IP Library › Granted Patent US 10,878,051
Granted Patent B1
US 10,878,051 · App. 15/941,729 · Granted Dec 29, 2020

Mapping device identifiers

Inventors: Joseph Holliday (San Francisco, CA); Felix Wong (South San Francisco, CA); Howard Wulsin (Redondo Beach, CA)
Assignee: Palantir Technologies Inc.
G06F16/955G06F16/2228H04L63/0876H04L67/22H04W8/005
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,878,051
App. No.
15/941,729
Granted
Dec 29, 2020
Kind
B1
Abstract

Systems, methods, and non-transitory computer readable media are provided for mapping device identifiers. Service event information of a first set of devices and a second set of devices may be obtained. The service event information may identify sets of device identifiers, sets of timestamps associated with the sets of devices, and sets of addresses associated with the sets of devices. A timestamp and an address of a device of the first set of devices may be identified and a time window may be determined based on the timestamp. Device identifiers of the second set of devices may be identified based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

Claims (41)

1. A system comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the system to perform:

obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices;

obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices;

identifying a timestamp and an address of a device of the first set of devices based on the first service event information;

determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service;

and identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

2. The system of claim 1 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

3. The system of claim 2 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

4. The system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the system to perform mapping a device of the second set of devices to the device of the first set of devices.

5. The system of claim 4 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is used to associate an analysis of the device of the first set of devices with the device of the second set of devices.

6. The system of claim 4 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed based on a frequency of the identification of the one or more device identifiers of the second set of devices.

7. The system of claim 6 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed further based on a confidence level.

8. The system of claim 1 , wherein the identifying a device identifier further comprises:

identifying a second timestamp and a second address of the device of the first set of devices based on the first service event information, the second timestamp indicating a time at which the device logged into the first service, utilized a function of the first service, or logged off from the first service;

determining a second time window based on the second timestamp;

determining, from the second set of devices, a second device identifier in which corresponding one or more addresses have a highest combined number of matches with the address within the time window or with the second address within the second time window, compared to other device identifiers from the second set of devices; and

mapping, to the device, a second device corresponding to the determined second device identifier.

9. The system of claim 1 , wherein the instructions, when executed, further cause the one or more processors to perform blocking activities of a device corresponding to the identified one or more device identifiers of the second set of devices.

10. A method implemented by a computing system including one or more processors and storage media storing machine-readable instructions, wherein the method is performed using the one or more processors, the method comprising:

obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices;

obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices;

identifying a timestamp and an address of a device of the first set of devices based on the first service event information;

determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service; and

identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

11. The method of claim 10 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

12. The method of claim 11 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

13. The method of claim 10 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices to associate an analysis of the device of the first set of devices with the device of the second set of devices.

14. The method of claim 10 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices based on a frequency of the identification of the one or more device identifiers of the second set of devices.

15. The method of claim 14 , wherein the mapping of the device of the second set of devices to the device of the first set of devices is performed further based on a confidence level.

16. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform:

obtaining first service event information, the first service event information identifying a first set of device identifiers of a first set of devices using a first service, a first set of timestamps associated with the first set of devices, and a first set of addresses associated with the first set of devices;

obtaining second service event information, the second service event information identifying a second set of device identifiers of a second set of devices using a second service, a second set of timestamps associated with the second set of devices, and a second set of addresses associated with the second set of devices;

identifying a timestamp and an address of a device of the first set of devices based on the first service event information;

determining a time window based on the timestamp, a type of the first service or a type of the second service, and an expected duration of use of the type of the first service or the type of the second service; and

identifying one or more device identifiers of the second set of devices based on a comparison of the address with addresses of the second set of addresses that are associated with timestamps within the time window.

17. The non-transitory computer readable medium of claim 16 , wherein the first set of device identifiers are of a different type than the second set of device identifier.

18. The non-transitory computer readable medium of claim 17 , wherein the first set of device identifiers are determined based on a first fingerprinting service and the second set of device identifier are determined based on a second fingerprinting service different from the first fingerprinting service.

19. The non-transitory computer readable medium of claim 16 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device of the first set of devices to associate an analysis of the device of the first set of devices with the device of the second set of devices.

20. The non-transitory computer readable medium of claim 16 , wherein the instructions, when executed, further cause the one or more processors to perform mapping a device of the second set of devices to the device based on a frequency of the identification of the one or more device identifiers of the second set of devices.

Assignments (2)
SECURITY INTEREST Recorded Jul 3, 2022
From: PALANTIR TECHNOLOGIES INC.
To: WELLS FARGO BANK, N.A.
Reel/Frame 060572/0506 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 22, 2018
From: HOLLIDAY, JOSEPH; WONG, FELIX; WULSIN, HOWARD
To: PALANTIR TECHNOLOGIES INC.
Reel/Frame 045872/0505 →