Associating a user identifier detected from web traffic with a client address

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed operable to:
• receive a set of known user identifiers used in the network;
• receive web traffic log data regarding web traffic in the network, wherein the web traffic log data comprises HTTP header information captured from the web traffic and a plurality of client addresses associated with the web traffic;
• detect a particular user identifier of the set of known user identifiers in multiple field values of the HTTP header information, wherein the HTTP header information is associated with a particular client address of the plurality of client addresses;
• and
• make an association between the particular user identifier and the particular client address based on a frequency count of the particular user identifier in web traffic that is associated with the particular client address, wherein the frequency count is calculated by counting how often the particular user identifier is present in the multiple field values of the HTTP header information.

A tangible, non-transitory, computer-readable medium that stores program instructions that cause a device in a network to execute a process comprising:

• receiving, at the device, a set of known user identifiers used in the network;
• receiving, at the device, web traffic log data regarding web traffic in the network, wherein the web traffic log data comprises HTTP header information captured from the web traffic and a plurality of client addresses associated with the web traffic;
• detecting, by the device, a particular user identifier of the set of known user identifiers in multiple field values of the HTTP header information, wherein the HTTP header information is associated with a particular client address of the plurality of client addresses;
• and
• making, by the device, an association between the particular user identifier and the particular client address based on a frequency count of the particular user identifier in web traffic that is associated with the particular client address, wherein the frequency count is calculated by counting how often the particular user identifier is present in the multiple field values of the HTTP header information.