# US 12,113,714 B2 · System and method for monitoring and managing video stream content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,714 B2 - Document ID: US12113714B2 - Status: Granted - Kind: B2 - Application number: 18/360,013 - Filed: 2023-07-27 - Published: 2023-11-16 - Granted: 2024-10-08 - Earliest claimed: 2019-10-14 - Applicants: Sandvine Corporation - Inventors: Darrell Reginald May; Bojja Krishna Chaitanya; Srinivas Chintamaneni - Web page: https://patentgrep.com/patent/US12113714B2 ## CPC - H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 47/28: in relation to timing considerations - H04L 65/60: Network streaming of media packets - H04L 69/22: Parsing or analysis of headers - H04N 21/2407: {Monitoring of transmitted content, e.g. distribution time, number of downloads (arrangements for monitoring programmes for broadcast or for distribution combined with broadcast H04H20/14)} - H04N 21/44236: {Monitoring of piracy processes or activities (protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56)} - H04N 21/454: Content {or additional data} filtering, e.g. blocking advertisements - H04N 21/6125: {involving transmission via Internet (transmission by internet of broadcast information H04H60/82)} - H04N 21/6131: {involving transmission via a mobile phone network (wireless downlink channel access H04W74/006)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION ## Abstract A system and method for managing and monitoring video stream content. The method including: receiving a traffic flow; determining if the traffic flow is a video streaming traffic flow; if the traffic flow is a video streaming traffic flow; determine at least one attribute associated with the video streaming traffic flow; determine a probability that the traffic flow is fraudulent based on a heuristic analysis of the at least one associated attribute; if the probability is above a predetermined threshold, flag the traffic flow as a fraudulent video streaming traffic flow, otherwise allow the traffic flow to proceed to its destination without being flagged; if the traffic flow is not a video streaming traffic flow, allow the traffic flow to proceed to its destination. ## Claims ### Claim 1 A method for monitoring and managing video stream content comprising: receiving a traffic flow; determining if the traffic flow is a video streaming traffic flow; if the traffic flow is a video streaming traffic flow; determine at least one attribute associated with the video streaming traffic flow, wherein the at least one attribute comprises a channel name determined from a payload of a packet of the traffic flow; determine a probability that the traffic flow is fraudulent based on a heuristic analysis of the channel name in comparison to a legitimate video streaming traffic flow channel name; if the probability is above a predetermined threshold, flag the traffic flow as a fraudulent video streaming traffic flow, otherwise allow the traffic flow to proceed to its destination without being flagged; if the traffic flow is not a video streaming traffic flow, allow the traffic flow to proceed to its destination. ### Claim 2 (depends on 1) The method according to claim 1 wherein determining the at least one attribute associated with the traffic flow further comprises: retrieving at least one packet from the traffic flow; determining at least one header of the at least one packet; and determining at least one attribute by determining at least one field from within the at least one header. ### Claim 3 (depends on 2) The method according to claim 2 wherein the at least one header is selected from the group of Internet Protocol Header; Transmission Control Protocol Header; HyperText Transfer Protocol; Transport Layer Security/Secure Sockets Layer Header; and Domain Name Server Header. ### Claim 4 (depends on 1) The method according to claim 1 wherein determining at least one attribute associated with the traffic flow further comprises: determining a video frame of the video streaming traffic flow; performing a hash of the video frame of the video streaming traffic flow; retrieving a second hash of a video frame of a legitimate video stream; and comparing the hash to the second hash to determine whether the hashes match. ### Claim 5 (depends on 1) The method according to claim 1 wherein determining a probability of that the traffic flow is fraudulent comprises: retrieving at least one legitimate video stream attribute from a memory component; performing a comparison between the at least one legitimate video stream attributes and the at least one traffic flow attribute; and determining a match probability of the legitimated video stream and the traffic flow based on the comparison. ### Claim 6 (depends on 5) The method according to claim 5, wherein the at least one attributes are considered matched if the match probability is above 80%. ### Claim 7 (depends on 1) The method according to claim 1, wherein determining a probability of that the traffic flow is fraudulent comprises: retrieving legitimate video stream attributes from a memory component; and performing a probabilistic matching algorithm with respect to the associated attributes of the video stream traffic flow with the retrieved legitimate video stream attributes. ### Claim 8 (depends on 1) The method according to claim 1 further comprising performing traffic actions on the video stream traffic flow if the probability that the traffic flow is fraudulent is above a second predetermined threshold. ### Claim 9 (depends on 1) The method according to claim 1 wherein determining the at least one attribute associated with the traffic flow comprises: determining a packet timestamp associated with the video streaming traffic flow. ### Claim 10 A system for monitoring and managing video stream video stream content comprising: an analysis module configured to: receive a traffic flow; determine if the traffic flow is a video streaming traffic flow; if the traffic flow is a video streaming traffic flow; determine at least one attribute associated with the video streaming traffic flow, wherein the at least one attribute comprises a channel name determined from a payload of a packet of the traffic flow; a video module configured to determine a probability that the traffic flow is fraudulent based on a heuristic analysis of the channel name in comparison to a legitimate video streaming traffic flow channel name; and a reporting module configured to flag the traffic flow as a fraudulent video streaming traffic flow if the probability is above a predetermined threshold. ### Claim 11 (depends on 10) The system according to claim 10, wherein the analysis module is further configured to: retrieve at least one packet from the traffic flow; determine at least one header of the at least one packet; and determine at least one attribute by determining at least one field from within the at least one header. ### Claim 12 (depends on 11) The system according to claim 11 wherein the at least one header is selected from the group of Internet Protocol Header; Transmission Control Protocol Header; HyperText Transfer Protocol; Transport Layer Security/Secure Sockets Layer Header; and Domain Name Server Header. ### Claim 13 (depends on 10) The system according to claim 10 wherein the analysis module is further configured to: determine a video frame of the video streaming traffic flow; perform a hash of the video frame of the video streaming traffic flow; retrieve a second hash of a video frame of a legitimate video stream; and compare the hash to the second hash to determine whether the hashes match. ### Claim 14 (depends on 10) The system according to claim 10 wherein the analysis module is further configured to: retrieve at least one legitimate video stream attribute from a memory component; perform a comparison between the at least one legitimate video stream attributes and the at least one traffic flow attribute; and the video module is configured to determine a match probability of the legitimated video stream and the traffic flow based on the comparison. ### Claim 15 (depends on 14) The system according to claim 14, wherein the at least one attributes are considered matched if the match probability is above 80%. ### Claim 16 (depends on 10) The system according to claim 10, wherein the analysis module is further configured to: retrieve legitimate video stream attributes from a memory component; and perform a probabilistic matching algorithm with respect to the associated attributes of the video stream traffic flow with the retrieved legitimate video stream attributes. ### Claim 17 (depends on 10) The system according to claim 10 wherein the reporting module is further configured to perform traffic actions on the video stream traffic flow if the probability that the traffic flow is fraudulent is above a second predetermined threshold. ### Claim 18 (depends on 10) The system according to claim 10 wherein the analysis module is further configured to retrieve at least one packet from the video streaming traffic flow and determine a packet timestamp associated with the at least one packet.