Methods, systems and apparatus for using session, device and/or user signatures

1. A method of operating a system comprising:

receiving a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message;

extracting a first set of features from said first set of session control messages; and

operating one or more neural networks to identify a group session signature to which said first set of session control messages corresponds based on said first set of features, said identified group session signature being one of a plurality of group session signatures, said first set of features including signaling attributes that are native to a device or user behavior.

2. The method of claim 1 , wherein the identified group session signature is used to retrieve information corresponding to communications sessions having a matching group session signature.

3. The method of claim 2 further comprising:

determining one or more of the following: a device identity, user identity or communications session type for the first communications session based on said retrieved information corresponding to communications sessions having the same group session signature as the identified group session signature of the first communications session.

4. The method of claim 3 further comprising:

operating a profiling system or a profiling component of a communications session processing device to perform one or more of the following: an identity verification or security check, a user and traffic profiling check, or a fraud detection and prevention operation based on one or more of said one or more determined device identity, user identity, or communications session type.

5. The method of claim 4 further comprising:

when the identity verification or security check fails, performing one or more of the following operations:

(i) providing a notification to a user or operator corresponding to the identity which failed the verification or security check,

(ii) taking an action to limit or prevent use of one or more network services corresponding to a user identity or device identity corresponding to the first communications session, or

(iii) adding the determined device identity, determined user identity, or the determined communications session type to a suspected entity list.

6. The method of claim 4 further comprising:

when the user and traffic profiling check fails performing one or more of the following operations:

(i) providing a notification to a user corresponding to the identity of the user which failed the user and traffic profiling check or a service provider for the user corresponding to the identity of the user which failed the user and traffic profiling check; or

(ii) taking an action to limit or prevent use of one or more network services corresponding to a user identity or device identity corresponding to the first communications session.

7. The method of claim 5 ,

wherein the identity verification or security check includes a determination that an unauthorized use of a device has been made in connection with the first communications session, said determination being based at least in part on a determined device signature and a user signature and a geolocation corresponding to the first communications session.

8. A method of operating a system comprising:

receiving a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message;

extracting a set of device features from said first set of session control messages, said set of device features including features corresponding to how a device is being used; and

operating a first neural network to determine a device signature for the first set of session control messages based on said set of device features.

9. The method of claim 8 further comprising:

comparing the determined device signature to a set of device signatures of a cluster of device signatures having the same device identifier as the originator of the first communications session to which the first set of session control messages belongs.

10. The method of claim 9 further comprising:

based on the results of said comparison of the device signature to the device signatures of the cluster, determining a score for the similarity of the device signature to the other device signatures in the set of device signatures of the cluster; and

when said score is above a first threshold determine that the determined device signature falls within the cluster of device signatures; and

when the score is not above the first threshold determine that the determined device signature does not fall within the cluster of device signatures.

11. The method of claim 10 , further comprising:

training the first neural network to compute a device signature using a plurality of sets of session control packets belonging to a plurality of communications sessions including the device identifier, said first neural network being an autoencoder neural network including an encoder layer, a latent layer and a decoding layer, said latent layer having the fewest neural network nodes of any layer in the neural network including neural network nodes; and

after the first neural network has been trained determining a device signature for each set of session control messages belonging to the plurality of communications sessions including the device identifier used to train the first neural network, each device signature for each set of session control messages being based on an output vector of the latent layer of the autoencoder neural network of the first neural network corresponding to an input feature vector extracted from the corresponding set of session control messages.

12. The method of claim 11 further comprising:

when the device signature is determined not to fall within the cluster of the device signatures sending a notification to a device of a user registered as having previously used the device identifier included in the first communications session or take an action to limit or revoke device permissions or registrations for the device identifier included in the first communications session.

13. A system comprising:

a first device, said first device including:

a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message;

a feature extractor that extracts a first set of features from said first set of session control messages; and

one or more neural networks that identify a group session signature to which said first set of session control messages corresponds based on said first set of features, said identified group session signature being one of a plurality of group session signatures, said first set of features including signaling attributes that are native to a device or user behavior.

14. The system of claim 13 , wherein the identified group session signature is used to retrieve information corresponding to a communications session having a matching group session signature.

15. The system of claim 14 , wherein said first device further includes a processor that controls the operation of the first device to determine one or more of the following: a device identity, user identity or communications session type for the communications session based on said retrieved information corresponding to communications sessions having the same group signature as the identified group session signature of the first communications session.

16. The system of claim 15 further comprising:

a profiling device that performs one or more of the following operations: an identity verification or security check, a user and traffic profiling check, ora fraud detection and prevention operation based on one or more of said one or more determined device identity, user identity, or communications session type.

17. The system of claim 16 further comprising:

when the identity verification or security check fails said profiling device performs one or more of the following operations:

(i) providing a notification to a user corresponding to the identity which failed the verification or security check or a service provider for the user corresponding to the identity which failed the verification or security check, or

(ii) taking an action to limit or prevent use of one or more network services corresponding to a user identity or device identity corresponding to the first communications session.

18. The system of claim 16 further comprising:

when the user and traffic profiling check fails the profiling device performs one or more of the following operations:

(i) providing a notification to a user or a service provider for the user corresponding to the identity of the user which failed the user and traffic profiling check, or

(ii) taking an action to limit or prevent use of one or more network services corresponding to a user identity or device identity corresponding to the first communications session.

19. A system comprising:

a first device, said first device including:

a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message;

a feature extractor that extracts a first set of device features from said first set of session control messages; and

a first neural network that determines a device signature from the first set of session control messages based on said set of device features.

20. The system of claim 19 wherein said first device further includes a processor that controls the operation of the first device to perform the following operation:

compare the determined device signature to a set of device signatures of a cluster of device signatures having the same device identifier as the originator of the first communications session to which the first set of session control messages belongs.