Web page spectroscopy

A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor of network equipment, facilitate performance of operations, comprising:

• receiving first data and second data via a network, wherein the first data describes a first communication packet flow associated with a first user equipment and the second data describes a second communication packet flow associated with the first user equipment;
• based on the first data and the second data, training a model to detect respective behaviors represented by the first data and the second data, wherein at least one of the respective behaviors is indicative of tethering;
• and
• extracting a common parameter from third data that describes a third communication packet flow via the network and fourth data that describes a fourth communication packet flow via the network based on the model, wherein the common parameter is an indication of concurrent usage at the first user equipment, and wherein the common parameter is associated with web page displays;
• identifying overlapping web page displays of the web page displays that are associated with the first user equipment, wherein the overlapping web page displays comprise a first web page and a second web page, wherein the identifying comprises analyzing respective spectroscopic signatures associated with the web page displays, and wherein the respective spectroscopic signatures indicate interactions associated with the overlapping web page displays;
• determining that tethering is occurring at the first user equipment based on the overlapping web page displays, wherein the first web page is output at the first user equipment, and wherein the second web page is output at a second user equipment that is tethered to the first user equipment;
• determining that the tethering is an unauthorized tethering;
• and
• disabling a tethering option at the first user equipment based on the determining that the tethering is the unauthorized tethering.

A method, comprising:

• receiving, by a system operatively coupled to a processor, first data and second data via a network, wherein the first data describes a first communication packet flow associated with a first user equipment and the second data describes a second communication packet flow associated with the first user equipment;
• training, by the system, a model using, as inputs to the model, the first data and the second data, wherein the training comprises training the model to detect respective behaviors represented by the first data and the second data, wherein at least one of the respective behaviors is indicative of tethering;
• extracting, by the system, a common parameter from third data the describes a third communication packet flow via the network and fourth data that describes fourth communication packet flow via the network based on the model, wherein the common parameter is an indication of concurrent usage at the first user equipment, and wherein the common parameter is associated with web page displays;
• identifying, by the system, overlapping web page displays of the web page displays that are associated with the first user equipment, wherein the overlapping web page displays comprise a first web page and a second web page, wherein the identifying comprises analyzing respective spectroscopic signatures associated with the web page displays, and wherein the respective spectroscopic signatures indicate interactions associated with the overlapping web page displays;
• determining, by the system, that tethering is occurring at the first user equipment based on the overlapping web page displays, wherein the first web page is output at the first user equipment, and wherein the second web page is output at a second user equipment that is tethered to the first user equipment;
• and
• based on the concurrent usage and the tethering that is occurring at the first user equipment and based on a determination that the concurrent usage is unauthorized, disabling a tethering option at the first user equipment.