US 12,143,409 B2
Web page spectroscopy
Arthur L. Zaifman, Millburn, NJ (US); and John Mark Mocenigo, Califon, NJ (US)
Assigned to AT&T Intellectual Property I, L.P., Atlanta, GA (US)
Filed by AT&T Intellectual Property I, L.P., Atlanta, GA (US)
Filed on Jan. 25, 2023, as Appl. No. 18/159,118.
Application 18/159,118 is a continuation of application No. 17/061,037, filed on Oct. 1, 2020, granted, now 11,582,254.
Application 17/061,037 is a continuation of application No. 15/960,713, filed on Apr. 24, 2018, granted, now 10,834,112, issued on Nov. 10, 2020.
Prior Publication US 2023/0164160 A1, May 25, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 16/955 (2019.01); G06N 7/01 (2023.01); G06N 20/00 (2019.01); H04L 67/125 (2022.01); H04L 67/50 (2022.01)
CPC H04L 63/1425 (2013.01) [G06F 16/955 (2019.01); G06N 7/01 (2023.01); G06N 20/00 (2019.01); H04L 67/125 (2013.01); H04L 67/535 (2022.05)] 15 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, the operations comprising:
identifying a common parameter from first data that describes a first communication packet flow and second data that describes a second communication packet flow, wherein the common parameter indicates behaviors of uniform resource locators represented by the first data and the second data, wherein the uniform resource locators correlate to a plurality of different domain name systems, wherein the first communication packet flow and the second communication packet flow are associated with a user equipment, wherein tethering is not authorized at the user equipment, and wherein the identifying comprises using a model that is trained to detect the behaviors indicated by the common parameter to comprise a tethering behavior;
based on a behavior indicated by the common parameter to be the tethering behavior when the behavior indicates overlapping web pages based on the plurality of different domain name systems, determining that unauthorized tethering is occurring at the user equipment; and
based on the unauthorized tethering determined to be occurring at the user equipment, disabling a tethering option at the user equipment.