System and method for logging communications

• US 9,756,011 B2
• Filed: 09/09/2016
• Issued: 09/05/2017
• Est. Priority Date: 10/24/2007
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Zampiello, Geoffrey
• Primary Examiner(s): ZUNIGA ABAD, JACKIE
• Application Number:
  US15/261,040
• Publication Number:
  US 20160380965A1
• Time in Patent Office: 361 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users

Abstract

A method for logging communication includes determining when a target user is active and identifying an access device and private Internet Protocol (IP) address associated with the target user when the target user is active. The method further includes causing the access device to provide traffic information associated with the target user to a logging device.

Claims

1. A system, comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations, the operations comprising;

determining when a target user is active by comparing active session information to a list of users, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises an indication as to a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session; and

logging, at an access point and after determining when the target user is active, traffic information including a network address translation table entry associated with a private internet protocol address of the target user, wherein the network address translation table entry is included in the traffic information when the network address translation table entry matches a network traffic type associated with the private internet protocol address.

2. The system of claim 1, wherein the operations further comprise identifying the access point when the target user is determined to be active.

3. The system of claim 1, wherein the operations further comprise identifying the private internet protocol address associated with the target user when the target user is determined to be active.

4. The system of claim 1, wherein the operations further comprise receiving the active session information on a periodic basis.

5. The system of claim 1, wherein the operations further comprise reconstructing a communication of the target user based on the traffic information.

6. The system of claim 1, wherein the active session information further comprises an indication as to a reason for ending the session.

7. The system of claim 1, wherein the operations further comprise identifying the access point when network traffic associated with the target user is peer-to-peer network traffic.

8. The system of claim 1, wherein the operations further comprise identifying the private internet protocol address associated with the target user when network traffic associated with the target user is peer-to-peer network traffic.

9. The system of claim 1, wherein the operations further comprise performing a translation between the private internet protocol address and a public internet protocol address associated with the access point.

10. The system of claim 1, wherein the operations further comprise causing the access point to replace a network address translation port of the access point with a port of the device.

11. The system of claim 1, wherein the operations further comprise instructing the access point to provide a network resource to the device.

12. A method, comprising:

determining, by utilizing instructions from a memory that are executed by a processor, when a target user is active by comparing active session information to a list of users, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises an indication as to a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session; and

logging, at an access point and after determining when the target user is active, traffic information including a network address translation table entry associated with a private internet protocol address of the target user, wherein the network address translation table entry is included in the traffic information when the network address translation table entry matches a network traffic type associated with the private internet protocol address.

13. The method of claim 12, further comprising identifying the access point when the target user is determined to be active.

14. The method of claim 12, further comprising instructing the access point to provide a network resource to the device.

15. The method of claim 12, further comprising performing a translation between the private internet protocol address and a public internet protocol address associated with the access point.

16. The method of claim 12, further comprising reconstructing a communication of the target user based on the traffic information.

17. The method of claim 12, further comprising receiving the active session information on a periodic basis.

18. The method of claim 12, further comprising identifying the private internet protocol address associated with the target user when the target user is determined to be active.

19. The method of claim 12, further comprising causing the access point to replace a network address translation port of the access point with a port of the device.

20. A non-transitory computer-readable medium comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

determining when a target user is active by comparing active session information to a list of users, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises an indication as to a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session; and

storing, at an access point and after determining when the target user is active, traffic information including a network address translation table entry associated with a private internet protocol address of the target user, wherein the network address translation table entry is included in the traffic information when the network address translation table entry matches a network traffic type associated with the private internet protocol address.