System to identify a computer on a network
OwnerRobert STEELEinventor
Life of this patent
Estimating the term…
Abstract
A system, a method, and a computer program for identifying a device on a network that participates in communication sessions, where the device may rotate its IP address between communication sessions. A plurality of unauthorized communication sessions that are carried out on different IP addresses are captured, stored, and analyzed to determine whether the same device was used during the communication sessions.
Claims20
A network system that identifies a device participating in two or more communication sessions on a network where an IP address assigned to the device is subject to change, the network system comprising:
- a network interface that receives a data packet from the device corresponding to a communication session that includes a portion of a predetermined file;
- a packet parser that separates metadata from a header of the received data packet, the metadata comprising an IP address and a port number corresponding to the received data packet;
- an IP address—port number combination comparator that compares the IP address and the port number combination to one or more IP address—port number combinations previously stored in memory;
- and
- a notice signal generator that generates a notice signal when the IP address—port number combination comparator identifies more than a predetermined number of previously stored IP address—port number combinations that match the IP address and the port number combination,
- wherein the network interface transmits the notice signal to an Internet Service Provider to identify the device, and
- wherein the network interface further transmits the portion of the predetermined file to be reproduced on the device to verify the communication session.
A network system that identifies a device participating in two or more unauthorized communication sessions on a network where an IP address assigned to the device is subject to change, the network system comprising:
- a network interface that receives a data packet from the device corresponding to an unauthorized communication session;
- a packet parser that separates metadata from a header of the received data packet, the metadata comprising an IP address and a port number corresponding to the received data packet;
- an IP address—port number combination comparator that compares the IP address and the port number combination to one or more IP address—port number combinations previously stored in memory;
- and
- a notice signal generator that generates a notice signal when the IP address—port number combination comparator identifies more than a predetermined number of previously stored IP address—port number combinations that match the IP address and the port number combination,
- wherein the network interface transmits the notice signal to an Internet Service Provider to identify the device.
The network system of 15, wherein the file list comparator causes a start reporting record to be generated when the current file list is determined to match one or more stored file lists.
A network system that identifies a device participating in two or more unauthorized communication sessions on a network where an IP address assigned to the device is subject to change, the network system comprising:
- a network interface that receives a data packet from the device corresponding to an unauthorized communication session that includes a portion of a predetermined file;
- a packet parser that separates metadata from a header of the received data packet, the metadata comprising an IP address and a port number corresponding to the received data packet;
- an IP address—port number combination comparator that compares the IP address and the port number combination to one or more IP address—port number combinations previously stored in memory;
- and
- a file list comparator that compares a current file list that corresponds to the received data packet to one or more stored file lists when the IP address—port number combination comparator does not identify a match for the IP address—port number combination,
- wherein the file list comparator causes a start reporting record to be generated when the current file list is determined to match one or more stored file lists.
Dependencies are inferred from the claim text.