Deep learning based tethering detection

A system for detecting presence of device tethering, the system comprising:

• a processor;
• and
• a computer-readable storage medium having encoded thereon computer-readable instructions that when executed by the processor, cause the system to perform operations comprising:
• capturing a plurality of packets associated with a communications flow in a communications network, the communications flow associated with a subscription allowing for use of the communications network by a user;
• based on the captured packets, generating an image by converting bits of the captured packets to pixel data;
• inputting the image to a machine learning model that is trained to identify an operating system or an operating system version based on image data;
• receiving, from the machine learning model, identities of operating systems or operating system versions of source devices of the plurality of packets;
• based on the identities, determining that the plurality of packets are associated with at least two different operating systems or operating system versions;
• and
• based on the determining that the plurality of packets are associated with at least two different operating systems or operating system versions, outputting an indication of device tethering in the communications flow.

A computer-readable storage medium having encoded thereon computer-readable instructions that when executed by a system, cause the system to perform operations comprising:

• capturing a plurality of packets associated with a communications flow in a communications network, the communications flow associated with a subscription allowing for use of the communications network by a user;
• based on the captured packets, generating an image by converting bits of the captured packets to pixel data;
• inputting the image to a machine learning model that is trained to identify an operating system or an operating system version based on image data;
• receiving, from the machine learning model, identities of operating systems or operating system versions of source devices of the plurality of packets;
• based on the identities, determining that the plurality of packets are associated with at least two different operating systems or operating system versions;
• and
• based on the determining that the plurality of packets are associated with at least two different operating systems or operating system versions, outputting an indication of device tethering in the communications flow.