Analyzing device similarity

• US 9,292,793 B1
• Filed: 03/31/2012
• Issued: 03/22/2016
• Est. Priority Date: 03/31/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Lin, Derek, Villa, Yael, Kaufman, Alon
• Primary Examiner(s): Starks, Wilbert L
• Assistant Examiner(s): Wu, Fuming
• Application Number:
  US13/436,936
• Time in Patent Office: 1,452 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method is used in analyzing device similarity. Data describing a device is received and a model is applied to the data. Based on the modeling, a measure of similarity between the device and a previously known device is determined.

Claims

1. A method for use in analyzing device similarity, the method comprising:

receiving data describing a set of mobile devices, wherein the set of mobile devices includes an unknown mobile device and a previously known mobile device, wherein the data includes a plurality of components associated with the set of mobile devices, wherein the components include device hardware element data and application data, wherein each component of the plurality of components is measured by weight of popularity and frequency, and wherein the weight of each component of the plurality of components changes dynamically based on changing of the popularity and the frequency of use of the plurality of components;

constructing, using the data, a first data vector for each of the plurality of components for the unknown mobile device and a second data vector for each of the plurality of components for the previously known mobile device, wherein a comparison between the first data vector and the second data vector represent components that are selected from the group consisting of matching components, mismatching components, and missing components, and wherein the first and second data vectors are unlabeled;

applying a probabilistic classifier model to the first and second unlabeled data vectors, wherein an expectation-maximization method iteratively and jointly trains the probabilistic classifier model and estimates labels for each of the first and second unlabeled data vectors at the same time, wherein the expectation-maximization method calculates a similarity score for each of the unknown mobile device and the previously known mobile device; and

based on the similarity scores, determining a measure of similarity between the unknown mobile device and the previously known mobile device by comparing the similarity scores against a threshold.

2. The method of claim 1, wherein the model is a Naï

ve Bayesian model.

3. The method of claim 2, wherein an expectation-maximization method is used to train the Naï

ve Bayesian model.

4. The method of claim 2, wherein the Naï

ve Bayesian model is applied to random labels to generate new labels.

5. The method of claim 4, wherein the Naï

ve-Bayesian model is applied iteratively to the new labels to generate a next iteration of new labels.

6. The method of claim 1, wherein the measure of similarity is expressed as a probability that the device is the previously known device.

7. The method of claim 1, wherein the device is tracked via components of a device signature of the device.

8. The method of claim 1, wherein the measure of similarity accounts for importance of an element based on a frequency of the element in a population.

9. The method of claim 1, wherein the measure of similarity accommodates new device element additions.

10. The method of claim 1, wherein the measure of similarity is based on an unsupervised learning method.

11. A system for use in analyzing device similarity, the system comprising:

first logic configured to receive data describing a set of mobile devices, wherein the set of mobile devices includes an unknown mobile device and a previously known mobile device, wherein the data includes a plurality of components associated with the set of mobile devices, wherein the components include device hardware element data and application data, wherein each component of the plurality of components is measured by weight of popularity and frequency, and wherein the weight of each component of the plurality of components changes dynamically based on changing of the popularity and the frequency of use of the plurality of components;

second logic configured to construct, using the data, a first data vector for each of the plurality of components for the unknown mobile device and a second data vector for each of the plurality of components for the previously known mobile device, wherein a comparison between the first data vector and the second data vector represent components that are selected from the group consisting of matching components, mismatching components, and missing components, and wherein the first and second data vectors are unlabeled;

third logic configured to apply a probabilistic classifier model to the first and second unlabeled data vectors, wherein an expectation-maximization method iteratively and jointly trains the probabilistic classifier model and estimates labels for each of the first and second unlabeled data vectors at the same time, wherein the expectation-maximization method calculates a similarity score for each of the unknown mobile device and the previously known mobile device; and

forth logic configured to, based on the similarity scores, determine a measure of similarity between the unknown mobile device and the previously known mobile device by comparing the similarity scores against a threshold.

12. The system of claim 11, wherein the model is a Naï

ve Bayesian model.

13. The system of claim 12, wherein an expectation-maximization method is used to train the Naï

ve Bayesian model.

14. The system of claim 12, wherein the Naï

ve Bayesian model is applied to random labels to generate new labels.

15. The system of claim 14, wherein the Naï

ve-Bayesian model is applied iteratively to the new labels to generate a next iteration of new labels.

16. The system of claim 11, wherein the measure of similarity is expressed as a probability that the device is the previously known device.

17. The system of claim 11, wherein the device is tracked via components of a device signature of the device.

18. The system of claim 11, wherein the measure of similarity accounts for importance of an element based on a frequency of the element in a population.

19. The system of claim 11, wherein the measure of similarity accommodates new device element additions.

20. The system of claim 11, wherein the measure of similarity is based on an unsupervised learning method.