System and method for identifying communication session participants based on traffic patterns

• US 10,142,426 B2
• Filed: 03/29/2016
• Issued: 11/27/2018
• Est. Priority Date: 03/29/2015
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Zlatokrilov, Haim
• Primary Examiner(s): Lai, Michael C
• Application Number:
  US15/084,408
• Publication Number:
  US 20160285978A1
• Time in Patent Office: 973 Days
• Field of Search: 709224
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A monitoring system monitors traffic flows that are exchanged over a communication network. The system characterizes the flows in terms of their temporal traffic features, and uses this characterization to identify communication devices that participate in the same communication session. By identifying the communication devices that serve as endpoints in the same session, the system establishes correlations between the users of these communication devices. The monitoring system characterizes the flows using traffic features such as flow start time, flow end time, inter-burst time and burst size, and/or statistical properties of such features. The system typically generates compressed-form representations (“signatures”) for the traffic flows based on the temporal traffic features, and finds matching flows by finding similarities between signatures.

Claims

1. A method for identifying communication devices that serve as endpoints in the same communication session and for establishing correlations between the users of the communication devices, the method comprising:

monitoring a plurality of traffic flows exchanged over a communication network;

determining respective temporal traffic features for the monitored traffic flows;

identifying communication devices that participate in a same communication session, by finding a match among respective temporal traffic features of the traffic flows exchanged by the communication devices;

wherein determining the temporal traffic features comprises generating a respective compressed-form signature for each of the traffic flows, and wherein finding the match comprises comparing among signatures of at least some of the traffic flows exchanged by the communication devices; and

wherein finding the match comprises matching the temporal traffic features between an inbound traffic flow of a first communication device and an outbound traffic flow of a second communication device.

2. The method according to claim 1, wherein the temporal traffic features depend on at least one feature type selected from a group of types consisting of start time, end time, inter-burst time, burst size and overall data volume.

3. The method according to claim 1, wherein identifying the communication devices comprises detecting the match even though the communication devices communicate via at least one intermediary server.

4. The method according to claim 3, wherein the intermediary server performs transcoding among the traffic flows of the communication devices.

5. The method according to claim 1, wherein identifying the communication devices comprises selecting a subset of the traffic flows that are associated with a given application type, and searching for the match only among the traffic flows in the subset.

6. The method according to claim 1, and comprising reaffirming the match by matching the temporal traffic features between an outbound traffic flow of the first communication device and an inbound traffic flow of the second communication device.

7. The method according to claim 1, wherein finding the match comprises matching activity periods in a first traffic flow with silence periods in a second traffic flow.

8. The method according to claim 1, wherein identifying the communication devices comprises finding multiple matches among the communication devices over multiple communication sessions.

9. The method according to claim 1, wherein determining the temporal traffic features and finding the match are performed independently of content of the traffic flows.

10. The method according to claim 1, wherein at least some of the traffic flows are encrypted.

11. Apparatus for identifying communication devices that serve as endpoints in the same communication session and for establishing correlations between the users of the communication devices, the apparatus comprising:

an interface, which is configured to monitor a plurality of traffic flows exchanged over a communication network;

a processor, which is configured to determine respective temporal traffic features for the monitored traffic flows, and to identify communication devices that participate in a same communication session, by finding a match among the temporal traffic features of the traffic flows exchanged by the communication devices;

wherein the processor is configured to generate a respective compressed-form signature for each of the traffic flows, and to find the match by comparing among signatures of at least some of the traffic flows exchanged by the communication devices; and

wherein the processor is configured to find the match by matching the temporal traffic features between an inbound traffic flow of a first communication device and an outbound traffic flow of a second communication device.

12. The apparatus according to claim 11, wherein the processor is configured to find the match even though the communication devices communicate via at least one intermediary server.

13. The apparatus according to claim 12, wherein the intermediary server performs transcoding among the traffic flows of the communication devices.

14. The apparatus according to claim 11, wherein the processor is configured to select a subset of the traffic flows that are associated with a given application type, and to search for the match only among the traffic flows in the subset. device and an outbound traffic flow of a second communication device.

15. The apparatus according to claim 11, wherein the processor is configured to reaffirm the match by matching the temporal traffic features between an outbound traffic flow of the first communication device and an inbound traffic flow of the second communication device.

16. The apparatus according to claim 11, wherein the processor is configured to find multiple matches among the communication devices over multiple communication sessions.