Timestamp-based session association
Systems and methods for associating sessions using (TCP packet-level) timestamps are provided. A collection of data packets received during one or more sessions within a time period may be retrieved. Each packet in the collection may be associated with a unique identifier of a respective session. A skew for a selected session within the time period may be determined based on a rate difference between a respective receiving device clock and a respective sending device clock of at least two data packets associated with the unique identifier of the selected session. The selected session may be associated with a computing device. An uptime may be calculated for each of the retrieved data packets based on the determined skew and respective timestamp information of the data packet. It may be identified as to whether each of the calculated uptimes matches a previously calculated uptime for a packet associated with a previous session or a session that has previously been associated with a selected session. A list of sessions associated with the computing device may be updated based on one or more identified matches between the respective calculated uptime and the previously calculated uptime.
1. A method for associating sessions based on timestamp data, the method comprising:
retrieving a collection of data packets received during one or more sessions within a time period, each packet in the collection of data packets associated with a unique identifier of a respective session;
determining a skew for packets of a session selected from the sessions within the time period, the determined skew based on a rate difference between a respective receiving device clock and a respective sending device clock of at least two data packets associated with the unique identifier of the selected session, wherein the selected session is associated with a client device;
calculating an uptime for each of the retrieved data packets, wherein the calculated uptime is indicative of a last time that a respective timestamp of a respective one of the data packets was reset, the respective timestamp for each data packet including a timestamp from the client device and a timestamp from a server, the uptime calculated by multiplying the determined skew to the client device timestamp and subtracting the product from the server timestamp;
identifying whether each of the calculated uptimes matches a previously calculated uptime for a packet associated with a previously selected session; and
updating a list of sessions associated with the client device based on one or more identified matches between the respective calculated uptime and the previously calculated uptime.
2. The method of claim 1 , wherein the sessions are TCP sessions.
3. The method of claim 2 , further comprising:
identifying one of the retrieved packets as most recently received within the time period for the selected session; and
identifying the selected session based on the identified packet being associated with the unique identifier of the selected session.
4. The method of claim 1 , further comprising filtering the retrieved data packets based on the IP address.
5. The method of claim 1 , further comprising discarding at least one outlying data packet.
6. The method of claim 5 , wherein the outlying data packet is identified based on falling into a selected percentile in relation to other data packets associated with the collection based on respective timestamp data.
7. The method of claim 1 , further comprising discarding at least one data packet when the at least one data packet is not associated with timestamp data.
8. The method of claim 1 , wherein determining the skew comprises:
selecting the at least two data packets for skew determination, wherein the two data packets include a first data packet that was most recently received within the time period from the selected session and a second data packet that was received prior by a predetermined time interval for the selected session; and
calculating the skew based on the client device timestamp and the server timestamps of the first data packet and the client device timestamp and the server timestamps of the second data packet.
9. The method of claim 8 , wherein calculating the skew comprises:
determining a difference between the server timestamp of the first data packet and the server timestamp of the second data packet;
determining a difference between the client device timestamp of the first data packet and the client device timestamp of the second data packet; and
dividing the server timestamp difference by the client device difference.
10. The method of claim 1 , wherein the respective calculated uptime is deemed to match the previously calculated uptime when the respective calculated uptime is within a predetermined range of the previously calculated uptime.
11. The method of claim 1 , wherein a session on the client device is associated with an identifier.
12. The method of claim 11 , wherein sessions with the same identifier are treated as a single session.
13. The method of claim 11 , wherein the updated list of sessions is treated as a single session during comparison to subsequent sessions.
14. The method of claim 1 , wherein the respective timestamp was last reset when the client device was restarted.
15. The method of claim 1 , wherein the client device is associated with one or more unique device identifiers, and wherein the list of sessions further includes one of the device identifiers in association with each of the listed sessions.
16. The method of claim 1 , wherein the client device is associated with one or more unique browser identifiers of browsers used by the client device, and wherein the list of sessions further includes one of the browser identifiers in association with each of the listed sessions.
17. A server system for associating sessions based on timestamp data, the system comprising:
a processor that executes instructions stored in memory, wherein execution of the instructions by the processor:
retrieves a collection of data packets received during one or more sessions within a time period, each packet in the collection of data packets associated with a unique identifier of a respective session,
determines a skew for packets of a session selected from the sessions within the time period, the determined skew based on a rate difference between a respective receiving device clock and a respective sending device clock of at least two data packets associated with the unique identifier of the selected session, wherein the selected session is associated with a client device,
calculates an uptime for each of the retrieved data packets, wherein the calculated uptime is indicative of a last time that a respective timestamp of a respective one of the data packets was reset, the respective timestamp for each data packet including a timestamp from the client device and a timestamp from a server, the uptime calculated by multiplying the determined skew to the client device timestamp and subtracting the product from the server timestamp;
identifies whether each of the calculated uptimes matches a previously calculated uptime for a packet associated with a selected session previous matched session; and
memory that stores a list of sessions associated with the client device, wherein the stored list of session is updated based on one or more identified matches between the respective calculated uptime and the previously calculated uptime.
18. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for associating sessions based on timestamp data, the method comprising:
retrieving a collection of data packets received during one or more sessions within a time period, each packet in the collection of data packets associated with a unique identifier of a respective session;
determining a skew for packets of a session selected from the sessions within the time period, the determined skew based on a rate difference between a respective receiving device clock and a respective sending device clock of at least two data packets associated with the unique identifier of the selected session, wherein the selected session is associated with a client device;
calculating an uptime for each of the retrieved data packets, wherein the calculated uptime is indicative of a last time that a respective timestamp of a respective one of the data packets was reset, the respective timestamp for each data packet including a timestamp from the client device and a timestamp from a server, the uptime calculated by multiplying the determined skew to the client device timestamp and subtracting the product from the server timestamp;
identifying whether each of the calculated uptimes matches a previously calculated uptime for a packet associated with a previous session; and
updating a list of sessions associated with the client device based on one or more identified matches between the respective calculated uptime and the previously calculated uptime.