System and method for passive decoding of social network activity using replica database

• US 20140095700A1
• Filed: 07/29/2013
• Published: 04/03/2014
• Est. Priority Date: 07/29/2012
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Kaushansky, Amir
• Granted Patent: US 10,298,622 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04L 63/304 intercepting circuit switched data communications lawful interception of wireless network communications H04W12/02
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Methods and systems for obtaining reconstructing activities of target users in social networks, such as for decoding and displaying social network sessions held by a target user, or identifying other users who are associated with the target user. This analysis is typically carried out based on passive monitoring of network traffic. A social network decoding system constructs and maintains a replica database, which mimics a portion of the user profile database maintained by the social network servers. The social network decoding system monitors network traffic between users and social network servers. Based on the monitored traffic, the system gradually constructs a replica database that attempts to replicate a portion of the social network user profile database, relating to one or more predefined target users. Using the replica database, the system is able to correlate loosely-coupled information objects, events and interactions between the target users and social network pages.

Claims

1. A method, comprising:

monitoring communication between one or more users of a communication network and one or more servers of a social network that maintains a user profile database;

based on the monitored communication, constructing a replica database that replicates a portion of the user profile database relating to one or more predefined target users; and

reconstructing activity of a target user in the social network using the monitored communication and the replica database.

2. The method according to claim 1, wherein constructing the replica database comprises establishing a correlation between first and second information objects extracted from the monitored communication, and wherein reconstructing the activity comprises deducing the activity of the target user from the correlation.

3. The method according to claim 2, wherein establishing the correlation comprises correlating a page of the social network with a response made to an element of the page.

4. The method according to claim 2, wherein establishing the correlation comprises correlating first and second objects posted at different times on a page of the social network.

5. The method according to claim 1, wherein reconstructing the activity comprises reconstructing one or more sessions conducted by the target user in the social network.

6. The method according to claim 1, wherein reconstructing the activity comprises reconstructing one or more links of the target user with respective other users of the social network.

7. The method according to claim 1, wherein monitoring the communication comprises passively receiving the communication without affecting the communication network or the social network.

8. The method according to claim 1, wherein reconstructing the activity comprises detecting an event related to the activity of the target user in the social network, and outputting an indication of the event.

9. The method according to claim 8, wherein detecting the event comprises detecting, using the replica database, that the target user deleted a contact from his list of contacts.

10. The method according to claim 8, wherein detecting the event comprises detecting, using the replica database, a new comment that is added to a given information object.

11. Apparatus, comprising:

a network interface, which is configured to monitor communication between one or more users of a communication network and one or more servers of a social network that maintains a user profile database; and

a processing unit, which is configured to construct, based on the monitored communication, a replica database that replicates a portion of the user profile database relating to one or more predefined target users, and to reconstruct activity of a target user in the social network using the monitored communication and the replica database.

12. The apparatus according to claim 11, wherein the processing unit is configured to establish a correlation between first and second information objects extracted from the monitored communication, and to deduce the activity of the target user from the correlation.

13. The apparatus according to claim 12, wherein the processing unit is configured to establish the correlation by correlating a page of the social network with a response made to an element of the page.

14. The apparatus according to claim 12, wherein the processing unit is configured to establish the correlation by correlating first and second objects posted at different times on a page of the social network.

15. The apparatus according to claim 11, wherein the processing unit is configured to reconstruct the activity by reconstructing one or more sessions conducted by the target user in the social network.

16. The apparatus according to claim 11, wherein the processing unit is configured to reconstruct the activity by reconstructing one or more links of the target user with respective other users of the social network.

17. The apparatus according to claim 11, wherein the network interface is configured to passively receive the communication without affecting the communication network or the social network.

18. The apparatus according to claim 11, wherein the processing unit is configured to detect an event related to the activity of the target user in the social network, and to output an indication of the event.

19. The apparatus according to claim 18, wherein the processing unit is configured to detect, using the replica database, that the target user deleted a contact from his list of contacts.

20. The apparatus according to claim 18, wherein the processing unit is configured to detect, using the replica database, a new comment that is added to a given information object.