# US 10,873,560 B2 · Mapping anonymous entities to accounts for de-anonymization of online activities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,560 B2 - Document ID: US10873560B2 - Status: Granted - Kind: B2 - Application number: 16/736,545 - Filed: 2020-01-07 - Published: 2020-05-07 - Granted: 2020-12-22 - Earliest claimed: 2017-12-22 - Assignees: 6Sense Insights, Inc. - Applicants: 6Sense Insights, Inc. - Inventors: Viral Bajaria; Premal Shah; Nitin Vijayvargiya; Dustin Chang - Web page: https://patentgrep.com/patent/US10873560B2 ## CPC - H04L 61/4552: Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06Q 30/0201: Market modelling; Market analysis; Collecting market data - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 2209/544: Remote - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 2101/69: using geographic information, e.g. room number - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Mapping anonymous Internet entities to known accounts. In an embodiment, events, representing online activity and comprising IP addresses, are received from a plurality of sources. Subsets of the events are aggregated into mappings that associate the IP address, shared by the subset, with an account. Each mapping is associated with statistics regarding the events. A confidence value is calculated for each mapping based on the statistics, and a final subset of the mappings is selected based on the confidence values. Subsequently, when a request with an IP address is received, the final subset of mappings is searched for the requested IP address, and an indication of the account associated with the requested IP address is returned in response to the request. ## Claims ### Claim 1 A method for de-anonymizing anonymous Internet Protocol (IP) addresses, the method comprising using at least one hardware processor of a server platform to: receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and comprises an IP address and event information; aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address, shared by a subset of the plurality of events, with an account, and is associated with a plurality of statistics regarding the subset of events; for each of the plurality of mappings, compute a confidence value for the mapping based on the associated plurality of statistics; select a final subset of the plurality of mappings based on the confidence values for the plurality of mappings; and respond to one or more requests, comprising a requested IP address, by searching the final subset of mappings for the requested IP address, and returning an indication of an account associated with the requested IP address in the final subset of mappings. ### Claim 2 (depends on 1) The method of claim 1, further comprising using the at least one hardware processor to normalize the event information across the plurality of events. ### Claim 3 (depends on 1) The method of claim 1, wherein the event information for each of the plurality of events comprises a domain name. ### Claim 4 (depends on 1) The method of claim 1, wherein, for each of the plurality of events, the event information comprises a geographical region associated with the IP address of the event. ### Claim 5 (depends on 1) The method of claim 1, wherein each account comprises a company name. ### Claim 6 (depends on 1) The method of claim 1, wherein selecting a final subset of the plurality of mappings based on the confidence values for the plurality of mappings comprises, for at least one set of two or more mappings which each associate a same IP address with different accounts: determining one of the two or more mappings with a maximum confidence value among the two or more mappings; computing a sum of the confidence values for the two or more mappings; computing a ratio of the maximum confidence value to the sum of the confidence values; and, when the ratio does not exceed a threshold, excluding the two or more mappings from the final subset of mappings. ### Claim 7 (depends on 6) The method of claim 6, wherein the threshold comprises a constant value multiplied by the difference between one and the maximum confidence value. ### Claim 8 (depends on 1) The method of claim 1, wherein computing a confidence value for each mapping based on the associated plurality of statistics comprises: calculating a time confidence value, indicating a timing of events from which the mapping was derived; calculating a statistical confidence value, indicating a frequency of the events from which the mapping was derived; calculating a source confidence value, indicating an accuracy of one or more of the plurality of sources from which the events, from which the mapping was derived, were received; and calculating the confidence value based on the time confidence value, the statistical confidence value, and the source confidence value. ### Claim 9 (depends on 1) The method of claim 1, further comprising using the at least one hardware processor to, after a new set of events is received from one or more sources: aggregate subsets of the new set of events into a new set of mappings; extract a portion of the final subset of mappings that include IP addresses in the new set of events; merge the new set of mappings with the extracted portion of the final subset of mappings by, for each mapping in the merged set of mappings, recomputing the plurality of statistics and the confidence value for the mapping; and update the final subset of mappings with the merged set of mappings. ### Claim 10 (depends on 9) The method of claim 9, wherein each of the plurality of events is stored in a persistent event pool, and wherein the new set of events is not stored in the persistent event pool until after the final subset of mappings has been updated. ### Claim 11 (depends on 1) The method of claim 1, further comprising using the at least one hardware processor to: generate a graphical user interface comprising one or more inputs for receiving a user request comprising a requested IP address; in response to receiving the user request, adding an inquiry, representing the request, to a queue of inquiries; subsequently, when the inquiry reaches the front of the queue, querying the final subset of the plurality of mappings based on the inquiry; and, after receiving a result of the query, generating a graphical user interface comprising a visual representation of the result of the query. ### Claim 12 A system for de-anonymizing anonymous Internet Protocol (IP) addresses, the system comprising: at least one hardware processor; and one or more software modules configured to, when executed by the at least one hardware processor, receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and comprises an IP address and event information, aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address, shared by a subset of the plurality of events, with an account, and is associated with a plurality of statistics regarding the subset of events, for each of the plurality of mappings, compute a confidence value for the mapping based on the associated plurality of statistics, select a final subset of the plurality of mappings based on the confidence values for the plurality of mappings, and respond to one or more requests, comprising a requested IP address, by searching the final subset of mappings for the requested IP address, and returning an indication of an account associated with the requested IP address in the final subset of mappings. ### Claim 13 (depends on 12) The system of claim 12, wherein each account comprises a company name. ### Claim 14 (depends on 12) The system of claim 12, wherein selecting a final subset of the plurality of mappings based on the confidence values for the plurality of mappings comprises, for at least one set of two or more mappings which each associate a same IP address with different accounts: determining one of the two or more mappings with a maximum confidence value among the two or more mappings; computing a sum of the confidence values for the two or more mappings; computing a ratio of the maximum confidence value to the sum of the confidence values; and, when the ratio does not exceed a threshold, excluding the two or more mappings from the final subset of mappings. ### Claim 15 (depends on 14) The system of claim 14, wherein the threshold comprises a constant value multiplied by the difference between one and the maximum confidence value. ### Claim 16 (depends on 12) The system of claim 12, wherein computing a confidence value for each mapping based on the associated plurality of statistics comprises: calculating a time confidence value, indicating a timing of events from which the mapping was derived; calculating a statistical confidence value, indicating a frequency of the events from which the mapping was derived; calculating a source confidence value, indicating an accuracy of one or more of the plurality of sources from which the events, from which the mapping was derived, were received; and calculating the confidence value based on the time confidence value, the statistical confidence value, and the source confidence value. ### Claim 17 (depends on 12) The system of claim 12, wherein the one or more software modules are further configured to, after a new set of events is received from one or more sources: aggregate subsets of the new set of events into a new set of mappings; extract a portion of the final subset of mappings that include IP addresses in the new set of events; merge the new set of mappings with the extracted portion of the final subset of mappings by, for each mapping in the merged set of mappings, recomputing the plurality of statistics and the confidence value for the mapping; and update the final subset of mappings with the merged set of mappings. ### Claim 18 (depends on 17) The system of claim 17, wherein each of the plurality of events is stored in a persistent event pool, and wherein the new set of events is not stored in the persistent event pool until after the final subset of mappings has been updated. ### Claim 19 (depends on 12) The system of claim 12, wherein the one or more software modules are further configured to: generate a graphical user interface comprising one or more inputs for receiving a user request comprising a requested IP address; in response to receiving the user request, adding an inquiry, representing the request, to a queue of inquiries; subsequently, when the inquiry reaches the front of the queue, querying the final subset of the plurality of mappings based on the inquiry; and, after receiving a result of the query, generating a graphical user interface comprising a visual representation of the result of the query. ### Claim 20 A non-transitory computer-readable medium having instructions stored therein, wherein the instructions, when executed by a processor, cause the processor to: receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and comprises an IP address and event information; aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address, shared by a subset of the plurality of events, with an account, and is associated with a plurality of statistics regarding the subset of events; for each of the plurality of mappings, compute a confidence value for the mapping based on the associated plurality of statistics; select a final subset of the plurality of mappings based on the confidence values for the plurality of mappings; and respond to one or more requests, comprising a requested IP address, by searching the final subset of mappings for the requested IP address, and returning an indication of an account associated with the requested IP address in the final subset of mappings.