US 11,444,956 B2Granted

System and method for de-anonymizing actions and messages on networks

AssigneeCognyte Technologies Israel Ltd.

InventorsOffri Gil, Omer Ziv, Yuval Altman, Yaron Gvilli, Hodaya Shabtay, Omri David, Yitshak Yishay

Life of this patent

Estimating the term…

Loading patent…

Abstract

A traffic-monitoring system that monitors encrypted traffic exchanged between IP addresses used by devices and a network, and further receives the user-action details that are passed over the network. By correlating between the times at which the encrypted traffic is exchanged and the times at which the user-action details are received, the system associates the user-action details with the IP addresses. In particular, for each action specified in the user-action details, the system identifies one or more IP addresses that may be the source of the action. Based on the IP addresses, the system may identify one or more users who may have performed the action. The system may correlate between the respective action-times of the encrypted actions and the respective approximate action-times of the indicated actions. The system may hypothesize that the indicated action may correspond to one of the encrypted actions having these action-times.

Claims21

Dependent claims

A method, comprising:

monitoring one or more flows of encrypted traffic between at least one Internet Protocol (IP) address and a peer-to-peer (P2P) network;
based on the monitoring, without decrypting the flows, identifying that a particular type of action was performed at the IP address at an action-time;
receiving, from a node in the P2P network, an indication that an action of the particular type was performed;
in response to receiving the indication, identifying an approximate action-time of the action;
ascertaining that a difference between the approximate action-time and the action-time is within a predefined range;
in response to ascertaining that the difference is within the predefined range, identifying the IP address as a candidate source of the action;
in response to identifying the IP address as a candidate source of the action, associating information relating to the action with at least one descriptor that is based on the IP address;
and
generating an output that indicates the association.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/221,779Filed 3 Apr 2021 · continuation
Priority: IL 26550520 Mar 2019
Published: US 2022/0038466 A13 Feb 2022
Granted: 13 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification23 codes

H04L 43/026
Capturing of monitoring data: using flow identification
G06F 16/951
Retrieval from the web: indexing; Web crawling techniques
H04L 9/0637
Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation: modes of operation, e.g. cipher…
H04L 9/3239
Using cryptographic hash functions: involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD

Family

Application16/823,421Parent of this continuation · filed 19 Mar 2020
US 2022/0038466 A1Pre-grant publication · published 3 Feb 2022
US 10,999,295 B2Parent of this continuation
US 2020/0304519 A1Published application
US 11,444,956 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key