US 2019/0173735 A1 · NETWORK USER IDENTIFICATION USING TRAFFIC ANALYSIS

Abstract

The subject matter of this specification generally relates to computer networks. In some implementations, a method includes identifying a network address associated with a network event. Network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event is identified. A user that was assigned the network address at a time at which the network event occurred is identified using one or more network address assignment logs. A level of confidence that the user was using the network address at the time of the network event is determined based on the identified network activity and one or more patterns of network activity initiated by the user. An action is performed based on the level of confidence.

Claims20

Dependent claims

A computer-implemented method, comprising:

identifying a network address associated with a network event;
identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event;
identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred;
determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event;
and
performing an action based on the level of confidence.

3 more elements

A system, comprising:

a data processing apparatus;
and
a computer storage medium encoded with a computer program, the program comprising data processing apparatus instructions that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising:
identifying a network address associated with a network event;
identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event;
identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred;
determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event;
and
performing an action based on the level of confidence.

6 more elements

A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by one or more data processing apparatus cause the data processing apparatus to perform operations comprising:

identifying a network address associated with a network event;
identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event;
identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred;
determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event;
and
performing an action based on the level of confidence.

3 more elements

Dependencies are inferred from the claim text.

Network user identification using traffic analysis

Life of this patent

Network user identification using traffic analysis

Life of this patent

Abstract

Claims20