# US 12,015,808 B2 · System and method for identifying encrypted, pre-recorded media content in packet data networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,808 B2 - Document ID: US12015808B2 - Status: Granted - Kind: B2 - Application number: 18/185,893 - Filed: 2023-03-17 - Published: 2023-07-13 - Granted: 2024-06-18 - Earliest claimed: 2021-04-23 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Yuan Ding; Natalia Schenck; Daniel Sanchez; Umut Akyol; Lawrence E. Bakst; Vinay Sharma - Web page: https://patentgrep.com/patent/US12015808B2 ## CPC - H04N 21/23418: {involving operations for analysing video streams, e.g. detecting features or characteristics (television picture signal circuitry for scene change detection H04N5/147; filtering for image enhancement G06T5/00; methods or arrangements for recognising scenes G06V20/00; arrangements characterised by components specially adapted for monitoring, identification or recognition of video in broadcast systems H04H60/59)} - G06F 17/15: Correlation function computation {including computation of convolution operations (arithmetic circuits for sum of products per se, e.g. multiply-accumulators G06F7/5443; digital filters, e.g. FIR, IIR, adaptive filters H03H17/00)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04N 21/233: Processing of audio elementary streams {(monitoring, identification or recognition of audio in broadcast systems H04H60/58)} - H04N 21/2407: {Monitoring of transmitted content, e.g. distribution time, number of downloads (arrangements for monitoring programmes for broadcast or for distribution combined with broadcast H04H20/14)} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects of the subject disclosure may include, for example, a device having a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations including receiving encrypted hypertext transport protocol (HTTPS) traffic including media content; separating the HTTPS traffic into audio segments and video segments; calculating a size for each audio segment in the HTTPS traffic; maintaining a sliding window of a plurality of sizes of consecutive audio segments to form a fingerprint; and identifying the media content by matching the fingerprint with a reference in a catalog. Other embodiments are disclosed. ## Claims ### Claim 1 A device, comprising: a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising: calculating a segment size for each encrypted audio segment in encrypted audio segments separated from encrypted hypertext transport protocol (HTTPS) traffic carrying media content; determining one or more indices from a sliding window of a plurality of segment sizes of consecutive encrypted audio segments, wherein the indices are calculated by summing selected segment sizes in plurality of segment sizes and dividing by a total of sizes of the plurality of segment sizes in the sliding window; and identifying the media content by matching the indices with a reference in a catalog. ### Claim 2 (depends on 1) The device of claim 1, wherein the matching calculates a correlation coefficient between the indices and the reference. ### Claim 3 (depends on 2) The device of claim 2, wherein the correlation coefficient is a Pearson product-moment correlation coefficient. ### Claim 4 (depends on 3) The device of claim 3, wherein the matching is determined when the correlation coefficient is 99.9% or higher. ### Claim 5 (depends on 4) The device of claim 4, wherein the catalog is a three-dimensional k-d tree. ### Claim 6 (depends on 5) The device of claim 5, wherein the sliding window comprises six segment sizes and each index to the catalog is determined by summing a subset of the six segment sizes. ### Claim 7 (depends on 6) The device of claim 6, wherein each index is a ratio of a first sum of two different segment sizes to a second sum of all sizes of the six segment sizes. ### Claim 8 (depends on 7) The device of claim 7, wherein each segment size is calculated from transport control protocol sequence numbers for a corresponding segment. ### Claim 9 (depends on 1) The device of claim 1, wherein the operations further comprise: calculating a video segment size for each encrypted video segment; maintaining a second sliding window of a plurality of video segment sizes of consecutive encrypted video segments to form a fingerprint; and identifying the media content by matching the fingerprint with a second reference in the catalog. ### Claim 10 (depends on 1) The device of claim 1, wherein the processing system comprises a plurality of processors operating in a distributed computing environment. ### Claim 11 A non-transitory, machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising: calculating a segment size for each encrypted segment in encrypted hypertext transport protocol (HTTPS) traffic carrying media content; determining one or more indices from a sliding window of a plurality of segment sizes of consecutive encrypted segments, wherein each index of the one or more indices are calculated from a mathematical combination of segment sizes in the plurality of segment sizes in the sliding window; and identifying the media content by matching the indices with a reference in a catalog. ### Claim 12 (depends on 11) The non-transitory, machine-readable medium of claim 11, wherein the matching calculates a correlation coefficient between the indices and the reference. ### Claim 13 (depends on 12) The non-transitory, machine-readable medium of claim 12, wherein the matching is determined when the correlation coefficient is 99.9% or higher. ### Claim 14 (depends on 13) The non-transitory, machine-readable medium of claim 13, wherein the sliding window comprises six segment sizes. ### Claim 15 (depends on 14) The non-transitory, machine-readable medium of claim 14, wherein each segment size is calculated from transport control protocol sequence numbers for a corresponding segment. ### Claim 16 (depends on 15) The non-transitory, machine-readable medium of claim 15, wherein the operations further comprise separating the encrypted HTTPS traffic into encrypted audio segments and encrypted video segments; and wherein the plurality of segment sizes is of the encrypted audio segments only. ### Claim 17 (depends on 16) The non-transitory, machine-readable medium of claim 16, wherein the processing system comprises a plurality of processors operating in a distributed computing environment. ### Claim 18 A method, comprising: calculating, by a processing system comprising a processor, a segment size for each encrypted segment in encrypted hypertext transport protocol (HTTPS) traffic including media content; determining one or more indices, by the processing system, from a sliding window of a plurality of segment sizes of consecutive encrypted segments, wherein each index of the one or more indices is determined by a ratio of a sum of one or more segment sizes in the plurality of segment sizes to a total of the segment sizes in the plurality of segment sizes; and identifying, by the processing system, the media content by matching the indices with a reference. ### Claim 19 (depends on 18) The method of claim 18, wherein the reference is stored in a three-dimensional k-d tree. ### Claim 20 (depends on 18) The method of claim 18, wherein the sliding window comprises six sizes, wherein the matching calculates a correlation coefficient between the one or more indices and the reference, and wherein the matching is determined when the correlation coefficient is 99.9% or higher.