Patent ID: 8654127
Filing Date: 2014-02-18
Classification: G06T,H04L

Abstract:
1. A method for recognizing and analyzing relations between taps of a communication device in a packet connected communication network and the communication network, comprising the steps of: gathering traffic information in the communication network with a tap of a communication device connected to the communication network, the tap examining header information of connections of the communication network; storing the information gathered by the tap in a data storage, the tap connected to the data storage, the tap and the data storage together defining a network probe, the network probe being one of i) a physical device and ii) a computer unit; observing connections of the communication network with the network probe, each connection travels in the communication network and has header information describing the connection, the header information including an identity of the connection and relations to other identities, wherein the observing the connections comprises the tap i) passively analyzing IP packets and association logs received to the tap, the association logs being a description of an observed connection of the communication network, the description being searchable for identities, from the IP packets and association logs, locating the header information of the observed connections, ii) using the located header information to determine the identities of the observed connections and the relations between the observed connections, and iii) saving at least a part of the located header information, the identities, and the relations to the data storage; with the network probe, modelling the determined identities and relations as identity flows, the identity flows describing i) the identities, ii) the relations of the identities to the other identities, and iii) identity changes, the identity flows being relative to time and place of the connections; and using at least some of the identity flows for creating an identity graph for analyzing functioning of the communication network, the identity graph being a graphical presentation of the relations of the identities, with the identities of different places and devices of the communication network being marked in the identity graph, and the relations of the identities to the other identities being marked in the identity graph, the identity graphs describing the communication network depending on from where and when the communication network is observed, wherein the identities and the relations of the identities to the other identities to be included in an identity graph are chosen according to predetermined modifiers, the modifiers defining objects in the communication network which are the object of interest for the analyzing of the communication network.