# US 11,310,325 B2 · Application session event inference from network activity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,325 B2 - Document ID: US11310325B2 - Status: Granted - Kind: B2 - Application number: 15/853,513 - Filed: 2017-12-22 - Published: 2019-06-27 - Granted: 2022-04-19 - Earliest claimed: 2017-12-22 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Rami Al-Kabra; Ruchir Sinha; Jonathan Patrick Morrow; Prem Kumar Bodiga; Ijaz Ahamed Meeran Abdul Jabbar - Web page: https://patentgrep.com/patent/US11310325B2 ## CPC - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 16/337: {Profile generation, learning or modification} - G06F 16/9535: Search customisation based on user profiles and personalisation - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - G06N 20/20: Ensemble learning - G06Q 30/0201: Market modelling; Market analysis; Collecting market data - H04L 43/062: related to network traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A computing system may automatically infer one or more events that occur during an application session involving activity on a network, such as the Internet. Such an application session may be interactions with, for example, social networking websites, banking websites, news websites, and so on. Events are any of a number of activities or transactions that may occur during the application session. The computing system may automatically infer an event by gathering network transaction data for network transactions performed by one or more client devices of a wireless communication network. The computing system may generate a network activity signature based, at least in part, on the network transaction data and apply pattern recognition and/or machine learning to the network activity signature to infer events associated with the network activity signature. ## Claims ### Claim 1 A computer-implemented method comprising: gathering network transaction data for network transactions performed by a plurality of client devices of a wireless communication network from weblogs, each client device being associated with a weblog, wherein the network transaction data in at least two of the weblogs includes different types of network transaction data, and wherein the number of client devices exceeds a threshold for ensuring anonymity of client devices; generating network activity signatures based, at least in part, on the network transaction data including the different types of network transaction data and metrics of the network transaction data associated with the user behavior of the client devices; gathering additional network transaction data for network transactions associated with an application and performed by a particular client device of the wireless communication network; comparing at least one of the network activity signatures to the additional network transaction data; and based on the comparing, inferring one or more events within the application, the inferring of the one or more events being performed without using data related to or derived from direct detection or direct measurement of the one or more events. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein generating the network activity signatures is further based, at least in part, on patterns and sequences of the network transaction data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the network transaction data includes metrics associated with bulk data transfer to the client devices. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising anonymizing the network transaction data prior to generating the network activity signatures. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: using the network activity signatures as training data; machine learning associations among the network activity signatures and the network transactions; and inferring the one or more events within the application based, at least in part, on the machine learning. ### Claim 6 An apparatus comprising: a non-transitory storage medium; and instructions stored in the non-transitory storage medium, the instructions being executable by the apparatus to: gather network transaction data for network transactions performed by a plurality of client devices of a wireless communication network from weblogs, each client device being associated with a weblog, wherein the network transaction data in at least two of the weblogs includes different types of network transaction data, and wherein the number of client devices exceeds a threshold for ensuring anonymity of client devices; generate network activity signatures based, at least in part, on the network transaction data including the different types of network transaction data and metrics of the network transaction data associated with the user behavior of the client devices; gather additional network transaction data for network transactions associated with an application and performed by a particular client device of the wireless communication network; compare at least one of the network activity signatures to the additional network transaction data; and based on the comparing, infer one or more events within the application, the inferring of the one or more events being performed without using data related to or derived from direct detection or direct measurement of the one or more events. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein generating the network activity signatures is further based, at least in part, on patterns and sequences of the network transaction data. ### Claim 8 (depends on 6) The apparatus of claim 6, wherein the network transaction data includes metrics associated with bulk data transfer to the client devices. ### Claim 9 (depends on 6) The apparatus of claim 6, wherein the instructions are further executable by the apparatus to: use the network activity signatures as training data; machine learn associations among the network activity signatures and the network transactions; and infer the one or more events within the application based, at least in part, on the machine learning. ### Claim 10 (depends on 6) The apparatus of claim 6, wherein the instructions are further executable by the apparatus to: generate an additional network activity signature based, at least in part, on the additional network transaction data, wherein the comparing the at least one of the network activity signatures to the additional network transaction data further comprises comparing the at least one of the network activity signatures to the additional network activity signature. ### Claim 11 A wireless communication network comprising: one or more processors; a non-transitory storage medium; and instructions stored in the non-transitory storage medium, the instructions being executable by the one or more processors to: gather network transaction data for network transactions performed by a plurality of client devices of a wireless communication network from weblogs, each client device being associated with a weblog, wherein the network transaction data in at least two of the weblogs includes different types of network transaction data, and wherein the number of client devices exceeds a threshold for ensuring anonymity of client devices; generate network activity signatures based, at least in part, on the network transaction data including the different types of network transaction data and metrics of the network transaction data associated with the user behavior of the client devices; gather additional network transaction data for network transactions associated with an application and performed by a particular client device of the wireless communication network; compare at least one of the network activity signatures to the additional network transaction data; and based on the comparing, infer one or more events within the application, the inferring of the one or more events being performed without using data related to or derived from direct detection or direct measurement of the one or more events. ### Claim 12 (depends on 11) The wireless communication network of claim 11, wherein the instructions are further executable by the one or more processors to anonymize the network transaction data prior to generating the network activity signatures. ### Claim 13 (depends on 11) The wireless communication network of claim 11, wherein the instructions are further executable by the one or more processors to: use the network activity signatures as training data; machine learn associations among the network activity signatures and the network transactions; and infer the one or more events within the application based, at least in part, on the machine learning. ### Claim 14 (depends on 11) The wireless communication network of claim 11, wherein the network transaction data includes metrics associated with bulk data transfer to the client devices.