Client Device Tracking via Network Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network tracking systems struggle to accurately identify and track multiple client devices used by a single user across different IP addresses and devices of varying types, leading to inaccurate behavioral modeling and reduced malware detection efficacy.
Innovation Solution
A client device tracking module that analyzes network traffic data, including HTTP proxy logs, to determine whether a device sample belongs to an existing device model or requires a new model creation, using relational criteria such as IP address, User-Agent strings, and visited hostnames, enabling precise tracking of client devices over time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network tracking systems use traditional IP address-based identification, then the system structure remains simple, but the tracking accuracy deteriorates because multiple devices may share the same IP address or a single device may use multiple IP addresses
Solution Approach 1:
The patent segments the device identification process into multiple independent components: device sample collection, feature extraction, device model creation, and model matching. Each component handles a specific aspect of identification, improving accuracy without requiring complete system redesign. The device model itself is segmented into multiple features (User-Agent, screen resolution, installed applications, etc.) that can be independently analyzed and combined.
Solution Approach 2:
The patent introduces device models as intermediary objects between raw network traffic data and identification results. These models serve as mediators that store extracted device features and enable comparison against new device samples. This intermediary layer decouples the complexity of feature extraction from the matching process, allowing accurate tracking while maintaining system modularity.
2Measurement precision
If the system creates separate device models for each client device, then device tracking precision improves, but the quantity of data stored and processing requirements increase
Solution Approach 1:
The patent extracts only the most relevant and distinctive features from complete device profiles, such as User-Agent strings, screen resolutions, and installed applications. By selecting and storing only these key identifying characteristics rather than all possible device attributes, the system achieves accurate device differentiation while minimizing data storage requirements and processing overhead.
Solution Approach 2:
The system collects more device features than strictly necessary for basic identification (excessive action), including detailed information about installed applications, screen resolutions, and browser configurations. This partial over-collection ensures robust device differentiation even when some features are missing or change, while the selective storage of only essential features in device models prevents excessive data accumulation.
3Reliability
If the system monitors and analyzes all network traffic data from multiple devices, then malware detection capability improves, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary device identification and characterization by creating device models from collected network traffic data before malware detection is needed. These pre-built models contain extracted device features that can be quickly matched against new traffic samples. This preliminary action separates the time-consuming feature extraction process from the real-time detection process, enabling fast malware detection while maintaining high reliability.
Solution Approach 2:
The system applies different processing depths to different types of network traffic data based on their relevance to malware detection. Device identification features (User-Agent, screen resolution) are extracted and stored for all traffic, while more intensive analysis is applied only when anomalies are detected or when creating initial device profiles. This local quality approach optimizes processing time by avoiding uniform deep analysis of all traffic data.
Data Source
AI summary
A computing device having connectivity to a network stores one or more existing device models, where each of the one or more existing device models is a representation of a different client device used by a first authenticated user to access the network. The computing device obtains a device sample, which comprises network traffic data that is captured during a period of time and which is generated by a particular client device associated with the authenticated user of the network. The computing device determines, based on one or more relational criteria, whether the device sample should be assigned to one of the one or more existing device models or to an additional device model that has not yet been created. The computing device then determines relative identity of the particular client device based on whether the device sample is assigned to one of the one or more device models or to an additional device model that has not yet been created.