Patent ID: 8180892

Claim:
A method for identifying and tracking multiple computer user sessions associated with a network address translation (NAT) device coupled to a computer network, the method comprising: receiving one or more data packets originating from the NAT device, the one or more data packets containing a request to a destination server coupled to the computer network, wherein the data packets are transmission control protocol/Internet Protocol (TCP/IP) packets; determining a client source address associated with the one or more data packets, the client source address associated with the NAT device; determining one or more session entries associated with the client source address, wherein the session entries are stored in system state information; determining a session signature based one or more characteristics defined by data packet header information and/or request header information in the one or more data packets, the session signature uniquely identifying one of the multiple computer user sessions coupled to the NAT device, wherein determining the session signature further comprises: performing link-chain detection by comparing HTTP referrer field against browsing history associated with HTTP header in session and assigning a score to detected links; performing refresh detection if the HTTP referrer field is absent, a requested URL is compared against the browsing history to detect a page refresh and assigning a score to detected refreshes; determining an activity score wherein the activity score is determined based upon a frequency with which events are associated with a given session; determining an IPID trendline score based upon an IPID parameter; assigning a user agent score based upon a determined web-browser identified in the request; and calculating a weighted score comprising the link chain detection, the refresh detection, the activity score, the IPID score and the user agent score; wherein the weighted score is compared to one or more weighted scores each associated with a session entry in a session table to determine the session with a best matching score; and storing a new session entry in the system state information if the session signature is not associated with the one of the one or more sessions entries in the system state information.