公开(公告)号：US11095736B2

公开(公告)日：2021-08-17

申请号：US17099963

申请日：2020-11-17

Applicant: Verint Systems LTD.

Inventor： Yitshak Yishay ,  Liran Orevi ,  Itsik Horovitz ,  Aviad Rotem

IPC: G06F15/173 ,  H04L29/08 ,  H04L12/58

Abstract: A monitoring system that receives messages that are exchanged with the application server. Relationships between users are posited in response to the times at which the messages are received. A relationship between two users may be posited in response to receiving, at approximately the same time, two messages from the application server that are destined, respectively, for the two users. The near-simultaneous receipt of the two messages indicates that the two messages were sent from the server at approximately the same time, which, in turn, indicates that the two messages may correlate with one another. Further indication of a correlation between the messages, which may increase the level of confidence with which the relationship between the two users is posited, may be found by examining the respective sizes of the messages, which indicate the message types.

公开(公告)号：US10999295B2

公开(公告)日：2021-05-04

申请号：US16823421

申请日：2020-03-19

Applicant: Verint Systems Ltd.

Inventor： Offri Gil ,  Omer Ziv ,  Yuval Altman ,  Yaron Gvili ,  Hodaya Shabtay ,  Omri David ,  Yitshak Yishay

IPC: H04L29/06 ,  H04L29/12 ,  H04L9/06 ,  G06F16/951 ,  H04L29/08

Abstract: A traffic-monitoring system that monitors encrypted traffic exchanged between IP addresses used by devices and a network, and further receives the user-action details that are passed over the network. By correlating between the times at which the encrypted traffic is exchanged and the times at which the user-action details are received, the system associates the user-action details with the IP addresses. In particular, for each action specified in the user-action details, the system identifies one or more IP addresses that may be the source of the action. Based on the IP addresses, the system may identify one or more users who may have performed the action. The system may correlate between the respective action-times of the encrypted actions and the respective approximate action-times of the indicated actions. The system may hypothesize that the indicated action may correspond to one of the encrypted actions having these action-times.

公开(公告)号：US10958613B2

公开(公告)日：2021-03-23

申请号：US16228929

申请日：2018-12-21

Applicant: Verint Systems LTD.

Inventor： Offri Gil ,  Pinchas Birenbaum ,  Yitshak Yishay

IPC: G06F15/16 ,  H04L12/58 ,  G06N20/00 ,  G06K9/62

Abstract: Systems and methods for passive monitoring of computer communication that does not require performing any decryption. A monitoring system receives the traffic exchanged with each relevant application server, and identifies, in the traffic, sequences of messages—or “n-grams”—that appear to belong to a communication session between a pair of users. Subsequently, based on the numbers and types of identified n-grams, the system identifies each pair of users that are likely to be related to one another via the application, in that these users used the application to communicate (actively and/or passively) with one another. The system may identify those sequences of messages that, by virtue of the sizes of the messages in the sequence, and/or other properties of the messages that are readily discernable, indicate a possible user-pair relationship.

公开(公告)号：US20200304414A9

公开(公告)日：2020-09-24

申请号：US15411369

申请日：2017-01-20

Applicant: Verint Systems Ltd.

Inventor： Yitshak Yishay

IPC: H04L12/813 ,  G06N5/04 ,  G06F17/30 ,  H04L12/851 ,  H04L12/26

Abstract: Methods and systems for keyword spotting, i.e., for identifying textual phrases of interest in input data. The input data may be communication packets exchanged in a communication network. A keyword spotting system holds a dictionary (or dictionaries) of textual phrases for searching input data. The input data and the patterns are assigned to multiple different pattern matching algorithms. For example, a share of the traffic is handled by one algorithm and smaller traffic shares may be handled by the others. The system monitors the algorithms performance as they process the data to search for a match. The ratio of traffic splitting among the algorithms is dynamically reassigned or adjusted to maximize the overall performance.

公开(公告)号：US10719540B2

公开(公告)日：2020-07-21

申请号：US15715038

申请日：2017-09-25

Applicant: Verint Systems Ltd.

Inventor： Yitshak Yishay

IPC: G06F17/30 ,  G06F16/33 ,  H04L29/06

Abstract: Systems and methods for spotting keywords in data packets are provided. In particular, input data is received to be searched for occurrences of a set of patterns, the input data being divided into multiple segments. Then the input data and the patterns are assigned to first and second pattern matching algorithms, the first pattern matching algorithm is configured to search only within each of the segments, and the second pattern matching algorithm is configured to search across boundaries between adjacent segments. Then the input data is searched using the first and second pattern matching algorithms.

公开(公告)号：US10715641B2

公开(公告)日：2020-07-14

申请号：US16262001

申请日：2019-01-30

Applicant: Verint Systems LTD.

Inventor： Yitshak Yishay

IPC: H04L29/06 ,  H04L29/12 ,  H04L12/26

Abstract: Methods and systems for monitoring activity on a local area networks (LAN). In particular, embodiments described herein provide systems and methods for associating packets with the devices from which they were communicated, despite the obfuscatory behavior of any network address translators (NAT). A processor first receives packets that were collectively communicated, by a plurality of devices, via a NAT-serviced LAN. The processor aggregates the packets into multiple packet aggregations on a per device basis. Fields that are contained in the respective packet headers of the packets are used. The packet aggregations may be grouped. The embodiments use unencrypted lower-level information (including, for example, IPIDs and domain names), such that aggregation and grouping may be successfully performed even if information in the application layer is encrypted.

公开(公告)号：US20200159758A1

公开(公告)日：2020-05-21

申请号：US16752955

申请日：2020-01-27

Applicant: Verint Systems Ltd.

Inventor： Yitshak Yishay

IPC: G06F16/35 ,  H04L29/06 ,  G06F16/36

Abstract: An apparatus and techniques for constructing and utilizing a “dynamic dictionary” that is not a compiled dictionary, and therefore does not need to be recompiled in order to be updated. The dynamic dictionary includes respective data structures that represent (i) a management automaton that includes a plurality of management nodes, and (ii) a runtime automaton that is derived from the management automaton and includes a plurality of runtime nodes. The runtime automaton may be used to search input data, such as communication traffic over a network, for keywords of interest, while the management automaton manages the addition of keywords to the dynamic dictionary. Typically, at least two (e.g., exactly two) such dynamic dictionaries are used in combination with a static dictionary.

公开(公告)号：US10084876B2

公开(公告)日：2018-09-25

申请号：US15457122

申请日：2017-03-13

Applicant: Verint Systems Ltd.

Inventor： Yitshak Yishay ,  Eithan Goldfarb

IPC: G06F15/173 ,  H04L29/08 ,  H04L12/26 ,  H04L29/06 ,  G06F12/0813

CPC classification number: H04L67/2842 ,  G06F12/0813 ,  G06F2212/154 ,  G06F2212/60 ,  G06F2212/62 ,  H04L43/062 ,  H04L63/1408 ,  H04L63/1416 ,  H04L67/02 ,  H04L67/22

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In an embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

公开(公告)号：US20170251074A1

公开(公告)日：2017-08-31

申请号：US15457122

申请日：2017-03-13

Applicant: Verint Systems Ltd.

Inventor： Yitshak Yishay ,  Eithan Goldfarb

IPC: H04L29/08 ,  H04L12/26

CPC classification number: H04L67/2842 ,  G06F12/0813 ,  G06F2212/154 ,  G06F2212/60 ,  G06F2212/62 ,  H04L43/062 ,  H04L63/1408 ,  H04L63/1416 ,  H04L67/02 ,  H04L67/22

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In an embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

公开(公告)号：US09742637B2

公开(公告)日：2017-08-22

申请号：US15274377

申请日：2016-09-23

Applicant: Verint Systems Ltd.

Inventor： Eithan Goldfarb ,  Yitshak Yishay

IPC: H04L12/26 ,  H04L12/741 ,  H04L12/747 ,  H04L29/06

CPC classification number: H04L43/028 ,  H04L45/742 ,  H04L45/745 ,  H04L63/0263

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.