Method And System For Tracking Machines On A Network Using Fuzzy Guid Technology

A method for querying a knowledgebase of malicious hosts numbered from 1 through N, the method comprising;

• providing a network of computers, the network of computers including a plurality of unknown malicious host machines, the malicious host machines being disposed throughout the network of computers, the network of computers including a world wide network of computers;
• querying a knowledge base including a plurality of known malicious hosts, the plurality of known malicious hosts being numbered from 1 through N, where N is an integer greater than 1, the knowledge base being coupled to the network of computers;
• receiving first information associated with an unknown host from the network;
• identifying an unknown host;
• querying the knowledge base to determine if the unknown host is one of the known malicious hosts in the knowledge base;
• and
• outputting second information associated with the unknown host based upon the querying process

A computer based method for populating a database to form a knowledge base of malicious host entities, the method comprising:

• determining a plurality of identity attributes;
• assigning a quality measure to each of the plurality the identity attributes;
• collecting one or more evidences from the unknown host;
• determining an attribute fuzzy GUID for each of the plurality of identity attributes for the unknown host, the attribute fuzzy GUID being associated with the evidences;
• processing the attribute fuzzy GUID for each of the plurality of attributes to determine a host fuzzy GUID for the unknown host;
• and
• storing the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base.

A computer based system for populating a database to form a knowledge base of malicious host entities, the system comprising a machine readable memory or memories, the memory or memories comprising:

• one or more codes directed to determining a plurality of identity attributes;
• one or more codes directed to assigning a quality measure to each of the plurality the identity attributes;
• one or more codes directed to collecting one or more evidences from the unknown host;
• one or more codes directed to determining an attribute fuzzy GUID for each of the plurality of identity attributes for the unknown host, the attribute fuzzy GUID being associated with the evidences;
• one or more codes directed to processing the attribute fuzzy GUID for each of the plurality of attributes to determine a host fuzzy GUID for the unknown host;
• and
• one or more codes directed to storing the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base.