Method and apparatus for combining traffic analysis and monitoring center in lawful interception

• US 7,770,221 B2
• Filed: 05/18/2006
• Issued: 08/03/2010
• Est. Priority Date: 05/18/2006
• Status: Active Grant

• Current Assignee: Cyberbit Ltd.
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: Weinberg, Adam, Ofek, Yossi, Frenkel, Assaf, Ben-Aroya, Eyal
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US10/581,437
• Publication Number:
  US 20090007263A1
• Time in Patent Office: 1,538 Days
• Field of Search: 726/4, 726/22, 726/26
• US Class Current: 726/22
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

A method and apparatus for integrating intercepted information with information obtained from an at least one data retention source, the method comprising receiving intercepted information from an interception source, receiving information from a data retention source, and analyzing the information received from the data retention source, in association with the intercepted information. The intercepted information can comprise meta data related to the intercepted communications, and/or the contents of the communication themselves. This enables a user such as a law enforcement agency to reveal possibly indirect connections between target entities s wherein the connections involve non-target entities. The method and apparatus combine interception and content analysis methodologies with traffic analysis techniques.

Claims

1. A method for integrating data or content of intercepted communication with an at least one stored record, the method comprising the steps of:

receiving from an interception source data or content of the intercepted communication in which a target participates, the communication intercepted in accordance with a warrant;

receiving an at least one stored record from a data retention source; and

analyzing and integrating the at least one stored record in association with the intercepted communication data or content.

2. The method of claim 1 wherein the at least one stored record is a communication traffic stored record.

3. The method of claim 1 wherein the at least one stored record is a non-communication traffic stored record.

4. The method of claim 3 wherein the at least one stored record is selected from the group consisting of:

a customer record, a financial record, and a travel record.

5. The method of claim 1 further comprising a querying step for querying the data retention source.

6. The method of claim 1 further comprising a data retrieval step according to one or more criteria.

7. The method of claim 1 wherein the stored record comprises information which is a response to a query addressed to the data retention source.

8. The method of claim 1 further comprising a display step for displaying information to a user.

9. The method of claim 8 wherein the display step displays any one of the following:

an at least one result associated with the analyzing step, raw data, or information related to an operation performed by the user.

10. The method of claim 8 wherein the display step provides graphic presentation of information.

11. The method of claim 10 wherein the graphic representation comprises an at least one connection map.

12. The method of claim 8 wherein the display step provides textual presentation of information.

13. The method of claim 1 further comprising an abstraction step for eliminating information from the at least one stored record.

14. The method of claim 13 wherein the information being eliminated is identifying information.

15. The method of claim 1 further comprising a formatting step for formatting the intercepted communication data or content, or the at least one stored record.

16. The method of claim 1 further comprising a storing step for storing the intercepted communication data or content, or the at least one stored record.

17. The method of claim 16 wherein the storing step stores the intercepted communication data or content, or the at least one stored record in a database.

18. The method of claim 1 wherein the data retention source is external to an operator of the interception source.

19. An apparatus for integrating data or content of intercepted communication associated with a target and captured in accordance with a warrant, with at least one stored record, the apparatus comprising:

an at least one storage device for storing the data or content of the intercepted communication, or the at least one stored record;

an at least one server comprising an at least one engine for processing information stored in the storage device and integrating the at least one stored record in association with the data or content of the intercepted communication;

an at least one computing platform comprising an at least one display device for displaying to a user an at least one result obtained by the at least one engine; and

an at least one connection to an at least one service provider database.

20. The apparatus of claim 19 wherein the at least one engine is any of the group of:

an analysis engine;

a query engine;

a filtering engine;

or a security engine.

21. The apparatus of claim 19 further comprising an at least one interception engine for capturing an at least one record from the at least one service provider database.

22. The apparatus of claim 19 wherein the storage device is associated with a monitoring center database or with a call detail record database or with an interne protocol detail record.

23. The apparatus of claim 19 wherein the at least one data record is received from a source external to an operator of the interception source.

24. A tangible computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising:

receiving from an interception source data or content of intercepted communication in which a target participates, the communication intercepted in accordance with a warrant;

receiving an at least one stored record from a data retention source; and

analyzing and integrating the at least one stored record in association with the data or content of the intercepted communication.