# US 9,883,413 B2 · Management of group mobile device network traffic usage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,883,413 B2 - Document ID: US9883413B2 - Status: Granted - Kind: B2 - Application number: 13/918,085 - Filed: 2013-06-14 - Published: 2014-12-18 - Granted: 2018-01-30 - Earliest claimed: 2013-06-14 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Cynthia Cama; Jeffrey Erman; Wen-Ling Hsu; Yu Jin; Ann E. Skudlark; Lien K. Tran - Web page: https://patentgrep.com/patent/US9883413B2 ## CPC - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04W 24/04: Arrangements for maintaining operational condition - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Network traffic usage information for a set of registered devices is monitored, analyzed, and reported within a cellular service provider portion of a communications network. The network traffic usage information can relate to data traffic, voice traffic, and/or short message service traffic. Reporting the network traffic usage information is customizable such that parameters associated with the network traffic usage can be changed, depending on the parameters that are of current interest to an organization affiliated with the set of registered devices. ## Claims ### Claim 1 A system, comprising: a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising: storing network traffic usage information associated with registered mobile devices registered to use network devices of a communication network, wherein the network traffic usage information comprises a mapping between a device associated with the registered mobile devices and a group of types of traffic usage associated with use of the device, wherein the mapping is determined as a function of a statistical analysis that classifies the device with a classification of the device as having communicated via one type of traffic usage included in the group of types of traffic usage, wherein the classification of the device is determined using a classifier that maps an attribute vector representing an input attribute to a confidence score that the input attribute belongs to a class, wherein the classifier determines a repeatedly changing hypersurface using the attribute vector, wherein the input attribute represents at least short message service data representative of short message service traffic, and wherein the class represents a group of data comprising an amount of network traffic usage for the type of traffic usage, the type of network traffic usage, and a duration of the type of network traffic usage; receiving a request for the network traffic usage information, wherein the request is received from the device associated with the registered mobile devices; sending a report to the device, wherein the report comprises at least a portion of the network traffic usage information, wherein the storing, the receiving, and the sending are performed by a network device of the network devices of the communications network; and sending an alert to the device in response to an increase in volume of data traffic to the registered mobile devices, wherein the increase is determined as a first function of the network traffic usage information and as a second function of a threshold condition being exceeded by the device, wherein the threshold condition represents a breach of a security policy, a breach of an access policy, an increase in data usage, an increase in voice usage, and a restricted website being accessed. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving the threshold condition associated with a traffic statistic of the network traffic usage information; monitoring the network traffic usage information for the traffic statistic; and transmitting to the device an indication of the traffic statistic satisfying the threshold condition. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving an indication of a mobile device to be registered as one of the registered mobile devices, wherein the mobile device is associated with an organization comprising the device; and monitoring device network traffic usage information of the mobile device for inclusion in the network traffic usage information before the storing. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a parameter of the network traffic usage information to include in the report; and modifying the report to include the parameter. ### Claim 5 (depends on 1) The system of claim 1, wherein the network traffic usage information is first network traffic usage information, wherein the mobile device is a first mobile device, and wherein the operations further comprise, at about a same time: receiving an identification of a second mobile device to include in the registered mobile devices; and receiving second network traffic usage information for the second mobile device. ### Claim 6 (depends on 1) The system of claim 1, wherein the network traffic usage information comprises traffic statistics collected on a voice channel and on a data channel of a registered mobile device of the registered mobile devices. ### Claim 7 (depends on 1) The system of claim 1, wherein at least the portion of the network traffic usage information comprises a traffic statistic, and the operations further comprise, before the generating the report: receiving a report frequency parameter representing a frequency for reports; and receiving a granularity level for the report representing a defined level of detail for reports. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations further comprise: initiating transmissions of respective network traffic usage information, for respective mobile devices of the registered mobile devices, to the respective mobile devices. ### Claim 9 (depends on 1) The system of claim 1, wherein the network traffic usage information comprises data traffic. ### Claim 10 (depends on 1) The system of claim 1, wherein the network traffic usage information comprises voice traffic. ### Claim 11 (depends on 1) The system of claim 1, wherein the network traffic usage information comprises text message service traffic. ### Claim 12 A method, comprising: receiving, by a system comprising a processor, an identifier of a device affiliated with a subscribing organization identity, wherein the identifier is associated with a mapping representative of an association between the device and a group of types of network traffic usage associated with use of the device, wherein the mapping of the association between the device and the group of types of network traffic usage is determined based on a probabilistic analysis that classifies the device as having used one of the types of network traffic usage included in the group of types of network traffic usage, wherein classification of the device is determined based on a classifier that maps an attribute vector representing an input attribute to a confidence score that the input attribute belongs to a class and that determines a multiply changing hypersurface using the attribute vector, wherein the input attribute represents at least short message service traffic, and wherein the class represents a group of data comprising an amount of network traffic usage for the one of the types of network traffic usage, the one of the types of network traffic usage, and a duration of the one of the types of network traffic usage; monitoring, by the system, the network traffic usage of the device comprising monitoring voice traffic, data traffic, and text message service traffic; creating, by the system, a customizable report that comprises a subset of the network traffic usage of the device; sending, by the system, the customizable report to a device associated with the subscribing organization identity; sending, by the system, a first alert to the device associated with the subscribing organization identity in response to determining that the device affiliated with the subscribing organization identity has exceeded a threshold condition representative of a breach of security policy, a breach in access policy, an increase in data usage, an increase in voice usage, and an access to a restricted website. ### Claim 13 (depends on 12) The method of claim 12, further comprising: receiving, by the system, a request to include a parameter of the network traffic usage in the customizable report; and including, by the system, the parameter in the customizable report; and resending, by the system, the customizable report to the device associated with the subscribing organization identity. ### Claim 14 (depends on 12) The method of claim 12, further comprising: receiving, by the system, a parameter associated with the network traffic usage; monitoring, by the system, the network traffic usage information for the parameter; and transmitting, by the system, a notification based on the network traffic usage satisfying the parameter. ### Claim 15 (depends on 14) The method of claim 14, wherein the transmitting comprises sending a second alert to the device associated with the subscribing organization identity. ### Claim 16 (depends on 12) The method of claim 12, wherein the sending comprises sending the customizable report in a format accessible by the device associated with the subscribing organization identity via a mobile application. ### Claim 17 (depends on 12) The method of claim 12, wherein the sending comprises sending the customizable report in a format accessible by the device associated with the subscribing organization identity via a network browser application. ### Claim 18 A non-transitory computer-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising: obtaining network traffic usage information associated with registered mobile devices, wherein the network traffic usage information is stored as a mapping between a device associated with the registered mobile devices and a group of types of traffic usage associated with use of the device, wherein the mapping is determined as a function of a probabilistic analysis that classifies the device as having communicated via one type of traffic usage included in the group of types of traffic usage, wherein classification of the device is determined based on using a classifier that maps an attribute vector representing an input attribute to a confidence score that the input attribute belongs to a class and that determines a dynamically changing hypersurface using the attribute vector, wherein the input attribute represents at least short message service traffic, and wherein the class represents a group of data comprising an amount for the type of network traffic usage, the type of network traffic usage, and a duration of the type of network traffic usage; receiving a request for a report of the network traffic usage information, wherein the request is received from an administrator device associated with the registered mobile devices; sending a customizable report to the administrator device, wherein the customizable report comprises at least some of the network traffic usage information, and wherein the obtaining, the receiving, and the sending are performed by network devices within a communications network; as a function of the network traffic usage information, identifying an increase in data traffic volume being transmitted to the registered mobile devices, wherein the increase in data traffic volume is determined as a function of a threshold condition being exceeded by the registered mobile devices, wherein the threshold condition represents a breach of a security policy and access policy, an increase in data usage and in voice usage, and an access to a restricted website; and in response to the identifying, sending a first alert to the registered mobile devices indicating the increase in data traffic volume. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, the operations further comprising: receiving the threshold condition associated with the network traffic usage information; monitoring the network traffic usage information for an occurrence of the threshold condition; and in response to the occurrence of the threshold condition, pushing a second alert of the occurrence of the threshold condition to the administrator device. ### Claim 20 (depends on 18) The non-transitory computer-readable medium of claim 18, the operations further comprising: receiving a report frequency parameter and a granularity level for the report; and generating the report comprising the network traffic usage information at the granularity level, wherein the sending the customizable report comprises sending the report at a frequency indicated by the report frequency parameter.