# US 12,603,945 B2 · Systems and methods for inferring user activities from IoT network traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,945 B2
- Document ID: US12603945B2
- Status: Granted
- Kind: B2
- Application number: 18/620,681
- Filed: 2024-03-28
- Published: 2024-10-03
- Granted: 2026-04-14
- Earliest claimed: 2023-03-30
- Assignees: Arizona Board of Regents on behalf of Arizona State University
- Applicants: Guoliang Xue; Yinxin Wan; Kuai Xu; Feng Wang
- Inventors: Guoliang Xue; Yinxin Wan; Kuai Xu; Feng Wang
- Web page: https://patentgrep.com/patent/US12603945B2

## CPC

- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- G06N 20/20: Ensemble learning
- G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q 50/163: Real estate management
- G06Q 50/50: Business processes related to the communications industry (charging, metering or billing arrangements specially adapted for data communications H04L12/14; telephonic communication involving automatic or semi-automatic exchanges H04M3/00; arrangements for metering, time-control or time indication H04M15/00; prepayment telephone systems H04M17/00; accounting or billing for wireless communication networks H04W4/24)
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system includes a processor that accesses a sequence of device events S from IoT network traffic and a plurality of user activity signatures, each user activity signature U in the plurality of user activity signatures being a known sequence of device events. The processor is configured to infer a user activity by way of approximate user activity signature matching.

## Claims

### Claim 1

A system, comprising:
a processor in communication with a memory, the memory including instructions executable by the processor to:
access a sequence of device events S,
access a plurality of user activity signatures, each user activity signature U in the plurality of user activity signatures comprising a known sequence of device events, and
infer user activity from the sequence of device events S, wherein the processor:
calculates a minimum cost of changing a subsequence of S into an activity signature U, and
determines a plurality of approximate matches between the sequence of device events S and each activity signature U in the plurality of user activity signatures by:
identification of a plurality of subsequences of S with an associated cost in less than or equal to a parameter k, the parameter k being predetermined and associated with approximation,
iterative removal of each subsequence in the plurality of subsequences of S if the subsequence still exists in S,
inclusion of the removed subsequence in the plurality of approximate matches,
wherein iterative removal of the subsequence of device events from the sequence of events is such that the subsequences of device events with a smallest cost are removed first, and, if the cost of two or more of the subsequences are equal, removing the subsequence of the activity signature of greatest length first.

### Claim 2 (depends on 1)

The system of claim 1, wherein the minimum cost of changing a subsequence of S into the activity signature U:
removes a minimum number of device events from the subsequence of S and from the known sequence of device events of the activity signature U until remaining device events in the subsequence of S and the known sequence of device events of the activity signature U are identical; and
sums a plurality of importance weights, each importance weight in the plurality of importance weights associated with a device event removed from the known sequence of device events of the activity signature U.

### Claim 3 (depends on 1)

The system of claim 1, wherein the sequence of device events based on IoT device events from at least one smart home device.

### Claim 4 (depends on 1)

The system of claim 1, wherein a value of k is predetermined to increase or decrease a false positive rate or a false negative rate for predicting the user activity.

### Claim 5 (depends on 1)

The system of claim 1, further comprising:
a threshold variable accessible to the processor, where activity signatures having a sequence length less than or equal to the threshold variable have an associated parameter k equal to 0.

### Claim 6

A method, comprising:
accessing a sequence of device events;
accessing a plurality of user activity signatures, each user activity signature of the plurality of user activity signatures encompassing a known sequence of device events; and
inferring a set of user activities from the sequence of device events by iterative identification of one or more approximate matches of a user activity signature of the plurality of user activity signatures from the sequence of device events, each approximate match of the one or more approximate matches being a subsequence of the sequence of device events having a removal cost from the sequence of device events that is less than or equal to a maximum approximation value, including
comparing a first length of a first user activity signature associated with a first subsequence with a second length of a second user activity signature associated with a second subsequence where respective removal costs of the first subsequence and the second subsequence are equal and where the first length is greater than the second length;
removing the first subsequence from the sequence of device events; and
removing the second subsequence from the sequence of device events following removal of the first subsequence from the sequence of device events.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
determining, for a subsequence of the sequence of device events, a minimum removal cost of changing the subsequence into a user activity signature of the plurality of user activity signatures.

### Claim 8 (depends on 6)

The method of claim 6, further comprising:
identifying one or more approximate matches of a user activity signature of the plurality of user activity signatures from the sequence of device events, each approximate match of the one or more approximate matches being a subsequence of the sequence of device events having a removal cost from the sequence of device events that is equal to a transient approximation value, the transient approximation value being less than or equal to the maximum approximation value; and
removing the subsequence from the sequence of device events.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
incrementing the transient approximation value following identification of all approximate matches having removal costs that are equal to the transient approximation value until the transient approximation value is equal to the maximum approximation value.

### Claim 10 (depends on 6)

The method of claim 6, the removal cost for a subsequence being evaluated based on an edit distance between the subsequence and a user activity signature, the edit distance corresponding to a minimum removal cost of changing the subsequence to the user activity signature where an operation of deletion of a device event from the user activity signature has a first removal cost value, an operation of deletion of a device event from the subsequence has a second removal cost value, and an operation of substitution of a device event from the user activity signature or the subsequence is prohibited.

### Claim 11 (depends on 6)

The method of claim 6, each approximate match of the one or more approximate matches being represented by an ordered pair of starting indices and ending indices of the subsequence that matches the user activity signature.

### Claim 12 (depends on 6)

The method of claim 6, further comprising:
removing one or more subsequences from the sequence of device events based on removal cost in ascending order.

### Claim 13

A method, comprising:
accessing a sequence of device events;
accessing a plurality of user activity signatures, each user activity signature of the plurality of user activity signatures encompassing a known sequence of device events; and
inferring a set of user activities from the sequence of device events by iterative identification of one or more approximate matches of a user activity signature of the plurality of user activity signatures from the sequence of device events, each approximate match of the one or more approximate matches being a subsequence of the sequence of device events having a removal cost from the sequence of device events that is less than or equal to a maximum approximation value, including
comparing a first approximate match associated with a first user activity signature to a second approximate match associated with a second user activity signature, the first approximate match and the second approximate match having an overlapping event index and the first user activity signature being a subset of the second user activity signature; and
removing the first approximate match from the one or more approximate matches.

### Claim 14 (depends on 13)

The method of claim 13, the sequence of device events being captured from at least one smart home device.