Technique for data traffic analysis

• US 9,973,950 B2
• Filed: 10/31/2013
• Issued: 05/15/2018
• Est. Priority Date: 10/31/2013
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: da Silva, Icaro L. J., Fu, Jing, Bertze, Asa
• Primary Examiner(s): Jung, Min
• Application Number:
  US15/031,091
• Publication Number:
  US 20160286420A1
• Time in Patent Office: 1,657 Days
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

A technique for providing information derived from data traffic between a telecommunications network and the Internet is disclosed. The telecommunications network provides mobile Internet access to a plurality of mobile subscribers using IP addresses allocated to the mobile subscribers. Data packets in data traffic are analyzed at an interface between the telecommunications network and the Internet. Each analyzed data packet includes an IP address allocated to one of the plurality of mobile sub-scribers. For each of the analyzed data packets, a subscriber identity is retrieved based on the IP address included therein using an allocation function of the telecommunications network. The allocation function associates sub-scriber identities to IP addresses. Information derived from the analyzed data packets is stored in combination with the retrieved subscriber identities in a storing unit. An access interface for accessing the stored information is also provided.

Claims

1. A method of providing information derived from data traffic between a telecommunications network and the Internet, the telecommunications network providing mobile Internet access to a plurality of mobile subscribers using Internet Protocol, IP, addresses allocated to the mobile subscribers, the method comprising:

analyzing, in data traffic at an interface between the telecommunications network and the Internet, data packets each of which includes an IP address;

retrieving, for the analyzed data packets, a subscriber identity based on the IP address included in a data packet allocated by an allocation function of the telecommunications network, the allocation function allocating to each subscriber identity of the plurality of mobile subscribers an IP address in the telecommunication network;

storing information derived from the analyzed data packets in combination with the retrieved subscriber identities, wherein the information derived for each of the analyzed data packets includes a Uniform Resource Locator, URL, for the Internet;

computing correlations for combinations of two or more different URLs, each correlation being computed for one of the combinations based on a first number of subscriber identities, wherein each of the subscriber identities stored in combination with each of the two or more URLs of the one combination contributes to the first number; and

providing an access interface for accessing the stored information.

2. The method of claim 1, wherein the derived information is stored further in combination with information as to a current location of the mobile subscriber.

3. The method of claim 1, wherein each correlation is normalized by a second number of subscriber identities, wherein each of the subscriber identities stored in combination with at least one of the two or more URLs of the corresponding combination contributes to the second number.

4. The method of claim 1, further comprising

computing transition probabilities for pairs of first and second URLs, each transition probability being computed for a transition from the first URL to the second URL of one of the pairs based on a third number of subscriber identities divided by a fourth number of subscriber identities, wherein each of the subscriber identities stored at least once in combination with the first URL of the one pair and at least once in combination with the second URL of the one pair contributes to the third number, and wherein each of the subscriber identities stored at least once in combination with the first URL of the one pair contributes to the fourth number.

5. The method of claim 1, further comprising

receiving a descriptor for specifying a set of URLs via the access interface,

wherein at least one of the correlations and transition probabilities are computed for the set of URLs specified by the descriptor and provided via the access interface.

6. The method of claim 1, wherein data packets originating from an Internet source and directed towards the telecommunications network are analyzed, the method further comprising:

storing the URL in association with the Internet source in a potential referral database.

7. The method of claim 1, wherein data packets directed towards the Internet and including a Hypertext Transfer Protocol, HTTP, request are analyzed, wherein the HTTP request includes the URL, and wherein the URL is stored in association with the subscriber identity in a subscriber-URL database, entries in the subscriber-URL database including one subscriber identify and one URL.

8. The method of claim 7, wherein entries in the subscriber-URL database further include a time stamp indicative of at least one of a time of submitting the HTTP request at the mobile subscriber and a time of analyzing the data packet at the interface.

9. The method of claim 7, wherein the subscriber identity is stored in association with the URL in a URL-subscriber database, entries in the URL-subscriber database including one URL and at least one subscriber identity, and the entries in the URL-subscriber database are subdivided into consecutive time intervals, each of the entries corresponding to one time interval of the consecutive time intervals.

10. The method of claim 9, further comprising:

obtaining content referenced by the URL; and

storing information derived from the obtained content in association with the URL in a URL-content database,

wherein the step of obtaining is triggered by a change in the URL-subscriber database.

11. The method of claim 10, wherein the content is obtained from the Internet in a HTTP response to a second HTTP request, which is different from the HTTP request included in the analyzed data packet.

12. The method of claim 10, further comprising:

caching content in an HTTP response in the data traffic at the interface from the Internet towards the telecommunications network in a cache in association with the URL included in the HTTP request of the analyzed data packet, wherein the HTTP response is related to the HTTP request by the URL or a session ID further included in the HTTP request and the HTTP response, and

wherein the content referenced by the URL in the URL-subscriber database is obtained from the cache.

13. The method of claim 10, wherein entries in the URL-subscriber database further include a counter indicative of a number of the analyzed data packets including the corresponding URL, wherein the step of obtaining the content is triggered for a plurality of entries in the URL-subscriber database in an order defined by the counter.

14. The method of claim 10, further comprising:

extracting keywords from the content and determining a category in a predefined hierarchical taxonomy,

wherein the derived information includes the extracted keywords and the determined category stored in association with the URL in the URL-content database.

15. The method of claim 7, further comprising:

storing the URL in a referral database in association with an HTTP referrer, if the HTTP request further includes the HTTP referrer in a header field of the analyzed data packet, and otherwise storing the URL in the referral database in association with an indicator indicating the absence of the HTTP referrer.

16. The method of claim 15, wherein each entry in the referral database includes the URL in association with the HTTP referrer or the indicator and further includes a counter, which is incremented for each analyzed data packet corresponding to the association.

17. The method of claim 1, wherein the mobile subscribers place calls to areas and/or receive calls from areas, and the data traffic at least partially includes the calls, and wherein the derived information is stored further in combination with the areas of calls of the subscriber identity.

18. The method of claim 1, wherein the subscriber identity includes a hash value derived from personally identifiable information, wherein the personally identifiable information is not included and/or not derivable from the subscriber identity.

19. A computer program product comprising a non-transitory computer readable storage medium storing program code that when executed by a computing device causes the computing device to perform the following operations comprising:

providing information derived from data traffic between a telecommunications network and the Internet, the telecommunications network providing mobile Internet access to a plurality of mobile subscribers using Internet Protocol, IP, addresses allocated to the mobile subscribers, the method comprising;

analyzing, in data traffic at an interface between the telecommunications network and the Internet, data packets each of which including an IP address;

retrieving, for the analyzed data packets, a subscriber identity based on the IP address included in a data packet allocated by an allocation function of the telecommunications network, the allocation function allocating to each subscriber identity of the plurality of mobile subscribers an IP address in the telecommunication network;

storing information derived from the analyzed data packets in combination with the retrieved subscriber identities, wherein the information derived for each of the analyzed data packets includes a Uniform Resource Locator, URL, for the Internet;

computing correlations for combinations of two or more different URLs, each correlation being computed for one of the combinations based on a first number of subscriber identities, wherein each of the subscriber identities stored in combination with each of the two or more URLs of the one combination contributes to the first number; and

providing an access interface for accessing the stored information.

20. A device providing information derived from data traffic between a telecommunications network and the Internet, the telecommunications network providing mobile Internet access to a plurality of mobile subscribers using Internet Protocol, IP, addresses allocated to the mobile subscribers, the device comprising:

a processor; and

a memory coupled to the processor and containing program code that when executed by the processor causes the process to perform the following operations comprising;

analyzing, in data traffic at an interface between the telecommunications network and the Internet, data packets each of which including an IP address;

retrieving, for the analyzed data packets, a subscriber identity based on the IP address included in a data packet allocated by an allocation function of the telecommunications network, the allocation function allocating to each subscriber identity of the plurality of mobile subscribers an IP address in the telecommunication network;

storing information derived from the analyzed data packets in combination with the retrieved subscriber identities, wherein the information derived for each of the analyzed data packets includes a Uniform Resource Locator, URL, for the Internet;

computing correlations for combinations of two or more different URLs, each correlation being computed for one of the combinations based on a first number of subscriber identities, wherein each of the subscriber identities stored in combination with each of the two or more URLs of the one combination contributes to the first number; and

providing an access interface for accessing the stored information.

21. The device of claim 20, wherein the information derived for each of the analyzed data packets includes a Uniform Resource Locator, URL, for the Internet.

22. The device of claim 21, the operations further comprising:

computing transition probabilities for pairs of first and second URLs, each transition probability being computed for a transition from the first URL to the second URL of one of the pairs based on a third number of subscriber identities divided by a fourth number of subscriber identities, wherein each of the subscriber identities stored at least once in combination with the first URL of the one pair and at least once in combination with the second URL of the one pair contributes to the third number, and wherein each of the subscriber identities stored at least once in combination with the first URL of the one pair contributes to the fourth number.