SYSTEM AND METHOD FOR IDENTIFYING COMMUNICATION SESSION PARTICIPANTS BASED ON TRAFFIC PATTERNS

摘要

A monitoring system monitors traffic flows that are exchanged over a communication network. The system characterizes the flows in terms of their temporal traffic features, and uses this characterization to identify communication devices that participate in the same communication session. By identifying the communication devices that serve as endpoints in the same session, the system establishes correlations between the users of these communication devices. The monitoring system characterizes the flows using traffic features such as flow start time, flow end time, inter-burst time and burst size, and/or statistical properties of such features. The system typically generates compressed-form representations (“signatures”) for the traffic flows based on the temporal traffic features, and finds matching flows by finding similarities between signatures.

主权项

1. A method, comprising:
monitoring a plurality of traffic flows exchanged over a communication network; determining respective temporal traffic features for the monitored traffic flows; and identifying communication devices that participate in a same communication session, by finding a match between respective temporal traffic features of the traffic flows exchanged by the communication devices.