Method of surveilling internet communication

• US 7,216,162 B2
• Filed: 01/23/2002
• Issued: 05/08/2007
• Est. Priority Date: 05/24/2000
• Status: Expired due to Term

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Amit, Yoni, Amit, Noah, Eadan, Zvi
• Primary Examiner(s): Jaroenchonwanit; Bunjob
• Assistant Examiner(s): Refai; Ramsey
• Application Number:
  US10/052,349
• Publication Number:
  US 20020116512A1
• Time in Patent Office: 1,931 Days
• Field of Search: 709/224, 709/223, 709/232, 709/203, 726/3, 726/13
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A network probe terminal for surveillance of a network communication line and simulating browser activity of a given terminal is disclosed. The probe terminal monitors TCP/IP data packets routed through the communication line and filters relevant requests and responses relating to a given IP address. These requests and responses are analyzed and sorted according to their type and content. Based on the analysis, the probe terminal identifies all relevant data transactions relating to the navigation process of a given terminal. The probe terminal activates a virtual browser simulating the processing of identified data transactions to create navigation presentations similar to the navigation presentations as seen by the user of a given terminal.

Claims

1. A method of tracking a network communication line by a first terminal simulating original browser activity of a second terminal, the method comprising:

accessing the network communication line,

tracing TCP/IP data packets routed through the network communication line,

selecting TCP/IP data packets relating to an IP address as identified data packets,

selecting from the identified data packets current requests for new connections as original requests,

selecting from the identified data packets current web page components indicating new addresses as new navigation components,

organizing the new navigation components into at least a false new components category comprising at least embedded objects or frames and a true new components category comprising at least hyperlinks,

organizing the original requests into at least a primary request category comprising original requests matching those in the true new components category or original requests failing to match any of those in the true new components category and belonging to HTTP or POST type and a secondary request category comprising original requests matching those in the false new components category or original requests failing to match any of those in the false new components category and not belonging to HTTP or POST type,

selecting, from the identified data packets, HTML data files relating to primary requests as respective primary responses,

generating virtual secondary requests according to the respective secondary responses,

selecting respective secondary responses from the identified data packet responses relating to secondary virtual requests, and

simulating web page presentation on the first terminal according to the respective secondary responses.

2. The method of claim 1 comprising:

selecting virtual secondary requests not matching any respective secondary responses as unanswered secondary requests,

retrieving content from a local cache of the first terminal as virtual cache if original browser local cache was used relating to unanswered secondary requests,

simulating web page presentation on the first terminal according to data relating to the unanswered secondary requests if the virtual cache contains said data, and

displaying error messages on the first terminal if the virtual cache does not contain data relating to the unanswered secondary requests.

3. The method of claim 2 comprising:

addressing via the network communication line to an appropriate Internet server for receiving respective simulated responses relating to unanswered secondary requests if the virtual cache does not contain data relating to the unanswered secondary requests.

4. The method of claim 1 comprising:

selecting from identified TCP/IP data packets data relating to network messages,

transforming the data relating to network messages data into a text data file, and displaying the text data file on the first terminal.

5. The method of claim 1 wherein a network comprising the network communication line comprises a local-area network (LAN) and the first and second terminals are connected to the network.

6. The method of claim 1 wherein the network communication line comprises an external communication line comprising at least one of a telephone line, an ISDN line, and an optical line.

7. The method of claim 1 wherein a network comprising the network communication line comprises a local-area network (LAN) and the first terminal is situated in a location different from that of the second terminal.

8. The method of claim 1 wherein the IP address is identified by a communication line provider.

9. The method of claim 1 wherein the IP address is identified by a communication line owner.

10. The method of claim 1 wherein the IP address is an address of a web site visitor and identified by a web site owner.

11. A network probe terminal for tracking a network communication line and simulating an original browser activity of a terminal, comprising:

connection means for accessing the network communication line,

monitoring means for tracing TCP/IP data packets routed through the network communication line,

a first filtering module for selecting new connection requests as original requests and web page components indicating new addresses as new navigation components out of TCP/IP data packets relating to an IP address as identified data packets,

first sorting means for organizing the new navigation components into at least a false new components category comprising at least embedded objects or frames and a true new components category comprising at least hyperlinks,

second sorting means for organizing the original requests into at least a primary request category comprising original requests matching those in the true new components category or original requests failing to match any of those in the true new components category and belonging to HTTP or POST type and a secondary request category comprising original requests matching those in the false new components category or original requests failing to match any of those in the false new components category and not belonging to HTTP or POST type,

a classifying module for selecting HTML data files relating to primary requests as primary responses from the identified data packets,

a request generating module for creating virtual secondary requests according to respective secondary responses,

a second filtering module for selecting responses relating to secondary virtual requests as secondary responses from identified data packets, and

displaying means for simulating web page presentation on a terminal agent according to the secondary responses.

12. The device of claim 11 wherein the second filtering module comprises means for selecting virtual secondary requests currently not matching any respective original responses as unanswered secondary requests.

13. The device of claim 11 comprising a cache module for activating a local cache in the terminal agent in case an original browser local cache has been used in response to unanswered secondary requests.

14. The device of claim 13 comprising a retrieval module for addressing via the network communication line to an appropriate internet server and receiving respective simulated responses relating to unanswered secondary requests if a virtual local cache does not contain data.

15. The device of claim 11 comprising an electronic message module for selecting from identified TCP/IP data packets data relating to network messages, transforming the data relating to network messages into a text data file, and displaying the text data file on the terminal agent.

16. The device of claim 11 wherein the IP address is identified by a communication line provider.

17. The device of claim 11 wherein the IP address is identified by a communication line owner.

18. The device of claim 11 wherein the IP address is an address of a web site visitor and identified by a web site owner.