# US 2019/0356571 A1 · Determining attributes using captured network probe data in a wireless communications system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356571 A1 - Document ID: US20190356571A1 - Status: Published application - Kind: A1 - Application number: 16/531,458 - Filed: 2019-08-05 - Published: 2019-11-21 - Earliest claimed: 2017-02-14 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: James Keith Pope - Web page: https://patentgrep.com/patent/US20190356571A1 ## CPC - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04W 12/08: Access security - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04W 48/14: using user query {or user detection} - H04W 84/12: WLAN [Wireless Local Area Networks] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Wireless user device probe data can be used to infer or determine an attribute of a user. The probe data can be captured by a sensor device from probes from the user device. The probe data can include network addresses of the wireless access points to which the user device has wirelessly connected prior to attempting a current connection to a wireless access point. The probe data can also include connection information about wireless links between the user device and the wireless access points to which the user device has connected prior to attempting the current connection. The probe data and a user device identifier can be provided for comparing the probe data to access point network addresses associated with attributes to determine an attribute for a user of the user device. ## Claims ### Claim 1 A sensor device comprising: a processor; and a memory device having instructions that are executable by the processor to cause the sensor device to: capture probe data from a user device, the probe data including (i) one or more network addresses of one or more wireless access points to which the user device has wirelessly connected prior to attempting a current connection to a wireless access point and (ii) connection information about wireless links between the user device and the one or more wireless access points to which the user device has connected prior to attempting the current connection; and provide the probe data and a user device identifier for comparing the probe data to access point network addresses associated with attributes to determine an attribute for a user of the user device. ### Claim 2 (depends on 1) The sensor device of claim 1, wherein the probe data includes Service Set Identifiers (SSIDs) for the one or more wireless access points to which the user device has previously wirelessly connected and time data from the connection information, the one or more wireless access points being WiFi access points, wherein the user device identifier is a media access control (MAC) address for the user device, wherein the attributes include relative security risks for the one or more wireless access points that are based on security threats of users previously identified within coverage areas of the one or more wireless access points or are based on security threats associated with physical locations associated with the one or more wireless access points. ### Claim 3 (depends on 2) The sensor device of claim 2, wherein the instructions are further executable to cause the sensor device to: designate at least one attribute as a high security risk; and analyze access point network addresses in an electronic data store by: identifying the access point network addresses that are associated with the high security risk; comparing the access point network addresses associated with the high security risk to the probe data to determine a match of a network address or a physical location to at least one of the access point network addresses that is associated with the high security risk; and outputting an alert about the user in response to determining the match; and add the probe data to the electronic data store as additional access point network addresses associated with the attributes. ### Claim 4 (depends on 1) The sensor device of claim 1, wherein the instructions are executable by the processor to cause the sensor device to provide the probe data and the user device identifier by transmitting the probe data and the user device identifier from the sensor device through a cellular communications network backhaul for receipt by a computing device for comparing the probe data to the access point network addresses associated with the attributes to determine the attribute for the user of the user device, the sensor device being positionable on a tower, a utility pole, or an aerial object. ### Claim 5 (depends on 1) The sensor device of claim 1, wherein the sensor device is separate and independent from any wireless access point and from the user device, the attribute for the user being determinable from network activity with respect to the one or more wireless access points. ### Claim 6 (depends on 1) The sensor device of claim 1, wherein the connection information includes one or more dates and times at which the user device connected to the one or more wireless access points, and one or more amounts of time that the user device connected to the one or more wireless access points. ### Claim 7 (depends on 1) The sensor device of claim 1, further comprising: an antenna configured to detect wireless signals in multiple channels from the user device; a demodulator configured to demodulate the wireless signals to extract the probe data from the wireless signals; and a transmitter configured to modulate the probe data on signals for providing the probe data via a communications protocol different than the communications protocol of the wireless signals detected by the antenna. ### Claim 8 A method comprising: capturing, by a sensor device, probe data from a user device, the probe data including (i) one or more network addresses of one or more wireless access points to which the user device has wirelessly connected prior to attempting a current connection to a wireless access point and (ii) connection information about wireless links between the user device and the one or more wireless access points to which the user device has connected prior to attempting the current connection; and providing the probe data and a user device identifier for comparing the probe data to access point network addresses associated with attributes to determine an attribute for a user of the user device. ### Claim 9 (depends on 8) The method of claim 8, wherein the probe data includes Service Set Identifiers (SSIDs) for the one or more wireless access points to which the user device has previously wirelessly connected and time data from the connection information, the one or more wireless access points being WiFi access points, wherein the user device identifier is a media access control (MAC) address for the user device, wherein the attributes include relative security risks for the one or more wireless access points that are based on security threats of users previously identified within coverage areas of the one or more wireless access points or are based on security threats associated with physical locations associated with the one or more wireless access points. ### Claim 10 (depends on 9) The method of claim 9, further comprising: designating at least one attribute as a high security risk; and analyzing the access point network addresses in an electronic data store by a computing device: identifying the access point network addresses that are associated with the high security risk; comparing the access point network addresses associated with the high security risk to the probe data to determine a match of a network address or a physical location to at least one access point network addresses that is associated with the high security risk; and outputting an alert about the user in response to determining the match; and adding the probe data to the electronic data store as additional access point network addresses associated with the attributes. ### Claim 11 (depends on 8) The method of claim 8, wherein providing the probe data and the user device identifier comprises transmitting the probe data and the user device identifier from the sensor device through a cellular communications network backhaul for receipt by a computing device, the sensor device being positioned on a tower, a utility pole, or an aerial object. ### Claim 12 (depends on 8) The method of claim 8, wherein the sensor device is separate and independent from any wireless access point and from the user device, the attribute for the user being determined from network activity with respect to the one or more wireless access points. ### Claim 13 (depends on 8) The method of claim 8, wherein the connection information includes a date and time at which the user device connected to at least one of the one or more wireless access points, and an amount of time that the user device connected to the at least one of the one or more wireless access points. ### Claim 14 (depends on 8) The method of claim 8, wherein capturing, by the sensor device, the probe data wirelessly transmitted from the user device comprises: detecting, by an antenna of the sensor device, wireless signals in multiple channels from the user device; demodulating, by a demodulator of the sensor device, the wireless signals to extract the probe data from the wireless signals; and storing the probe data electronically in a computer-readable medium of the sensor device. ### Claim 15 A non-transitory computer-readable storage medium including instructions that are executable by a processor to: receive probe data from a user device, the probe data including (i) one or more network addresses of one or more wireless access points to which the user device has wirelessly connected prior to attempting a current connection to a wireless access point and (ii) connection information about wireless links between the user device and the one or more wireless access points to which the user device has connected prior to attempting the current connection; and provide the probe data and a user device identifier for comparing the probe data to access point network addresses associated with attributes to determine an attribute for a user of the user device. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the probe data includes Service Set Identifiers (SSIDs) for the one or more wireless access points to which the user device has previously wirelessly connected, and time data from the connection information, the one or more wireless access points being WiFi access points, wherein the user device identifier is a media access control (MAC) address for the user device. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the instructions are further executable to: designate at least one attribute as a high security risk; and analyze access point network addresses in an electronic data store by: identifying the access point network addresses that are associated with the high security risk; comparing the access point network addresses associated with the high security risk to the probe data to determine a match of a network address or a physical location to at least one access point network address that is associated with the high security risk; and outputting an alert about the user in response to determining the match; and add the probe data to the electronic data store as additional access point network addresses associated with the attributes. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions are executable to determine or infer the attribute for the user based on network activity detected by a sensor device that is separate and independent from any wireless access point and from the user device. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions are further executable to: demodulate wireless signals in multiple channels received from the user device to extract the probe data from the wireless signals; and modulate the probe data onto signals for providing the probe data to a computing device. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the instructions are further executable to transmit modulated signals including probe data to a cellular communications network for receipt by the computing device.