Abstract: A mobile unit comprising a processing resource configured to: (a) connect, via a network interface, to a first organizational network of the organizational networks, the first organizational network being an active organizational network; (b) obtain network traffic comprising a plurality of first packets originating from at least one of the active organizational network's IT systems and a plurality of second packets originating from at least one of the active organizational network's OT systems; (c) perform Deep Packet Inspection (DPI) of the second packets, for obtaining DPI information; (d) record, on a media, the first packets and the DPI information; (e) disconnect from the active organizational network; (f) connect, via the network interface, to a subsequent organizational network of the organizational networks, the subsequent organizational network being the active organizational network after connecting thereto; and (g) repeat steps (b) to (f).

Abstract: Systems and methods for identifying and characterizing relationships based on communication traffic. The methods may include accepting indications of communication conducted among entities over a communication network, and using a link processor, analyzing the indications so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate. A criterion may be evaluated with respect to the indications associated with a given entity, responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications.

Abstract: Methods and systems for determining mobile communication terminals (mobiles) that have a common user, or that have a group of users in common. The methods and systems examine change-of-association events of mobiles operating in a network, and correlate the events to determine common mobiles, i.e., mobiles that have the same or similar change-of-association events. The events described are generated by the mobiles themselves automatically, by virtue of the fact that the mobiles are operating in the network. There is thus no need for, and the embodiments described herein do not require, user intervention to generate the events.

Abstract: Methods for associating multiple communication terminals with a given user, based on the geographical locations of the terminals. A target user may be known to own or operate a certain communication terminal (e.g., cellular phone). To identify additional terminals associated with this user, historical location indications are obtained for the known terminal. Each location indication indicates the geographical location of the terminal at a given time. The location indications of the known terminal are correlated with location indications of other terminals. When significant spatial correlation is found between the known terminal and another terminal, the other terminal is assumed likely to be associated with the same target user.

Abstract: Methods and systems for determining mobile communication terminals (mobiles) that have a common user, or that have a group of users in common. The methods and systems examine change-of-association events of mobiles operating in a network, and correlate the events to determine common mobiles, i.e., mobiles that have the same or similar change-of-association events. The events described are generated by the mobiles themselves automatically, by virtue of the fact that the mobiles are operating in the network. There is thus no need for, and the embodiments described herein do not require, user intervention to generate the events.

Abstract: Systems and methods for identifying and characterizing relationships based on communication traffic. The methods may include accepting indications of communication conducted among entities over a communication network, and using a link processor, analyzing the indications so as to identify that two or more of the entities are interrelated by detecting one or more intermediate entities with which the two or more entities communicate. A criterion may be evaluated with respect to the indications associated with a given entity, responsively to meeting the criterion, disqualifying the given entity from serving as an intermediate entity in analyzing the indications.

Abstract: Methods for associating multiple communication terminals with a given user, based on the geographical locations of the terminals. A target user may be known to own or operate a certain communication terminal (e.g., cellular phone). To identify additional terminals associated with this user, historical location indications are obtained for the known terminal. Each location indication indicates the geographical location of the terminal at a given time. The location indications of the known terminal are correlated with location indications of other terminals. When significant spatial correlation is found between the known terminal and another terminal, the other terminal is assumed likely to be associated with the same target user.