System and method for identifying communication session participants based on traffic patterns

• US 10,623,503 B2
• Filed: 10/19/2018
• Issued: 04/14/2020
• Est. Priority Date: 03/29/2015
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Zlatokrilov, Haim
• Primary Examiner(s): Lai, Michael C
• Application Number:
  US16/165,216
• Publication Number:
  US 20190052713A1
• Time in Patent Office: 543 Days
• Field of Search: 709224
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A monitoring system monitors traffic flows that are exchanged over a communication network. The system characterizes the flows in terms of their temporal traffic features, and uses this characterization to identify communication devices that participate in the same communication session. By identifying the communication devices that serve as endpoints in the same session, the system establishes correlations between the users of these communication devices. The monitoring system characterizes the flows using traffic features such as flow start time, flow end time, inter-burst time and burst size, and/or statistical properties of such features. The system typically generates compressed-form representations (“signatures”) for the traffic flows based on the temporal traffic features, and finds matching flows by finding similarities between signatures.

Claims

1. A method for identifying communication devices that serve as endpoints in a communication session, the method comprising:

monitoring a plurality of traffic flows exchanged over a communication network;

generating a respective compressed-form signature of traffic flow temporal behavior for each of the traffic flows; and

identifying communication devices that participate in a same communication session, by comparing signatures of at least some of the traffic flows exchanged by the communication devices, and matching the signatures between an inbound traffic flow of a first communication device and an outbound traffic flow of a second communication device.

2. The method according to claim 1, further comprising determining respective temporal traffic features for each of the traffic flows.

3. The method according to claim 2, further comprising finding a match among the respective temporal traffic features.

4. The method according to claim 2, wherein the temporal traffic features depend on at least one feature type selected from a group of types consisting of start time, end time, inter-burst time, burst size and overall data volume.

5. The method according to claim 1, wherein identifying the communication devices comprises matching the signatures even though the communication devices communicate via at least one intermediary server.

6. The method according to claim 5, wherein the intermediary server performs transcoding among the traffic flows of the communication devices.

7. The method according to claim 1, wherein identifying the communication devices comprises selecting a subset of the traffic flows that are associated with a given application type and comparing only among the traffic flows in the subset.

8. The method according to claim 1, further comprising reaffirming by matching the signatures between an outbound traffic flow of the first communication device and an inbound traffic flow of the second communication device.

9. The method according to claim 1, further comprising matching activity periods in a first traffic flow with silence periods in a second traffic flow.

10. The method according to claim 1, wherein identifying the communication devices comprises matching signatures among the communication devices over multiple communication sessions.

11. The method according to claim 1, wherein generating the compressed-form signatures and identifying the communication devices are performed independently of content of the traffic flows.

12. The method according to claim 1, wherein at least some of the traffic flows are encrypted.

13. Apparatus for identifying communication devices that serve as endpoints in a communication session, the apparatus comprising:

an interface, which is configured to monitor a plurality of traffic flows exchanged over a communication network; and

a processor, which is configured to generate a respective compressed-form signature of traffic flow temporal behavior for each of the traffic flows, and to identify communication devices that participate in a same communication session, by comparing signatures of at least some of the traffic flows exchanged by the communication devices, and matching the signatures between an inbound traffic flow of a first communication device and an outbound traffic flow of a second communication device.

14. The apparatus according to claim 13, wherein the processor is configured to determine respective temporal traffic features for each of the traffic flows.

15. The apparatus according to claim 14, wherein the processor is configured to finding a match among the respective temporal traffic features.

16. The apparatus according to claim 14, wherein the processor is configured to identify the communication devices by matching the signatures even though the communication devices communicate via at least one intermediary server.

17. The apparatus according to claim 16, wherein the intermediary server performs transcoding among the traffic flows of the communication devices.

18. The apparatus according to claim 13, wherein the processor is configured to select a subset of the traffic flows that are associated with a given application type and compare only among the traffic flows in the subset.

19. The apparatus according to claim 13, wherein the processor is configured to reaffirm by matching the signatures between an outbound traffic flow of the first communication device and an inbound traffic flow of the second communication device.

20. The apparatus according to claim 13, wherein the processor is configured to match signatures among the communication devices over multiple communication sessions.