# US 10,771,568 B2 · System for intercepting and reconstructing session data for web incidents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,568 B2 - Document ID: US10771568B2 - Status: Granted - Kind: B2 - Application number: 16/137,127 - Filed: 2018-09-20 - Published: 2020-03-26 - Granted: 2020-09-08 - Earliest claimed: 2018-09-20 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Ramesh Alagar; Prabakar Rangarajan - Web page: https://patentgrep.com/patent/US10771568B2 ## CPC - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/30: {for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281)} - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04L 67/564: Enhancement of application control based on intercepted application data - H04L 2463/121: Timestamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for generating user session objects is disclosed. The system intercepts web traffic data and extracts dynamic content items from the web traffic data such that the dynamic content items are separated from static content items. The system further groups the dynamic content items based on their associated user session IDs. The system then links together the dynamic content items of a group in sequence to generate a user session object, wherein the dynamic content items include one or more static content reference IDs associated with the static content items. ## Claims ### Claim 1 A system for generating a user session object, comprising: a memory; one or more processors; a sequence builder engine implemented by the one or more processors and configured to: receive a web traffic data stream, the web traffic data stream comprising a plurality of dynamic content items and a plurality of static content items, each of the dynamic content items being associated with a user session ID, each of the dynamic content items comprising one or more static content reference IDs associated with one or more of the static content items, each of the dynamic content items being associated with a timestamp; extract the plurality of the dynamic content items from the web traffic data stream such that the dynamic content items are separated from the static content items; group the plurality of dynamic content items into a number of groups based on the user session IDs associated with the dynamic content items, each group being associated with a user session ID; identify a first group of dynamic content items that are associated with a first user session ID; concatenate the first group of dynamic content items based on the timestamps associated with the first group of dynamic content items; generate a first user session object for the first group of dynamic content items, the first user session object comprising the concatenated first group of dynamic content items; and store the first user session object in the memory. ### Claim 2 (depends on 1) The system of claim 1, wherein the first user session object further comprises a marker, the marker comprising a dynamic content item identifying an exception, wherein the system further comprises a playback engine, the playback engine implemented by the one or more processors and configured to: identify the marker in the first user session object; identify, from the first user session object, a first predetermined number of dynamic content items before the marker based on their timestamps; identify, from the first user session object, a second predetermined number of dynamic content items after the flagging item based on their timestamps; and determine a subset of the first user session object, the subset of the first user session object comprising the first predetermined number of dynamic content items and the second first predetermined number of dynamic content items. ### Claim 3 (depends on 2) The system of claim 2, wherein the playback engine is further configured to: identify a number of dynamic content items in the subset of the first user session object; identify one or more static content reference IDs in the identified dynamic content items, the one or more static content reference IDs being associated with one or more static content items; retrieve the one or more static content items based on the one or more static content reference IDs; generate a reconstructed user session object, the reconstructed user session object comprising the identified dynamic content items and the retrieved one or more static content items; and render the reconstructed user session object. ### Claim 4 (depends on 3) The system of claim 3, wherein generating the reconstructed user session object comprising associating the retrieved one or more static content items with the identified dynamic content items. ### Claim 5 (depends on 1) The system of claim 1, wherein each of the static content items comprises: a JavaScript (JS) element; a cascading style sheet (CSS) element; or an image. ### Claim 6 (depends on 1) The system of claim 1, wherein each of the dynamic content items comprises a dynamic web page. ### Claim 7 (depends on 1) The system of claim 1, wherein each of the static content reference IDs comprises a web address associated with a static content item. ### Claim 8 (depends on 1) The system of claim 1, wherein the web traffic data stream comprises HTTP requests and HTTP responses. ### Claim 9 (depends on 1) The system of claim 1, wherein the first user session object comprises a directed acyclic graph (DAG) object. ### Claim 10 A non-transitory computer-readable medium comprising a logic for generating a user session object, the logic, when executed by one or more processors, instructing the one or more processors to: receive a web traffic data stream, the web traffic data stream comprising a plurality of dynamic content items and a plurality of static content items, each of the dynamic content items being associated with a user session ID, each of the dynamic content items comprising one or more static content reference IDs associated with one or more of the static content items, each of the dynamic content items being associated with a timestamp; extract the plurality of the dynamic content items from the web traffic data stream such that the dynamic content items are separated from the static content items; group the plurality of dynamic content items into a number of groups based on the user session IDs associated with the dynamic content items, each group being associated with a user session ID; identify a first group of dynamic content items that are associated with a first user session ID; concatenate the first group of dynamic content items based on the timestamps associated with the first group of dynamic content items; generate a first user session object for the first group of dynamic content items, the first user session object comprising the concatenated first group of dynamic content items; and store the first user session object. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the first user session object further comprises a marker, the marker comprising a dynamic content item identifying an exception, wherein the logic further instructs the one or more processors to: identify the marker in the first user session object; identify, from the first user session object, a first predetermined number of dynamic content items before the marker based on their timestamps; identify, from the first user session object, a second predetermined number of dynamic content items after the flagging item based on their timestamps; and determine a subset of the first user session object, the subset of the first user session object comprising the first predetermined number of dynamic content items and the second first predetermined number of dynamic content items. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the logic further instructs the one or more processors to: identify a number of dynamic content items in the subset of the first user session object; identify one or more static content reference IDs in the identified dynamic content items, the one or more static content reference IDs being associated with one or more static content items; retrieve the one or more static content items based on the one or more static content reference IDs; generate a reconstructed user session object, the reconstructed user session object comprising the identified dynamic content items and the retrieved one or more static content items; and render the reconstructed user session object. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein generating the reconstructed user session object comprising associating the retrieved one or more static content items with the identified dynamic content items. ### Claim 14 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein each of the static content items comprises: a JavaScript (JS) element; a cascading style sheet (CSS) element; or an image. ### Claim 15 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the first user session object comprises a directed acyclic graph (DAG) object. ### Claim 16 A method for generating a user session object, comprising: receiving a web traffic data stream, the web traffic data stream comprising a plurality of dynamic content items and a plurality of static content items, each of the dynamic content items being associated with a user session ID, each of the dynamic content items comprising one or more static content reference IDs associated with one or more of the static content items, each of the dynamic content items being associated with a timestamp; extracting the plurality of the dynamic content items from the web traffic data stream such that the dynamic content items are separated from the static content items; grouping the plurality of dynamic content items into a number of groups based on the user session IDs associated with the dynamic content items, each group being associated with a user session ID; identifying a first group of dynamic content items that are associated with a first user session ID; concatenating the first group of dynamic content items based on the timestamps associated with the first group of dynamic content items; generating a first user session object for the first group of dynamic content items, the first user session object comprising the concatenated first group of dynamic content items; and storing the first user session object. ### Claim 17 (depends on 16) The method of claim 16, wherein the first user session object further comprises a marker, the marker comprising a dynamic content item identifying an exception, wherein the method further comprises: identifying the marker in the first user session object; identifying, from the first user session object, a first predetermined number of dynamic content items before the marker based on their timestamps; identifying, from the first user session object, a second predetermined number of dynamic content items after the flagging item based on their timestamps; and determining a subset of the first user session object, the subset of the first user session object comprising the first predetermined number of dynamic content items and the second first predetermined number of dynamic content items. ### Claim 18 (depends on 17) The method of claim 17, wherein the method further comprises: identifying a number of dynamic content items in the subset of the first user session object; identifying one or more static content reference IDs in the identified dynamic content items, the one or more static content reference IDs being associated with one or more static content items; retrieving the one or more static content items based on the one or more static content reference IDs; generating a reconstructed user session object, the reconstructed user session object comprising the identified dynamic content items and the retrieved one or more static content items; and rendering the reconstructed user session object. ### Claim 19 (depends on 18) The method of claim 18, wherein generating the reconstructed user session object comprising associating the retrieved one or more static content items with the identified dynamic content items. ### Claim 20 (depends on 16) The method of claim 16, wherein the first user session object comprises a directed acyclic graph (DAG) object.