System and method for IP target traffic analysis

• US 9,203,712 B2
• Filed: 03/03/2014
• Issued: 12/01/2015
• Est. Priority Date: 10/31/2010
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Altman, Yuval
• Primary Examiner(s): WILSON, ROBERT W
• Application Number:
  US14/195,346
• Publication Number:
  US 20140201361A1
• Time in Patent Office: 638 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Methods and systems for identifying network users who communicate with the network (e.g., the Internet) via a given network connection. The disclosed techniques analyze traffic that flows in the network to determine, for example, whether the given network connection serves a single individual or multiple individuals, a single computer or multiple computers. A Profiling System (PS) acquires copies of data traffic that flow through network connections that connect computers to the WAN. The PS analyzes the acquired data, attempting to identify individuals who login to servers.

Claims

1. A method, comprising:

acquiring, from a network, data traffic that is associated with a network connection;

analyzing the data traffic so as to identify individual users by detecting one or more User Identifiers (UIs) that the individual uses for login to one or more servers over the network, thereby forming a UI cluster;

associating the one or more UIs with the individual according to one or more association criteria;

creating a list of one or more individuals who are served by the network connection by processing the acquired data traffic; and

outputting the created list of the individuals.

2. The method according to claim 1, wherein acquiring the data traffic comprises acquiring login and logout events that are associated with the network connection, and wherein creating the list comprises identifying the individuals by analyzing the login and logout events.

3. The method according to claim 1, wherein the association criteria are statistical and are based on typical habits of computer users.

4. The method according to claim 3, wherein associating the UIs comprises detecting at least one event selected from a group of events consisting of:

two or more UIs that are concurrently associated with active data transfer through a given computer that is served by the network connection;

two or more UIs having similar activity time patterns;

two or more UIs that are logged in during similar time patterns;

two or more UIs that that lexicographically similar and are concurrently logged in;

one or more events in which two or more UIs login simultaneously;

one or more events in which two or more UIs logout simultaneously; and

a UI that is not associated with any other UI.

5. The method according to claim 3, wherein creating the list comprises identifying an individual who roams between the network connection and an additional network connection, by detecting a given UI in the data traffic of the network connection and in the data traffic of the additional connection.

6. The method according to claim 1, wherein creating the list comprises distinguishing between two or more of the individuals by applying one or more disassociation criteria to User Identifiers (UIs) that the individuals use for login to one or more servers over the network.

7. The method according to claim 6, wherein distinguishing between the individuals comprises detecting two or more UIs that relate to a given application and are simultaneously associated with active data transfer.

8. The method according to claim 6 wherein distinguishing between the individuals comprises distinguishing between first and second groups of the UIs that do not share any common UI, by detecting an event in which all the UIs in the first group simultaneously log out, and, after a time delay that is shorter than a predetermined value, all the UEs in the second group simultaneously log in.

9. The method according to claim 1, wherein creating the list comprises creating a first list of one or more computers that are served by the network connection, and creating a second list of the one or more individuals based on the first list.

10. The method according to claim 9, and comprising refining the first list based on the second list.

11. The method according to claim 1, wherein acquiring the data traffic comprises detecting in the data traffic events that are associated with the network connection, wherein creating the list comprises identifying the individuals by analyzing the events, and wherein the events comprise at least one event type selected from a group of types consisting of computer start-up events, computer shut-down events and service registration events.

12. Apparatus, comprising:

an interface, which is configured to acquire, from a network, data traffic that is associated with a network connection; and

a processor, which is configured to analyze data traffic so as to identify individual users by detecting one or more User Identifiers (UIs) that the individual uses for login to one or more servers over the network, thereby forming a UI cluster, and to associate the one or more UIs with the individual according to one or more association criteria; and

to create a list of one or more individuals who are served by the network connection by processing the acquired data traffic.

13. The apparatus of claim 12, wherein the association criteria are statistical and are based on typical habits of computer users.

14. The apparatus according to claim 13, wherein the processor is configured to associate the UIs by detecting at least one event selected from a group of events consisting of:

two or more UIs that are concurrently associated with active data transfer through a given computer that is served by the network connection;

two or more UIs having similar activity time patterns;

two or more UIs that are logged in during similar time patterns;

two or more UIs that that lexicographically similar and are concurrently logged in;

one or more events in which two or more UIs login simultaneously;

one or more events in which two or more UIs logout simultaneously; and

a UI that is not associated with any other UI.

15. The apparatus according to claim 13, wherein the processor is configured to identify an individual who roams between the network connection and an additional network connection by detecting a given UI in the data traffic of the network connection and in the data traffic of the additional connection.

16. The apparatus according to claim 12, wherein the processor is configured to distinguish between two or more of the individuals on the list by applying one or more disassociation criteria to User Identifiers (UIs) that the individuals use for login to one or more servers over the network.

17. The apparatus according to claim 16, wherein the processor is configured to distinguish between the individuals by detecting two or more UIs that relate to a given application and are simultaneously associated with active data transfer.

18. The apparatus according to claim 16 wherein the processor is configured to distinguish between first and second groups of the UIs that do not share any common UI, by detecting an event in which all the UIs in the first group simultaneously log out, and, after a time delay that is shorter than a predetermined value, all the UEs in the second group simultaneously log in.

19. The apparatus according to claim 12, wherein the processor is configured to create a first list of one or more computers that are served by the network connection, and to create a second list of the one or more individuals based on the first list.

20. The apparatus according to claim 19, wherein the processor is configured to refine the first list based on the second list.