Method and system for generating durable host identifiers using network artifacts
AssigneeVectra Networks, Inc.
InventorsNicolas Beauchesne, Monty Sher Gill, Oliver Kourosh Tavakoli
Life of this patent
Estimating the term…
Abstract
A host identification engine receives network traffic from a network and uses one or more artifact extractors to extract artifact data items that can identify a host. The artifact data items can be stored in a host signature database. Network addresses to which the hosts correspond can be stored in a network address database. A mapping table can be implemented to match the data in the signature database and network database to generate durable host identification data that can accurately track hosts as they use different identification data and/or move between hosts.
Claims30
A computer-implemented method for generating network host identification data, comprising:
- extracting one or more artifact data items from network traffic, the network traffic corresponding to communications between one or more hosts;
- generating durable host identification data, the durable host identification data corresponding to a collection of artifacts that identify a host across different network addresses;
- storing the durable host identification data in a signature database;
- and
- storing one or more network addresses and times the one or more network address were in use by the one or more hosts in a network address database, the one or more network addresses corresponding to the durable host identification data.
A system for generating network host identification data, comprising:
- a computer processor to execute a set of program code instructions;
- a memory to hold the program code instructions, in which the program code instructions comprises program code to perform:
- extract one or more artifact data items from network traffic, the network traffic corresponding to communications between one or more hosts;
- generating durable host identification data, the durable host identification data corresponding to a collection of artifacts that identify a host across different network addresses;
- store the durable host identification data in a signature database;
- and store one or more network addresses and times the one or more network address were in use by the one or more hosts in a network address database, the one or more network addresses corresponding to the durable host identification data.
A computer program product embodied on a non-transitory computer usable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for generating network host identification data, the method comprising:
- extracting one or more artifact data items from network traffic, the network traffic corresponding to communications between one or more hosts;
- generating durable host identification data, the durable host identification data corresponding to a collection of artifacts that identify a host across different network addresses;
- storing the durable host identification data in a signature database;
- and
- storing one or more network addresses and times the one or more network address were in use by the one or more hosts in a network address database, the one or more network addresses corresponding to the durable host identification data.
Dependencies are inferred from the claim text.