Web page spectroscopy
Facilitating web page spectroscopy in a communications network is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise receiving first data that describes a first communication packet flow and second data that describes a second communication packet flow. The operations can also comprise training a model based on the first data and the second data, as a result of which the model is trained to detect respective behaviors represented by the first data and the second. Further, the operations can comprise extracting a common parameter from third data that describes a third communication packet flow and fourth data that describes a fourth communication packet flow based on the model.
1 . A method comprising:
based on first data that describes a first communication packet flow of a user equipment and second data that describes a second communication packet flow of the user equipment, identifying, by a device comprising a processor deployed in a communication network that is distinct from the user equipment, a parameter that is indicative of a behavior of uniform resource locators represented by the first data and the second data, wherein the uniform resource locators correlate to a plurality of different domain name systems, and wherein the behavior indicates a tethering at the user equipment when the behavior indicates overlapping web pages based on the plurality of different domain name systems; and
based on a determination that the tethering is not authorized at the user equipment, disabling, by the device, a tethering capability at the user equipment.
2 . The method of claim 1 , wherein the identifying comprises using a model trained to detect a group of behaviors comprising the behavior that indicates the tethering at the user equipment.
3 . The method of claim 2 , further comprising:
prior to the using the model, training, by the device, the model to detect respective fingerprints of first metadata associated with the first communication packet flow and second metadata associated with the second communication packet flow, wherein the training is based on stored fingerprints of previously analyzed metadata associated with previously received communication packet flows.
4 . The method of claim 1 , further comprising:
prior to the identifying, extracting, by the device, the parameter from the first data and the second data.
5 . The method of claim 1 , wherein the identifying comprises:
identifying the first data based on first fingerprint data of first metadata associated with the first communication packet flow; and
identifying the second data based on second fingerprint data of second metadata associated with the second communication packet flow.
6 . The method of claim 5 , wherein the first fingerprint data and the second fingerprint data comprise respective domain name system signatures of the plurality of different domain name systems that indicate properties determined to be stable properties.
7 . The method of claim 1 , wherein the behavior indicated by the parameter is associated with web page displays, and wherein the method further comprises:
determining, by the device, that overlapping web page displays of the overlapping web pages are associated with the user equipment based on an analysis of respective spectroscopic signatures associated with the web page displays.
8 . The method of claim 7 , wherein the overlapping web page displays comprise a first web page and a second web page, and wherein the respective spectroscopic signatures indicate interactions associated with the overlapping web page displays.
9 . A system comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor when deployed in a communication network, facilitate performance of operations, the operations comprising:
based on first data that describes a first communication packet flow of a user equipment and second data that describes a second communication packet flow of the user equipment, identifying a parameter that is indicative of a behavior of uniform resource locators represented by the first data and the second data, wherein the uniform resource locators correlate to a plurality of different domain name systems, and wherein the behavior indicates a tethering at the user equipment associated with the first communication packet flow and the second communication packet flow when the behavior indicates overlapping web pages based on the plurality of different domain name systems, wherein the system is distinct from the user equipment; and
based on a determination that the tethering is not authorized at the user equipment, disabling a tethering capability at the user equipment.
10 . The system of claim 9 , wherein the identifying comprises using a model trained to detect a group of behaviors comprising the behavior that indicates the tethering at the user equipment.
11 . The system of claim 10 , the operations further comprising:
prior to the using the model, training the model to detect respective fingerprints of first metadata associated with the first communication packet flow and second metadata associated with the second communication packet flow, wherein the training is based on stored fingerprints of previously analyzed metadata associated with previously received communication packet flows.
12 . The system of claim 9 , the operations further comprising:
prior to the identifying, extracting the parameter from the first data and the second data.
13 . The system of claim 9 , wherein the identifying comprises:
identifying the first data based on first fingerprint data of first metadata associated with the first communication packet flow; and
identifying the second data based on second fingerprint data of second metadata associated with the second communication packet flow.
14 . The system of claim 13 , wherein the first fingerprint data and the second fingerprint data comprise respective domain name system signatures of the plurality of different domain name systems that indicate properties determined to be stable properties.
15 . A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor when deployed in a communication network, facilitate performance of operations, the operations comprising:
extracting a common parameter from data that describes communication packet flows of a user equipment, wherein the common parameter is associated with uniform resource locators of web page displays and is an indication of concurrent usage via the user equipment, and wherein the uniform resource locators correlate to a plurality of different domain name systems, wherein the processor is distinct from the user equipment;
determining that a tethering is occurring at the user equipment based on a behavior that indicates overlapping web pages based on the plurality of different domain name systems, indicated by the common parameter, wherein the common parameter comprises an indication of overlapping web page displays of the overlapping web pages; and
deactivating the tethering at the user equipment based on the determining and based on the tethering being determined not to be authorized for the user equipment.
16 . The non-transitory machine-readable medium of claim 15 , wherein the overlapping web pages comprise a first web page and a second web page, and wherein respective spectroscopic signatures associated with the web pages indicate interactions associated with the overlapping web pages.
17 . The non-transitory machine-readable medium of claim 15 , wherein the extracting comprises:
identifying respective metadata associated with communication packet flows of the communication packet flows.
18 . The non-transitory machine-readable medium of claim 15 , wherein the extracting comprises:
identifying respective fingerprint data of communication packet flows of the communication packet flows.
19 . The non-transitory machine-readable medium of claim 18 , wherein the respective fingerprint data comprise respective domain name system signatures representative of properties determined to be stable properties.
20 . The non-transitory machine-readable medium of claim 15 , wherein the communication packet flows are packet flows transmitted via a fifth generation network communication protocol.