Quantifying privacy leakage in mobile networks

1. A method for profiling user activity in a mobile network, comprising:

identifying, from the mobile network, a plurality of application sessions;

extracting, by a computer processor, a plurality of user identifiers from the plurality of application sessions based on a pre-determined criterion;

analyzing, by the computer processor, the plurality of application sessions to determine a plurality of session blocks, wherein each session block comprises a plurality of application sessions sharing an IP address and is defined based on a minimum separation time with any other session block sharing the IP address;

extracting, by the computer processor, a traffic marker from the plurality of session blocks based on a user identifier of the plurality of user identifiers, wherein extracting the traffic marker comprises:

determining a measure of co-occurrence in the plurality of session blocks between the user identifier and a data string; and

identifying the data string as the traffic marker in response to the measure meeting a pre-determined threshold;

identifying a first portion of the plurality of the session blocks based on the user identifier, wherein the first portion of the plurality of the session blocks is associated with first mobile network activities of a user identified by the user identifier;

identifying a second portion of the plurality of the session blocks based on the traffic marker, wherein the second portion of the plurality of the session blocks is associated with second mobile network activities of the user; and

analyzing, by the computer processor, the first portion and the second portion of the plurality of the session blocks to determine a measure of a mobile network activity of the user.

2. The method of claim 1 ,

wherein the user identifier comprises at least one selected from a group consisting of an online social network (OSN) user identifier and an email address, and

wherein the pre-determined criterion comprises at least one selected from a group consisting of an OSN-specific parsing algorithm and a layer-7-application-specific parsing algorithm applied to the plurality of application sessions.

3. The method of claim 1 , wherein the measure comprises a uniqueness measure and a persistence measure.

4. The method of claim 1 , further comprising:

extracting a plurality of domain name service (DNS) server names from the first portion and the second portion of the plurality of the session blocks; and

analyzing the plurality of DNS server names to determine the measure of the mobile network activity of the user.

5. The method of claim 4 , further comprising:

extracting a user profile from the mobile network based on the user identifier; and

generating a measure of privacy leak in the mobile network based at least on the user profile and the measure of the mobile network activity of the user.

6. The method of claim 1 , further comprising:

determining that a session block contains at least one selected from a group consisting of two or more user identifier and two or more time-to-live values; and

eliminating the session block from the first portion and the second portion of the plurality of the session blocks.

7. A system for profiling user activity in a mobile network, comprising:

a processor and memory;

a session block generator comprising instructions stored in the memory, when executed on the processor having functionality to:

identify, from the mobile network, a plurality of application sessions; and

analyze the plurality of application sessions to determine a plurality of session blocks, wherein each session block comprises a plurality of application sessions sharing an IP address and is defined based on a minimum separation time with any other session block sharing the IP address;

a user session block identifier comprising instructions stored in the memory, when executed on the processor having functionality to:

extract a plurality of user identifiers from the plurality of application sessions based on a pre-determined criterion;

extract a traffic marker from the plurality of session blocks based on a user identifier of the plurality of user identifiers, wherein extracting the traffic marker comprises:

determining a measure of co-occurrence in the plurality of session blocks between the user identifier and a data string; and

identifying the data string as the traffic marker in response to the measure meeting a pre-determined threshold;

identify a first portion of the plurality of the session blocks based on the user identifier, wherein the first portion of the plurality of the session blocks is associated with first mobile network activities of a user identified by the user identifier; and

identify a second portion of the plurality of the session blocks based on the traffic marker, wherein the second portion of the plurality of the session blocks is associated with second mobile network activities of the user; and

a user activity analyzer comprising instructions stored in the memory, when executed on the processor having functionality to:

analyze the first portion and the second portion of the plurality of the session blocks to determine a measure of a mobile network activity of the user.

8. The system of claim 7 ,

wherein the user identifier comprises at least one selected from a group consisting of an online social network (OSN) user identifier and an email address, and

wherein the pre-determined criterion comprises at least one selected from a group consisting of an OSN-specific parsing algorithm and a layer-7-application-specific parsing algorithm applied to the plurality of application sessions.

9. The system of claim 7 , wherein the measure comprises a uniqueness measure and a persistence measure.

10. The system of claim 7 , the user activity analyzer further comprising instructions stored in the memory, when executed on the processor having functionality to:

extract a plurality of domain name service (DNS) server names from the first portion and the second portion of the plurality of the session blocks; and

analyze the plurality of DNS server names to determine the measure of the mobile network activity of the user.

11. The system of claim 10 , the user activity analyzer further comprising instructions stored in the memory, when executed on the processor having functionality to:

extract a user profile from the mobile network based on the user identifier; and

generate a measure of privacy leak in the mobile network based at least on the user profile and the measure of the mobile network activity of the user.

12. The system of claim 7 , the user session block identifier further comprising instructions stored in the memory, when executed on the processor having functionality to:

determine that a session block contains at least one selected from a group consisting of two or more user identifier and two or more time-to-live values; and

eliminate the session block from the first portion and the second portion of the plurality of the session blocks.

13. A non-transitory computer readable medium embodying instructions for profiling user activity in a mobile network, the instructions when executed by a processor comprising functionality for:

identifying, from the mobile network, a plurality of application sessions;

extracting a plurality of user identifiers from the plurality of application sessions based on a pre-determined criterion;

analyzing the plurality of application sessions to determine a plurality of session blocks, wherein each session block comprises a plurality of application sessions sharing an IP address and is defined based on a minimum separation time with any other session block sharing the IP address;

extracting a traffic marker from the plurality of session blocks based on a user identifier of the plurality of user identifiers, wherein extracting the traffic marker comprises:

determining a measure of co-occurrence in the plurality of session blocks between the user identifier and a data string; and

identifying the data string as the traffic marker in response to the measure meeting a pre-determined threshold;

identifying a first portion of the plurality of the session blocks based on the user identifier, wherein the first portion of the plurality of the session blocks is associated with first mobile network activities of a user identified by the user identifier;

identifying a second portion of the plurality of the session blocks based on the traffic marker, wherein the second portion of the plurality of the session blocks is associated with second mobile network activities of the user; and

analyzing the first portion and the second portion of the plurality of the session blocks to determine a measure of a mobile network activity of the user.

14. The non-transitory computer readable medium of claim 13 ,

wherein the user identifier comprises at least one selected from a group consisting of an online social network (OSN) user identifier and an email address, and

wherein the pre-determined criterion comprises at least one selected from a group consisting of an OSN-specific parsing algorithm and a layer-7-application-specific parsing algorithm applied to the plurality of application sessions.

15. The non-transitory computer readable medium of claim 13 , wherein the measure comprises a uniqueness measure and a persistence measure.

16. The non-transitory computer readable medium of claim 13 , the instructions when executed by a processor further comprising functionality for:

extracting a plurality of domain name service (DNS) server names from the first portion and the second portion of the plurality of the session blocks; and

analyzing the plurality of DNS server names to determine the measure of the mobile network activity of the user.

17. The non-transitory computer readable medium of claim 16 , the instructions when executed by a processor further comprising functionality for:

extracting a user profile from the mobile network based on the user identifier; and

generating a measure of privacy leak in the mobile network based at least on the user profile and the measure of the mobile network activity of the user.

18. The non-transitory computer readable medium of claim 13 , the instructions when executed by a processor further comprising functionality for:

determining that a session block contains at least one selected from a group consisting of two or more user identifier and two or more time-to-live values; and

eliminating the session block from the first portion and the second portion of the plurality of the session blocks.