IP Traffic Interception via Image Processing and Face Recognition

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing communication monitoring systems face difficulties in identifying and tracking target individuals, especially when they use encryption, Network Address Translation (NAT), or frequently change identifiers, making it hard to associate communication identifiers with the correct users.

Innovation Solution

The system extracts digital images and communication identifiers from monitored sessions, applies face recognition techniques to identify target individuals, and correlates them with communication identifiers, even in encrypted traffic, using methods like SSL Man in The Middle (MITM) decryption and image processing to overcome evasion techniques.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If communication monitoring systems use traditional identifier-based tracking methods, then they can monitor communication sessions, but they fail to reliably identify target individuals when users employ encryption, NAT, or frequently change identifiers

Engineering Contradiction:
Improveidentification reliabilityVSAvoidmonitoring system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces digital images as an intermediary element to bridge the gap between communication identifiers and target individuals. Instead of directly tracking identifiers that users can easily change or hide, the system captures images from communication sessions (emails, chats, video calls) and uses face recognition technology to identify target individuals, thereby reliably linking communications to specific persons despite identifier changes or encryption

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces traditional mechanical identifier-based tracking with biometric image processing. Rather than relying on mutable identifiers like IP addresses or phone numbers, the system uses face recognition algorithms to process images and extract immutable biometric features, substituting the mechanical identifier matching process with biological trait analysis that cannot be easily changed or obscured

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If the system extracts and processes digital images from encrypted communication traffic, then it can identify target individuals, but it requires decryption capabilities that increase system complexity

Engineering Contradiction:
Improvetarget identification precisionVSAvoiddecryption and processing complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system applies partial decryption or image extraction only when necessary for identification purposes. Rather than fully decrypting and analyzing all communication content, the system selectively extracts only the digital images required for face recognition, performing minimal necessary processing to achieve identification while avoiding the complexity of comprehensive decryption and analysis of all communication data

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentUS11019108B2System and method for interception of IP traffic based on image processing
Publication Date: 2021.05.25 COGNYTE TECH ISRAEL LTD
  • US11019108B2 patent drawing
  • US11019108B2 patent drawing

AI summary

Methods and systems for monitoring communication traffic in communication networks, such as Internet Protocol (IP) traffic transferred over the Internet or over a wireless network. The disclosed techniques identify communication traffic that is associated with target individuals, by extracting digital images from the traffic and recognizing target individuals who appear in the images. A correlation system monitors communication sessions that are conducted in a communication network to identify known target individuals who appear in images. Upon recognizing a target individual in an image extracted from a certain session, the system correlates this target user with one or more of the communication identifiers used in the session. The system automatically identifies IP addresses or other identifiers that are used by target individuals, and enable subsequent tracking of such identifiers.