Patent ID: 11870820
Assignee: TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 8:
9. A computer program comprising instructions which, when executed on at least one processor in a server blade in a computer system, cause the computer system to carry out the method comprising:
obtaining a plurality of messages,
decoding the obtained messages to provide a plurality of HI2 messages, each HI2 message comprising IRI associated with a target and a session, each HI2 message comprising an HI2 message sequence number and a plurality of HI2 message fields, each HI2 message field having an HI2 message field name and HI2 message field content, where the HI2 message field name identifies a type of content of the HI2 message field content,
normalizing HI2 field names by assigning a common HI2 field name to HI2 fields containing content of the same type,
grouping the HI2 messages into unique groups of messages, where each group of messages is defined by a session identity and a target identity,
identifying any SIP method and any media protocol within each group of messages,
for each group of messages, recording the identified SIP methods and media protocol, wherein during the action of recording any uniform resource identifier, URI, is disregarded, resulting in a set of sequences of the SIP methods and an indication of the media protocol of the media exchanged during a lawfully intercepted traffic case,
classifying with machine learning analysis the lawfully intercepted traffic case using the sequences, and
identifying a subsequent traffic case based at least on a classification of the lawfully intercepted traffic case determined by the machine learning analysis, wherein the subsequent traffic case is received according to the sequences.