Patent ID: 9055113
Filing Date: 2015-06-09
Classification: H04L

Abstract:
1. A method for correlating network traffic, the method comprising: determining one or more content providers accessed by a subscriber; maintaining a sequence of reference points for the subscriber, the sequence of reference points being ordered lists of the one or more content providers accessed by the subscriber; monitoring network traffic for characteristics of an internet content application to be monitored comprises examining one or more of TCP/UDP ports of the network traffic, patterns found in network traffic, stateful messages in the network traffic, or network traffic based on rate, payload lengths, and message sequence; and upon finding the characteristics of the monitored internet content application in the network traffic, searching the sequence of reference points for the one or more content providers accessed by the subscriber, determine whether an entry exists for the sequence of reference points for the content provider that the subscriber is accessing; and when an entry exists then updating the entry in the sequence of reference points with a new timestamp, and when the reference points do not exists, then a new sequence of reference points will be created, and reordering the sequence of reference points so that the most recent reference point is maintained at a head of a list; correlating the internet content application with the one or more content providers accessed by the subscriber to determine a content provider for the internet content application; and storing to a database the monitored internet content application and content providers originating the monitored internet content applications based on the reference points.