METHOD AND SYSTEM FOR PROFILING DATA COMMUNICATION ACTIVITY OF USERS OF MOBILE DEVICES

• US 20120071131A1
• Filed: 09/20/2011
• Published: 03/22/2012
• Est. Priority Date: 09/21/2010
• Status: Abandoned Application

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: ZISAPEL, Roy, PELES, Amir, CHESLA, Avi
• Application Number:
  US13/237,588
• Publication Number:
  US 20120071131A1
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method for profiling data communication activity of users of mobile devices, comprises sniffing traffic flows between a mobile device and the Internet through a cellular network; extracting a plurality of traffic attributes included in the traffic flows and associated with the mobile device; logging the extracted plurality of traffic attributes; analyzing the plurality of traffic attributes for generating a user profile for a user of the mobile device based on the plurality of traffic attributes, wherein the user profile includes at least one of an advertising targeted user profile and a security targeted user profile; and sharing information and alerts related to the generated user profile with at least one external system.

Claims

1. A method for profiling data communication activity of users of mobile devices, comprising:

sniffing traffic flows between a mobile device and the Internet through a cellular network;

extracting a plurality of traffic attributes included in the traffic flows and associated with the mobile device;

logging the extracted plurality of traffic attributes;

analyzing the plurality of traffic attributes for generating a user profile for a user of the mobile device based on the plurality of traffic attributes, wherein the user profile includes at least one of an advertising targeted user profile and a security targeted user profile; and

sharing information and alerts related to the generated user profile with at least one external system.

2. The method of claim 1, wherein the plurality of traffic attributes include at least an Internet protocol (IP) address of the mobile device, a destination address of a request sent by the mobile device, a destination uniform resource locator (URL), a requested content and its type, keywords in submitted search queries, and keywords in request data.

3. The method of claim 2, wherein the plurality of traffic attributes further include at least one of:

request parameters, response parameters, reply data, keywords in reply data, length of reply data, a response time of the mobile device, a response time of a web server receiving the request, a packet loss ratio, a retransmission rate, a number of open IP connections per second, a number of simultaneous IP connections, an average connection duration, a maximum connection duration, a number of transferred data bytes per an IP connection, a number of packets transferred per layer 4 connection, a distribution of destination IP addresses, distribution of destination port numbers, a ratio of requests to replies in packets and bytes, an error response rates, a distribution of transmission and application protocols, a number of transferred packets per second, and an average size of data transferred per second.

4. The method of claim 1, wherein generating the advertising targeted user profile further comprises:

correlating one or more of the plurality of traffic attributes with at least one of;

demographic information, location information, and categorization information.

5. The method of claim 4, wherein the advertising targeted user profile describes the browsing activity of an actual user of the mobile device and allows predicting advertisements that are of interest to the user.

6. The method of claim 5, wherein an identity of the user is known by crossing the Internet protocol (IP) address of the user with at least a personal identifier of the mobile device.

7. The method of claim 5, wherein the advertising targeted user profile includes at least one of:

a category of interest, a short-term interest, a specific interest, an audience list, a browsing history, browsing patterns, and a browsing experience.

8. The method of claim 7, wherein the short-term interest is generated by correlating URLs requested by the user during a predefined time interval with the web categorization information.

9. The method of claim 7, wherein the browsing history profile of a user is generated by analyzing logged transactions of the user over a predefined period of time.

10. The method of claim 7, wherein the browsing patterns are determined based on an average time that the user accesses the Internet through the mobile device, types of actions that the user performed while browsing, and a type of content that the user accessed.

11. The method of claim 7, wherein the browsing experience is generated by processing any error messages in responses sent to the mobile device of the user, a packet loss rate, and the transmission rate of the traffic.

12. The method of claim 7, wherein the audience list includes a list of user identities of users having at least the same short term interest.

13. The method of claim 5, further comprises sharing:

the advertising targeted user profile with at least one of;

a publisher server and an advertiser server.

14. The method of claim 13, wherein the sharing is in response to a request from the at least one of:

the publisher server and the advertiser server.

15. The method of claim 3, wherein the security targeted user profile defines a normal baseline behavior of the data communication activity of a user of the mobile device.

16. The method of claim 15, wherein generating the security targeted user profile comprises statistically processing the plurality of traffic attributes during a learning period.

17. The method of claim 16, wherein the security targeted user profile defines at least:

an average number of packets, an average data rate, a normal distribution of destination IP addresses, a normal distribution of destination port numbers, an average time of connection duration, and a list of commonly accessed web sites being accessed by the user.

18. The method of claim 15, further comprising:

comparing incoming traffic to the security targeted user profile to detect deviation from the security targeted user profile, wherein a deviation is an indication of a potential malicious attack.

19. The method of claim 18, wherein the malicious attack is at least one of:

a network denial-of-service (DoS) attack, an application DoS attack, a network scanning, an application scanning, a session hijacking, a brute-force attack, an impersonator attack.

20. The method of claim 18, further comprising:

generating a security alert upon detection of a deviation from the security targeted user profile; and

sending the security alert to a blocking engine to block the potential attack, wherein the blocking engine is at least one of;

a provisioning system of an operator of the cellular network or a network firewall.

21. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1.

25. The method of claim 21, wherein the sharing is in response to a request from the at least one of:

the publisher and the advertiser server.

26. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 21.

22. A method for targeting advertisement content to users of a mobile network, comprising:

sniffing traffic flows between a mobile device and the Internet through a cellular network;

extracting a plurality of traffic attributes included in the traffic flows associated with the mobile device;

logging the extracted plurality of traffic attributes;

generating an advertising targeted user profile for a user of the mobile device based on the plurality of traffic attributes and at least one of demographic information, location information, and categorization information; and

sharing the generated advertising targeted user profile with at least one of a publisher server and an advertiser server to provide at least advertisements that are of interest to the user.

23. The method of claim 22, wherein an identity of the user is known by crossing the Internet protocol (IP) address of the user with at least a personal identifier of the mobile device.

24. The method of claim 22, wherein the advertising targeted user profile includes at least one of:

a category of interest, a short-term interest, a specific interest, an audience list, a browsing history, browsing patterns, and a browsing experience.

27. A system for profiling data communication activity of users of mobile devices, comprising:

a traffic logger for sniffing traffic flows between a mobile device and the Internet through a cellular network and extracting a plurality of traffic attributes included in the traffic flows and associated with the mobile device;

an analyzer for analyzing the plurality of traffic attributes to generate a user profile for the user of the mobile device based, in part, on the plurality of traffic attributes, wherein the user profile includes at least one of an advertising targeted user profile and a security targeted user profile;

a database for saving the generated user profile; and

a profiling interface for interfacing with at least one external system for providing information and alerts related to the generated user profile.

28. The system of claim 27, wherein the plurality of traffic attributes include at least an Internet protocol (IP) address of the mobile device, a destination address of a request sent by the mobile device, a destination uniform resource locator (URL), a requested content and its type, keywords submitted in search queries, keywords in request data,

29. The system of claim 28, wherein the plurality of traffic attributes further include at least one of:

request parameters, response parameters, reply data, keywords in reply data, a length of reply data, a response time of the mobile device, a response time of a web server receiving the request, a packet loss ratio, a retransmission rate, a number of open IP connections per second, a number of simultaneous IP connections, an average connection duration, a maximum connection duration, a number of transferred data bytes per an IP connection, a number of packets transferred per layer 4 connection, a distribution of destination IP addresses, a distribution of destination port numbers, a ratio of requests to replies in packets and bytes, an error response rate, a distribution of transmission and application protocols, a number of transferred packets per second, and an average size of data transferred per second.

30. The system of claim 27, wherein the analyzer is configured to generate the advertising targeted user profile by correlating one or more of the plurality of traffic attributes with the least one of demographic information, location information, and categorization information.

31. The system of claim 27, wherein the advertising targeted user profile describes the browsing activity of an actual user of the mobile device and allows predicting advertisements that are of interest to the user.

32. The system of claim 27, wherein an identity of the user is known by crossing the internet protocol (IP) address of the user with at least a personal identifier of the mobile device.

33. The system of claim 30, wherein the advertising targeted user profile includes at least one of:

a category of interest, a short-term interest, a specific interest, an audience list, a browsing history, browsing patterns, and a browsing experience.

34. The system of claim 33, wherein the analyzer is configured to generate the short-term interest by correlating URLs requested by the user during a predefined time interval with the web categorization information.

35. The system of claim 33, wherein the analyzer is configured to generate the browsing history profile of the user by analyzing logged transactions of the user over a predefined period of time.

36. The system of claim 33, wherein the analyzer is configured to determine the browsing patterns based on an average time that the user accesses the Internet through the mobile device, types of actions that the user performed while browsing, and a type of content that the user accessed.

37. The system of claim 33, wherein the analyzer is configured to determine the browsing experience by processing error messages included in responses sent to the mobile device of the user, a packet loss rate, and the transmission rate of the traffic.

38. The system of claim 33, wherein the audience list includes a list of user identities of users having at least the same short term interest.

39. The system of claim 33, wherein the profiling interface is configured to share at least one of the advertising targeted user profile, usage alerts, and an audience list with at least one of:

a publisher server and an advertiser server.

40. The system of claim 39, wherein the sharing is in response to a request from the at least one of:

the publisher server and the advertiser server.

41. The system of claim 28, wherein the security targeted user profile defines a normal baseline behavior of the browsing activity of a user of the mobile device.

42. The system of claim 41, wherein the analyzer is configured to generate the security targeted user profile by statistically processing the plurality of traffic attributes during a learning period.

43. The system of claim 41, wherein the security targeted user profile defines at least one of:

an average number of packets, an average data rate, a normal distribution of destination IP addresses, a normal distribution of IP port numbers, an average time of connection duration, and a list of commonly accessed web sites being accessed by the user.

44. The system of claim 41, further comprising:

a security engine for comparing incoming traffic flows to the security targeted user profile to detect a deviation from the security targeted user profile, wherein the deviation is an indication for a potential malicious attack; and

generating a security alert upon detection of a deviation from the security targeted user profile.

45. The system of claim 44, wherein the malicious attack includes at least one of:

a network denial-of-service (DoS) attack, an application DoS attack, a network scanning, an application scanning, a session hijacking, a brute-force attack, an impersonator attack.

46. The system of claim 44, wherein the profiling interface is further configured to

send the security alert to a blocking engine to block the potential attack, wherein the blocking engine is at least one of:

a provisioning system of an operator of the cellular network and a network firewall.

47. The system of claim 27, wherein the cellular network is at least one of:

GSM, CDMA, TDMA, 3G, and LTE, and combination thereof.