SYSTEM AND METHOD FOR INTERCEPTION OF IP TRAFFIC BASED ON IMAGE PROCESSING

• US 20130108114A1
• Filed: 10/29/2012
• Published: 05/02/2013
• Est. Priority Date: 10/31/2011
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Aviad, Rotem, Zamir, Ariel
• Granted Patent: US 9,742,812 B2
• Time in Patent Office: Days
• US Class Current: 382/105
• CPC Class Codes: G06V 40/172 Classification, e.g. identification
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

Methods and systems for monitoring communication traffic in communication networks, such as Internet Protocol (IP) traffic transferred over the Internet or over a wireless network. The disclosed techniques identify communication traffic that is associated with target individuals, by extracting digital images from the traffic and recognizing target individuals who appear in the images. A correlation system monitors communication sessions that are conducted in a communication network to identify known target individuals who appear in images. Upon recognizing a target individual in an image extracted from a certain session, the system correlates this target user with one or more of the communication identifiers used in the session. The system automatically identifies IP addresses or other identifiers that are used by target individuals, and enable subsequent tracking of such identifiers.

Claims

1. A method, comprising:

monitoring communication sessions conducted in a communication network;

extracting from a monitored communication session a digital image and a communication identifier; and

recognizing a known target individual appearing in the extracted image, and associating the target individual with the communication identifier.

2. The method according to claim 1, wherein recognizing the target individual comprises applying a face recognition process to the extracted image so as to recognize a face of the target individual in the image.

3. The method according to claim 1, wherein monitoring the communication sessions comprises receiving communication traffic from the communication network, and reconstructing the communication sessions from the received communication traffic.

4. The method according to claim 1, wherein one or more of the communication sessions is encrypted with a transport-layer cryptographic protocol, and wherein monitoring the communication sessions comprises decrypting the cryptographic protocol before extracting the digital image and the communication identifier.

5. The method according to claim 1, wherein monitoring the communication sessions comprises monitoring communication packets transferred over a wireless network, and wherein extracting the communication identifier comprises extracting an identifier of a wireless communication terminal that participates in the monitored communication session.

6. The method according to claim 5, wherein the wireless network comprises a Wireless Local Area Network (WLAN) and the communication identifier comprises extracting a Medium Access Control (MAC) address that identifies the wireless communication terminal.

7. The method according to claim 5, wherein the wireless network comprises one of a Global System for Mobile communications (GSM) and a Universal Mobile Telecommunications System (UMTS) Network.

8. The method according to claim 1, and comprising outputting an association between the target individual with the communication identifier, so as to act upon one or more other communication sessions of the target individual using the communication identifier.

9. The method according to claim 1, wherein recognizing the target individual comprises recognizing in the extracted image a car license plate that is associated with the target individual.

10. The method according to claim 1, wherein recognizing the target individual comprises recognizing in the extracted image a body feature that is associated with the target individual.

11. Apparatus, comprising:

an interface, which is connected to a communication network and is configured to monitor communication sessions conducted in the network; and

a processor, which is configured to extract from a monitored communication session a digital image and a communication identifier, to recognize a known target individual appearing in the extracted image, and to associate the target individual with the communication identifier.

12. The apparatus according to claim 11, wherein the processor is configured to apply a face recognition process to the extracted image so as to recognize a face of the target individual in the image.

13. The apparatus according to claim 11, wherein the processor is configured to receive communication traffic from the communication network, and to reconstruct the communication sessions from the received communication traffic.

14. The apparatus according to claim 11, wherein one or more of the communication sessions is encrypted with a transport-layer cryptographic protocol, and wherein the processor is configured to decrypt the cryptographic protocol before extracting the digital image and the communication identifier.

15. The apparatus according to claim 11, wherein the communication sessions comprise communication packets transferred over a wireless network, and wherein the communication identifier comprises an identifier of a wireless communication terminal that participates in the monitored communication session.

16. The apparatus according to claim 15, wherein the wireless network comprises a Wireless Local Area Network (WLAN), and wherein the communication identifier comprises a Medium Access Control (MAC) address that identifies the wireless communication terminal.

17. The apparatus according to claim 15, wherein the wireless network comprises one of a Global System for Mobile communications (GSM) and a Universal Mobile Telecommunications System (UMTS) Network.

18. The apparatus according to claim 15, wherein the processor is configured to correlate an Internet Protocol (IP) address extracted from the monitored communication session with the identifier of the wireless communication terminal.

19. The apparatus according to claim 11, wherein the communication identifier comprises an application-layer identifier.

20. A computer software product, the product comprising a tangible non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor communication sessions conducted in a communication network, to extract from a monitored communication session a digital image and a communication identifier, to recognize a known target individual appearing in the extracted image, and to associate the target individual with the communication identifier.