System and method for tracking users of computer applications
A monitoring system that receives messages that are exchanged with the application server. Relationships between users are posited in response to the times at which the messages are received. A relationship between two users may be posited in response to receiving, at approximately the same time, two messages from the application server that are destined, respectively, for the two users. The near-simultaneous receipt of the two messages indicates that the two messages were sent from the server at approximately the same time, which, in turn, indicates that the two messages may correlate with one another. Further indication of a correlation between the messages, which may increase the level of confidence with which the relationship between the two users is posited, may be found by examining the respective sizes of the messages, which indicate the message types.
1. A system, comprising:
a network interface; and
a processor, configured:
to establish, with a server that services a computer application, one or more user profiles for the computer application;
to register, with the server a given user of the computer application as a contact, with respect to the computer application, of one of the established one or more user profiles;
to receive via the network interface, first messages exchanged between multiple users and the server, collected by a network tap;
to receive via the network interface, second messages exchanged between the established user profiles and the server;
to identify in the first messages collected by the network tap, for each of the second messages, one or more first messages transmitted within a given interval from the second message, registering IP addresses of the users of the identified one or more messages along with a level of confidence that the identified message is related to a same event as the second message;
to select from the registered IP addresses, an IP address with a sufficient confidence of being associated with the given user; and
to act on an assumption that the given user is using the selected IP address;
wherein the one or more user profiles include a first user profile and a second user profile, wherein the processor is configured to register, with the server, (i) one of the first user profile and the second user profile as a contact, with respect to the computer application, of the other one of the first user profile and the second user profile, and the given user as a contact, with respect to the computer application, of the first user profile, wherein the processor is configured to cause a status-update message which indicates a status of the first user profile to be sent to the server by the first user profile, and wherein the processor is configured to identify in the first messages a message acknowledging the status-update message.
2. The system of claim 1 , wherein the processor is configured to act on the assumption that the given user is using the selected IP address by generating an output indicating that the given user is using the selected IP address.
3. The system of claim 1 , wherein the processor is configured to act on the assumption that the given user is using the selected IP address by processing subsequent communication exchanged with the selected IP address.
4. The system of claim 1 , wherein the processor is configured to act on the assumption that the given user is using the selected IP address by identifying a physical location associated with the selected IP address.
5. The system of claim 1 , wherein the processor is configured to assign the level of confidence based on a size of the first message.
6. The system of claim 1 , wherein the one or more user profiles consist of a single user profile.
7. The system of claim 1 , wherein the second messages comprise messages acknowledging receipt of status updates from the established one or more user profiles, by the server, and wherein the processor is configured to identify for the acknowledgement messages corresponding first messages having a sufficient confidence of being a corresponding status- update message transmitted from the server to the given user.
8. The system of claim 1 , wherein the second messages comprise status-update messages indicating a status of the given user with respect to the computer application transmitted from the server to the one or more user profiles and the processor is configured to identify for the status-update messages, corresponding first messages having a sufficient confidence of being a corresponding status update transmitted to the given user.
9. The system of claim 1 , wherein the processor is configured to cause a status-update message which indicates a status of the one or more user profiles to be sent to the server by the one or more user profiles.
10. The system of claim 1 , wherein the second messages include messages transmitted from the server to the processor.
11. A method, comprising:
establishing, with a processor and a server, that services a computer application, one or more user profiles for the computer application;
registering, with the server, a given user of the computer application as a contact, with respect to the computer application, of one of the established one or more user profiles;
receiving, subsequently, a first messages exchanged between multiple users and the server, collected by a network tap,
receiving second messages exchanged between the established user profiles and the server,
identifying in the first messages collected by the network tap, for each of the second messages, one or more first messages transmitted within a given interval from the second message, registering IP addresses of the users of the identified one or more messages along with a level of confidence, that the identified message is related to a same event as the second message;
selecting from the registered IP addresses, an IP address with a sufficient confidence of being associated with the given user; and
acting on an assumption that the given user is using the selected IP address; wherein the one or more user profiles include a first user profile and a second user profile, wherein the method comprises registering, with the server, (i) one of the first user profile and the second user profile as a contact, with respect to the computer application, of the other one of the first user profile and the second user profile, and (ii) the given user as a contact, with respect to the computer application, of the first user profile, wherein the method further comprises causing a status-update message which indicates a status of the first user profile to be sent to the server by the first user profile, and wherein identifying the one or more first messages comprises identifying in the first messages a message acknowledging the status-update message.
12. The method of claim 11 , wherein acting on the assumption that the given user is using the selected IP address comprises generating an output indicating that the given user is using the selected IP address.
13. The method of claim 11 , wherein acting on the assumption that the given user is using the selected IP address comprises processing subsequent communication exchanged with the selected IP address.
14. The method of claim 11 , wherein acting on the assumption that the given user is using the selected IP address comprises identifying a physical location associated with the selected IP address.
15. The method of claim 11 , wherein the level of confidence is assigned based on a size of the first message.
16. The method of claim 11 , wherein the one or more user profiles consist of a single user profile.
17. The method of claim 11 , wherein the second messages comprise messages acknowledging receipt of status updates from the established one or more user profiles, by the server, and wherein identifying the one or more first messages comprises identifying for the Acknowledgement messages, corresponding first messages having a sufficient confidence of being a corresponding status-update message transmitted from the server to the given user.
18. The method of claim 11 , wherein the second messages comprise status-update messages indicating a status of the given user with respect to the computer application transmitted from the server to the one or more user profiles and wherein identifying the one or more first messages comprises identifying for the status-update messages, corresponding first messages having a sufficient confidence of being a corresponding status update transmitted to the given user.