Processing multiple network address observations

Patent metadata

Field	Value
Publication number	US-10536428-B2
Application number	US-201414329449-A
Country	US
Kind code	B2
Filing date	Jul 11, 2014
Priority date	Jul 12, 2013
Publication date	Jan 14, 2020
Grant date	Jan 14, 2020

Abstract

In one embodiment, a processing technique is provided that utilizes multiple network address observations. One or more records are obtained that maintain network address observations, each network address observation associating one or more attributes with a network address observed by one or more source devices. Multiple network addresses from the network address observations are clustered into one or more discrete groups of network addresses based on a clustering criteria. For a selected group of network addresses, an association is formed associating one or more refined attributes derived from the selected group with an individual network address that is a member of the selected group.

First claim

What is claimed is:

1. A method for processing network address observations to produce associations in a database, comprising:
capturing network address observations of multiple different network addresses, each network address observation captured by a source device or a network node of a network and associating one or more attributes with a network address;
clustering, by a network address to attribute association system executed on one or more electronic devices, the network address observations into one or more discrete groups that represent states of the network addresses, wherein a state is a distinct mode of operation or allocation of a network address and at least a subset of the multiple different network addresses have multiple states, the clustering based on at least one of a common location, time, user or device being associated with the network address observations;
for a selected group of network address observations that represents a state of the network addresses,
deriving, by the network address to attribute association system, one or more refined attributes based on network address observations of the selected group, the one or more refined attributes including an estimated location for the group, and
associating, by the network address to attribute association system, the one or more refined attributes derived from network address observations of the selected group with an individual network address;

producing, by the network address to attribute association system, an association between the one or more refined attributes and the individual network address in a profile maintained in the database, the database stored on a storage device of the one or more electronic devices; and
providing an output to a service provider that includes the one or more refined attributes in response to the individual network address.

2. The method of claim 1 , wherein the network address is an Internet Protocol (IP) address associated with the source device.

3. The method of claim 1 , wherein the clustering determines one or more times at which the subset of the multiple different network addresses that have multiple states transition between ones of the multiple states.

4. The method of claim 1 , wherein the clustering is based on a common location being associated with the multiple different network address observations.

5. The method of claim 1 , wherein the clustering is based on a common time being associated with the multiple different network address observations.

6. The method of claim 1 , wherein the clustering is based on a common user or device being associated with the multiple different network address observations.

7. The method of claim 1 , further comprising:
receiving one or more new network addresses; and
adding the one or more new network addresses to a group of network addresses that includes the individual network address.

8. The method of claim 7 , wherein the refined attributes include a classification criteria, and the method further comprises:
classifying the one or more new network addresses as belonging to a classification based on the classification criteria.

9. The method of claim 8 , wherein the one or more new network addresses is an individual new network address and the classification criteria includes a measure of likelihood that the individual new network address belongs to the classification.

10. The method of claim 8 , wherein one or more new network addresses is a group of new network addresses, and the classification criteria includes a measure of likelihood that the group of new network addresses belong to the classification.

11. The method of claim 8 , wherein one or more new network addresses is an individual new network address, and the classification criteria includes a measure of likelihood that a group of new network addresses that the individual new network address is a member of belongs to the classification.

12. The method of claim 8 , wherein the classification represents a segment.

13. A method for processing network address observations to produce associations in a database, comprising;
capturing network address observations, the network address observations captured by a source device or a network node of a network and associating one or more attributes with a network address;
determining, by a network address to attribute association system executed on one or more electronic devices, states of the network address, each state representing a distinct mode of operation or allocation of the network address, wherein the network address has multiple distinct modes of operation or allocations;
separately associating, by the network address to attribute association system, at least one refined attribute derived from the network address observations with each state of the network address, the at least one refined attribute including an estimated location; and
producing, by the network address to attribute association system, an association between the at least one refined attribute and the respective state of the network address in a profile maintained in the database, the database stored on a storage device of the one or more electronic devices; and
providing an output to a service provider that includes the one or more refined attributes in response to the network address.

14. The method of claim 13 , wherein the network address is an Internet Protocol (IP) address associated with the source device.

15. The method of claim 13 , wherein the determining states further comprises:
determining one or more times at which the one or more network addresses transition between states of the multiple states.

16. A non-transitory electronic-device readable medium having executable instructions stored thereon, the executable instructions when executed by one or more processors of one or more electronic devices operable to:
capture network address observations of multiple different network addresses, each network address observation captured by a source device or a network node of a network and associating one or more attributes with a network address;
cluster the network address observations into one or more discrete groups that represent states of network addresses, wherein a state is a distinct mode of operation or allocation of a network address and at least a subset of the multiple different network addresses have multiple states;
for a selected group, associate one or more estimated locations derived from network address observations of the selected group with an individual network address;
produce, an association in a database between the one or more estimated locations and the individual network address; and
providing an output to a service provider that includes the one or more estimated locations in response to the individual network address.

17. The non-transitory electronic-device readable medium of claim 16 , wherein the network address is an internet protocol (IP) address associated with the source device.

Assignees

• Skyhook Wireless Inc

Inventors

• Alizadeh-Shabdiz Farshid
• Brachet Nicolas
• Dancus Andrei
• Jones Russel Kipp
• Morgan Edward James
• Polak George
• Steger Christopher
• Sutton Richard

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04W4/029

  Location-based management or tracking services · CPC title

• H04L67/30 Primary

  Profiles · CPC title

• H04L41/0846

  based on copy from other elements · CPC title