Abstract: Methods and systems for managing the actions that are applied to packet flows by packet processing systems. A packet processing system maintains a flow table, i.e., a list of active flows and respective actions to be applied to the flows. The system classifies each incoming packet into a respective flow, and processes the packet in accordance with the action that is specified for this flow in the flow table. Typically, the system deletes a packet flow from the flow table when it becomes inactive, e.g., when no packets belonging to the flow arrive within a certain time-out period.

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.

Abstract: Methods and systems for profiling the locations of users of wireless communication terminals. A profiling engine may accept data points regarding a given target. Each data point may indicate a location of the target at a certain measurement time. The profiling engine may accumulate the data points relative to a periodic time scale having a pre-specified time period. The accumulation process produces a location profile of the target. The location profile may convey information regarding the tracked targets. For example, the profiling engine may use the location profile to improve the location accuracy of a target terminal that is idle for long period of time, to detect deviations from the characteristic location pattern of a target, to detect that a certain sensitive location is being visited regularly by a given target, and/or to identify connections among different targets by detecting similarities or correlations between their location profiles.

Abstract: Systems and methods for identifying and characterizing relationships based on communication traffic. The methods may include accepting indications of communication conducted among entities over a communication network, and using a link processor, analyzing the indications so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate. A criterion may be evaluated with respect to the indications associated with a given entity, responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications.

Abstract: Methods and systems for monitoring mobile communication terminals. A correlation system selects candidate communication terminals to be monitored, and then attempts to identify whether the candidate terminals are indeed operated by target users. Following successful correlation of a candidate terminal with a target user, various surveillance actions can be performed with respect to the terminal. Correlation of candidate communication terminals with target users is based on identification of speech key-phrases. When evaluating a given candidate terminal, the system analyzes speech that is communicated via the candidate terminal and attempts to detect one or more of the speech key-phrases in the analyzed speech.

Abstract: Methods and systems for determining mobile communication terminals (mobiles) that have a common user, or that have a group of users in common. The methods and systems examine change-of-association events of mobiles operating in a network, and correlate the events to determine common mobiles, i.e., mobiles that have the same or similar change-of-association events. The events described are generated by the mobiles themselves automatically, by virtue of the fact that the mobiles are operating in the network. There is thus no need for, and the embodiments described herein do not require, user intervention to generate the events.

Abstract: Methods and systems for finding search phrases in a body of data that is encoded using any of multiple possible character encoding schemes. An analytics system accepts an input search phrase for searching in a certain body of data. The system identifies two or more candidate character encoding schemes, which may have been used for encoding the body of data. Having determined the candidate encoding schemes, the system translates the input search phrase into multiple encoding-specific search phrases that represent the input search phrase in the respective candidate encoding schemes. The system then searches the body of data for occurrences of the input search phrase using the multiple encoding-specific search phrases.

Abstract: Methods and systems for monitoring mobile communication terminals. A correlation system selects candidate communication terminals to be monitored, and then attempts to identify whether the candidate terminals are indeed operated by target users. Following successful correlation of a candidate terminal with a target user, various surveillance actions can be performed with respect to the terminal. Correlation of candidate communication terminals with target users is based on identification of speech key-phrases. When evaluating a given candidate terminal, the system analyzes speech that is communicated via the candidate terminal and attempts to detect one or more of the speech key-phrases in the analyzed speech.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: Methods and systems for managing the actions that are applied to packet flows by packet processing systems. A packet processing system maintains a flow table, i.e., a list of active flows and respective actions to be applied to the flows. The system classifies each incoming packet into a respective flow, and processes the packet in accordance with the action that is specified for this flow in the flow table. Typically, the system deletes a packet flow from the flow table when it becomes inactive, e.g., when no packets belonging to the flow arrive within a certain time-out period.

Abstract: A Candidate Isolation System (CIS) detects subscribers of phone call services as candidates to be surveillance targets. A Voice Matching System (VMS) then decides whether or not a given candidate Communication Terminals (CTs) should be tracked by determining, using speaker recognition techniques, whether the subscriber operating the candidate CT is a known target subscriber. The CIS receives from the network call event data that relate to CTs in the network.

Abstract: Methods and systems for determining mobile communication terminals (mobiles) that have a common user, or that have a group of users in common. The methods and systems examine change-of-association events of mobiles operating in a network, and correlate the events to determine common mobiles, i.e., mobiles that have the same or similar change-of-association events. The events described are generated by the mobiles themselves automatically, by virtue of the fact that the mobiles are operating in the network. There is thus no need for, and the embodiments described herein do not require, user intervention to generate the events.

Abstract: Systems and methods for identifying and characterizing relationships based on communication traffic. The methods may include accepting indications of communication conducted among entities over a communication network, and using a link processor, analyzing the indications so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate. A criterion may be evaluated with respect to the indications associated with a given entity, responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications.

Abstract: Systems and methods for location tracking in a communication network. Base stations transmit downlink signals to a plurality of subscriber terminals to define a mapping between geographical locations and respective sets of signal strengths of the downlink signals received from the base stations at the geographical locations. A subset of the subscriber terminals may be selected, and for each subscriber terminal in the subset, first measurements of a geographical location of the subscriber terminal irrespective of the downlink signals is made. Second measurements of the downlink signals received at the subscriber terminal at the geographical location is made and the mapping of the subscribers terminals is updated responsively to the first and second measurements. The geographical locations of the subscriber terminals is updated using the updated mapping.

Abstract: A substantially real-time graph-based rule engine that analyzes connectivities, both direct and indirect relationships, between entities stored in a database as the database is updated (e.g., with CDR or financial transaction data). The rule engine uses pre-defined rules to detect events (i.e., the database updates) that influence the relationship between entities in the database. When the database is updated with events (e.g., CDRs), the real-time rule engine compares the update to any relevant rules. If the real-time based rule engine finds a match between a rule and an update to the database, then the rule engine generates a notification, such as an alert. The alerts may be used to provide notification of, e.g, fraudulent activities.

Abstract: Systems and methods for accepting relationship indications based on interaction among entities, where each relationship indication specifies that a respective pair of the entities may be related. A single entity record may be constructed that indicates all the linked entities that have been identified as being related to the entity. The entities may include an individual, a set of individuals, a communication terminal, a plurality of communication terminals, an organization, an e-mail address, a Web-site, a bank account and a home address. An analytics operation may performed, such as identifying a shortest sequence of interrelated entities that relate a first entity with a second entity, and acting upon the identified sequence.

Abstract: Methods and systems related to keyword searching processes. A list of keywords may be first represented by a set of short substrings. The substrings are selected such that an occurrence of a substring indicates a possible occurrence of one or more of the keywords. Input data may be initially pre-processed, so as to identify locations in the input data in which the substrings occur. Then, the identified locations are searched for occurrences of the actual keywords. The pre-processing scheme enables the keyword search process to search only in the identified locations of the substrings instead of over the entire input data.

Abstract: A method for location tracking that includes identifying a subset of users of a mobile communication network who are located in a predefined area of interest using a first location subsystem of the mobile communication network. One or more of the identified users are assigned to a second location subsystem of the mobile communication network, which is different from and has a higher resolution than the first location subsystem, to measure their respective locations. In variations, the locations may be passed to an operator, the subset of the users may be identified by passively monitoring location information generated in the mobile communication network, the second location subsystem may be provided with information regarding the users, and profiles of the users may be determined.

Abstract: Methods and systems for profiling the locations of users of wireless communication terminals. A profiling engine may accept data points regarding a given target. Each data point may indicate a location of the target at a certain measurement time. The profiling engine may accumulate the data points relative to a periodic time scale having a pre-specified time period. The accumulation process produces a location profile of the target. The location profile may convey information regarding the tracked targets. For example, the profiling engine may use the location profile to improve the location accuracy of a target terminal that is idle for long period of time, to detect deviations from the characteristic location pattern of a target, to detect that a certain sensitive location is being visited regularly by a given target, and/or to identify connections among different targets by detecting similarities or correlations between their location profiles.