Automatic identification of travel and non-travel network addresses

• US 8,615,605 B2
• Filed: 10/22/2010
• Issued: 12/24/2013
• Est. Priority Date: 10/22/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yu, Fang, Xie, Yinglian, Abadi, Martin, Savage, Stefan Roberts, Voelker, Geoffrey Michael, Pitsillidis, Andreas
• Primary Examiner(s): Winder, Patrice
• Assistant Examiner(s): Chang, Julian
• Application Number:
  US12/909,839
• Publication Number:
  US 20120102169A1
• Time in Patent Office: 1,159 Days
• Field of Search: 709201-203, 709217-219, 709/248, 709224-229, 709/245, 726 2- 10, 705/14.49, 705/14.5, 705/14.58
• US Class Current: 709/245
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A system to automatically classify types of IP addresses associated with a user. Information, such as user names, machine information, IP address, etc., may be obtained from logs. For each user or host in the logs, home IP addresses are identified from IP addresses where the user or host shows a predetermined level of activity. Travel IP addresses are identified, which are IP addresses at locations greater than a predetermined distance from the home IP addresses, as determined from geolocation data. A pattern analysis may be performed to determine which of the home IP addresses are work IP addresses associated with the user or host. The system may thus provide a classification of a user'"'"'s or host'"'"'s associated IP addresses as being one of travel, home, and work IP addresses. From this classification, mobility patterns may be derived, as well as applications to enhance security, advertising, search and network management.

Claims

1. A method for classifying network addresses, comprising:

collecting and analyzing user event data in logs in response to user activity;

determining non-travel network addresses as a first type of location information from the user event data;

determining travel network addresses as a second type of location information with respect to the non-travel network addresses by applying a distance parameter to geolocation location information; and

determining a network address, of the non-travel network addresses and the travel network addresses, that is a virtual private network (VPN) address or a proxy address based on a metric by applying the metric to two network addresses to determine that a user did not physically travel between locations specified by the two network addresses, wherein the determined network address is one of the two addresses.

2. The method of claim 1, wherein the non-travel network addresses comprise home network addresses and work network addresses.

3. The method of claim 2, further comprising:

determining multiple types of location information of the network addresses, including the travel network addresses, the home network addresses, and the work network addresses, using the user event data, comprising;

determining the home network addresses from the non-travel network addresses; and

determining the work network addresses as a third type of location information from the home network addresses by analyzing usage patterns of the network addresses.

4. The method of claim 3, wherein the first type of location information is home Internet Protocol (IP) addresses associated with the user, the second type of location information is travel IP addresses associated with the user, and the third type of location information is work IP addresses associated with the user.

5. The method of claim 4, wherein the distance parameter is applied to the home IP addresses to determine the travel IP addresses.

6. The method of claim 1, wherein the user event data comprises one of a user identifier, a machine identifier, a network address, or a time stamp associated with an event.

7. The method of claim 1, further comprising determining the first type of location information by applying a sliding window of time to each network address to determine if each network address is used by the user above a frequency threshold.

8. The method of claim 1, wherein network addresses associated with proxy servers or virtual private network (VPN) servers are removed from the first type of location information and the second type of location information.

9. The method of claim 8, wherein determining the network address, of the non-travel network addresses and the travel network addresses, that is a virtual private network (VPN) address or a proxy address based on a metric by applying the metric to two network addresses to determine that the user did not physically travel between locations specified by the two network addresses comprises:

identifying the two network addresses used consecutively in time associated with the user, where one network address of the two network addresses has been identified as the second type of location information;

applying the metric to the two network addresses to determine that the user did not physically travel between locations specified by the two network addresses consecutive in time; and

identifying one of the two network addresses as a virtual private network (VPN) or a proxy address.

10. The method of claim 1, wherein the metric is a distance per time metric.

11. The method of claim 1, further comprising:

determining a mobility pattern of a user and the first and second types of location information; and

providing applications based on the first and second types of location information and the mobility pattern.

12. The method of claim 11, wherein the applications comprise security applications that apply predetermined policies based on whether a network address associated with the user is a home network address, a travel network address, or a work network address.

13. The method of claim 11, wherein the applications comprise targeted advertising that is provided to the user based on whether a network address associated with the user is a home network address, a travel network address, or a work network address.

14. The method of claim 11, wherein the applications comprise data migration and caching policies that migrate or cache data associated with the user based on whether a network address associated with the user is a home network address, a travel network address, or a work network address.

15. A method for classifying network addresses, comprising:

determining location information of the network addresses;

identifying candidate network addresses using the location information of the network addresses;

filtering network addresses from the candidate network addresses that are associated with proxy servers or virtual private network (VPN) servers based on a metric by applying the metric to two network addresses to determine that a user did not physically travel between locations specified by the two network addresses, and removing one of the two addresses from the candidate network addresses; and

identifying non-travel network addresses and travel network addresses using the filtered candidate network addresses and a distance parameter.

16. The method of claim 15, further comprising:

identifying candidate home network addresses using the location information of the network addresses;

identifying travel network addresses using the candidate home network addresses by applying a distance parameter to geolocation location information; and

determining work network addresses from the candidate home network addresses by analyzing usage patterns of the network addresses.

17. A method for classifying network addresses associated with a user, comprising:

determining location information of the network addresses;

identifying candidate first locations from the location information;

determining second locations from the candidate first locations using a geographic parameter with respect to the location information, and based on patterns of use of the network addresses; and

filtering locations from the first and second locations that are associated with proxy servers or virtual private network (VPN) servers based on a metric by applying the metric to two locations of the first and second locations to determine that the user did not physically travel between the two locations, and removing one of the two locations from either the first or the second locations.

18. The method of claim 17, wherein the first locations are home network addresses, and the second locations comprise at least one of travel network addresses or work network addresses.

19. The method of claim 18, wherein the candidate first locations are candidate home Internet Protocol (IP) addresses associated with the user, and the second locations comprise at least one of travel IP addresses associated with the user or work IP addresses associated with the user.

20. The method of claim 18, wherein the parameter is a distance parameter applied to the candidate first locations to determine the travel network addresses, and further comprising determining the candidate first locations by applying a window of time to each network address to determine if each network address is used by the user for a threshold amount of time.