and the candidate communication terminals, and wherein computing the correlation comprises performing the correlation absent the interfering cells.

18. The apparatus according to claim 17, wherein the interfering cells are itemized in response to determining that at least one of the first and the candidate communication terminals is in a vicinity of a border between the first group and the second group.

19. The apparatus according to claim 17, wherein the interfering cells are itemized in response to determining that a periodic LUR is transmitted by at least one of the first and the candidate communication terminals.

20. The apparatus according to claim 17, wherein the interfering cells are itemized in response to determining that the percentage of time spent by at least one of the first and the candidate communication terminals in a given cell of the first and second group of cells is greater than a predefined threshold percentage.