System and method for determining commonly used communication terminals and for identifying noisy entities in large-scale link analysis

• US 8,509,733 B2
• Filed: 04/28/2011
• Issued: 08/13/2013
• Est. Priority Date: 04/28/2010
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Corem, Yochai, Segal, Muli, Goldfarb, Eithan
• Primary Examiner(s): Gelin, Jean
• Assistant Examiner(s): Shen, Qun
• Application Number:
  US13/096,145
• Publication Number:
  US 20110319052A1
• Time in Patent Office: 838 Days
• Field of Search: 455/405, 455/404.2, 455/435.1, 455/436
• US Class Current: 455/405
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04M 2201/18 Comparators
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

Systems and methods for identifying and characterizing relationships based on communication traffic. The methods may include accepting indications of communication conducted among entities over a communication network, and using a link processor, analyzing the indications so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate. A criterion may be evaluated with respect to the indications associated with a given entity, responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications.

Claims

1. A method, comprising:

accepting indications of communication conducted among entities over a communication network;

using a link processor, analyzing the indications of communication so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate;

evaluating a criterion with respect to the indications of communication associated with a given entity, the criterion being determined in accordance with a growth rate of a total number of the entities that communicate with the given entity; and

responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications,

wherein evaluating the criterion further comprises determining that the given entity generates both false interrelationships and genuine interrelationships among the entities.

2. The method according to claim 1, wherein analyzing the indications comprises constructing a data structure that represents relationships among the entities, and

wherein disqualifying the given entity comprises disregarding the indications associated with the given entity in constructing the data structure.

3. The method according to claim 2, wherein disqualifying the given entity comprises adding the given entity to a list of disqualified entities, and wherein constructing the data structure comprises updating the data structure only in response to the indications associated with the entities that do not belong to the list.

4. The method according to claim 1, wherein evaluating the criterion and disqualifying the given entity comprise disqualifying the given entity responsively to assessing that the growth rate exceeds a predefined value.

5. The method according to claim 1, wherein the criterion depends on a number of the entities with which the given entity communicates in a single communication session.

6. The method according to claim 1, wherein evaluating the criterion comprises determining that the given entity indicates false interrelationships among the entities.

7. The method according to claim 1, wherein determining that the given entity indicates both the false interrelationships and the genuine interrelationships comprises identifying that a growth rate of a total number of the entities that communicate with the given entity falls between predefined minimum and maximum values.

8. The method according to claim 1, comprising assigning respective scores to the entities that communicate with the given entity, and distinguishing between the false interrelationships and the genuine interrelationships responsively to the scores.

9. A system, comprising:

an interface, which is configured to accept indications of communication conducted among entities over a communication network; and

a link processor, which is configured to analyze the indications of communication so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate, to evaluate a criterion with respect to the indications associated with a given entity wherein the criterion is determined in accordance with a growth rate of a total number of the entities that communicate with the given entity, and, responsively to meeting the criterion, to disqualify the given entity from serving as an intermediate entity in analyzing the indications,

wherein the criterion determines that the given entity indicates both false interrelationships and genuine interrelationships among the entities.

10. The system according to claim 9, wherein the link processor is configured to construct a data structure that represents relationships among the entities, and to disregard the indications associated with the given entity in constructing the data structure.

11. The system according to claim 10, wherein the link processor is configured to add the given entity to a list of disqualified entities, and to update the data structure only in response to the indications associated with the entities that do not belong to the list.

12. The system according to claim 9, wherein the link processor is configured to disqualify the given entity responsively to assessing that the growth rate exceeds a predefined value.

13. The system according to claim 9, wherein the criterion depends on a number of the entities with which the given entity communicates in a single communication session.

14. The system according to claim 9, wherein the criterion determines that the given entity indicates false interrelationships among the entities.

15. The system according to claim 9, wherein the link processor is configured to determine that the given entity indicates both the false interrelationships and the genuine interrelationships by identifying that a growth rate of a total number of the entities that communicate with the given entity falls between predefined minimum and maximum values.

16. The system according to claim 9, wherein the link processor is configured to assign respective scores to the entities that communicate with the given entity, and to distinguish between the false interrelationships and the genuine interrelationships responsively to the scores.