Social Media Forensics Using IPDR Identity Correlation

The patent introduces an intermediary system that acts as a mediator between encrypted traffic and subscriber identification. This system captures network traffic metadata, correlates it with subscriber information from service providers, and creates IPDR records that link encrypted communications to subscriber identities without decrypting the actual content. The intermediary approach allows identification while preserving encryption-based privacy.

The system performs preliminary actions by pre-establishing correlations between network traffic patterns and subscriber identities before encrypted communications occur. It captures metadata, establishes baseline traffic patterns, and creates identification records in advance, enabling later correlation of encrypted traffic with specific subscribers without requiring real-time decryption.

The patent segments the identity correlation problem into multiple identifiable components. Instead of treating virtual identities as a single undifferentiated entity, the system breaks down correlation into segments: network IP addresses, device identifiers, traffic patterns, timestamps, and subscriber information. By segmenting the identification process, the system can correlate virtual identities with physical subscribers through multiple independent data points, improving measurement precision.

The system changes parameters by shifting from direct identity matching to multi-parameter correlation. Instead of relying on a single identifier, it uses multiple parameters including traffic volume, timing patterns, duration of connections, and network path characteristics. This parametric approach enables accurate correlation of virtual identities with physical subscribers even when multiple virtual identities are used.