Differentiating user equipment types based on TCP signatures

A method comprising:

• receiving a Transport Control Protocol (TCP) segment from a user device, wherein the TCP segment includes a TCP header and a payload, and wherein the payload includes either a Hypertext Transfer Protocol (HTTP) plaintext message or a Secure HTTP (HTTPS) encrypted message;
• extracting a TCP signature from the TCP header;
• determining whether the payload of the TCP segment includes a HTTP plaintext message or a HTTPS encrypted message;
• when the payload includes a HTTP plaintext message:
• extracting contents of a HTTP User-Agent field from the HTTP plaintext message;
• determining a device type identifier (ID) and a category ID based on the extracted contents;
• and
• updating a plurality of device signatures based on the TCP signature, the device type ID, and the category ID;
• when the payload includes a HTTPS encrypted message:
• determining a device type ID and a category ID based on the TCP signature and the plurality of device signatures;
• and
• forwarding data that includes the device type ID and the category ID to a network application.

One or more non-transitory computer readable mediums comprising computer-executable instructions, wherein when executed by one or more processors, the instructions cause the one or more processors to:

• receive a Transport Control Protocol (TCP) segment from a user device, wherein the TCP segment includes a TCP header and a payload, and wherein the payload includes either a Hypertext Transfer Protocol (HTTP) plaintext message or a Secure HTTP (HTTPS) encrypted message;
• extract a TCP signature from the TCP header;
• determine whether the payload of the TCP segment includes a HTTP plaintext message or a HTTPS encrypted message;
• when the payload includes a HTTP plaintext message:
• extract contents of a HTTP User-Agent field from the HTTP plaintext message;
• determine a device type identifier (ID) and a category ID based on the extracted contents;
• and
• update a plurality of device signatures based on the TCP signature, the device type ID, and the category ID;
• when the payload includes a HTTPS encrypted message:
• determine a device type ID and a category ID based on the TCP signature and the plurality of device signatures;
• and
• forward data that includes the device type ID and the category ID to a network application.