# US 2019/0173735 A1 · Network user identification using traffic analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173735 A1 - Document ID: US20190173735A1 - Status: Published application - Kind: A1 - Application number: 15/833,386 - Filed: 2017-12-06 - Published: 2019-06-06 - Earliest claimed: 2017-12-06 - Assignees: Chronicle LLC - Applicants: Chronicle LLC - Inventors: Michael Wiacek - Web page: https://patentgrep.com/patent/US20190173735A1 ## CPC - H04L 41/064: {involving time analysis} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/062: related to network traffic - H04L 43/16: Threshold monitoring - H04L 61/4505: using standardised directories; using standardised directory access protocols - H04L 61/5092: by self-assignment, e.g. picking addresses at random and testing if they are already in use - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/30: {for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281)} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The subject matter of this specification generally relates to computer networks. In some implementations, a method includes identifying a network address associated with a network event. Network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event is identified. A user that was assigned the network address at a time at which the network event occurred is identified using one or more network address assignment logs. A level of confidence that the user was using the network address at the time of the network event is determined based on the identified network activity and one or more patterns of network activity initiated by the user. An action is performed based on the level of confidence. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying a network address associated with a network event; identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event; identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred; determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event; and performing an action based on the level of confidence. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises identifying a last user assigned the network address prior to the network event occurring. ### Claim 3 (depends on 1) The method of claim 1, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises: identifying, using the one or more network address assignment logs, a device identifier for a device that was assigned the network address at the time the network event occurred; and identifying, as the user that was assigned the network address at the time at which the network event occurred, a user associated with the device. ### Claim 4 (depends on 1) The method of claim 1, wherein performing the action based on the level of confidence comprises: determining that the level of confidence does not meet a threshold level of confidence; and in response to determining that the level of confidence does not meet the threshold level of confidence: identifying one or more additional users; for each additional user, determining, based on the identified network activity and one or more patterns of network activity initiated by the additional user, a respective level of confidence that the additional user initiated the network event; and identifying, from the user and the one or more additional users, a particular user for which the respective level of confidence is highest. ### Claim 5 (depends on 4) The method of claim 4, wherein identifying one or more additional users comprises identifying one or more additional users that were previously assigned the network address prior to the time at which the network event occurred. ### Claim 6 (depends on 1) The method of claim 1, wherein performing the action based on the level of confidence comprises: determining that the level of confidence meets a threshold level of confidence; and generating and transmitting data that identifies the user. ### Claim 7 (depends on 1) The method of claim 1, wherein: the identified network activity includes a sequence of requested domain names; and determining, based on the identified network activity and the one or more patterns of network activity initiated by the user, the level of confidence that the user initiated the network event comprises: identifying, as the one or more patterns of network activity initiated by the user, one or more probabilistic patterns, each probabilistic pattern representing a sequence of host names and, for each transition from a first host name to a second host name in the sequence of host names, a probability that the user will request the second host name after the second host name; and determining the level of confidence using the probabilistic patterns and the identified network activity. ### Claim 8 A system, comprising: a data processing apparatus; and a computer storage medium encoded with a computer program, the program comprising data processing apparatus instructions that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising: identifying a network address associated with a network event; identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event; identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred; determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event; and performing an action based on the level of confidence. ### Claim 9 (depends on 8) The system of claim 8, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises identifying a last user assigned the network address prior to the network event occurring. ### Claim 10 (depends on 8) The system of claim 8, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises: identifying, using the one or more network address assignment logs, a device identifier for a device that was assigned the network address at the time the network event occurred; and identifying, as the user that was assigned the network address at the time at which the network event occurred, a user associated with the device. ### Claim 11 (depends on 8) The system of claim 8, wherein performing the action based on the level of confidence comprises: determining that the level of confidence does not meet a threshold level of confidence; and in response to determining that the level of confidence does not meet the threshold level of confidence: identifying one or more additional users; for each additional user, determining, based on the identified network activity and one or more patterns of network activity initiated by the additional user, a respective level of confidence that the additional user initiated the network event; and identifying, from the user and the one or more additional users, a particular user for which the respective level of confidence is highest. ### Claim 12 (depends on 11) The system of claim 11, wherein identifying one or more additional users comprises identifying one or more additional users that were previously assigned the network address prior to the time at which the network event occurred. ### Claim 13 (depends on 8) The system of claim 8, wherein performing the action based on the level of confidence comprises: determining that the level of confidence meets a threshold level of confidence; and generating and transmitting data that identifies the user. ### Claim 14 (depends on 8) The system of claim 8, wherein: the identified network activity includes a sequence of requested domain names; and determining, based on the identified network activity and the one or more patterns of network activity initiated by the user, the level of confidence that the user initiated the network event comprises: identifying, as the one or more patterns of network activity initiated by the user, one or more probabilistic patterns, each probabilistic pattern representing a sequence of host names and, for each transition from a first host name to a second host name in the sequence of host names, a probability that the user will request the second host name after the second host name; and determining the level of confidence using the probabilistic patterns and the identified network activity. ### Claim 15 A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by one or more data processing apparatus cause the data processing apparatus to perform operations comprising: identifying a network address associated with a network event; identifying network activity (i) that was initiated by a computing device assigned the network address and (ii) that occurred within a threshold period of time of the network event; identifying, using one or more network address assignment logs, a user that was assigned the network address at a time at which the network event occurred; determining, based on the identified network activity and one or more patterns of network activity initiated by the user, a level of confidence that the user was using the network address at the time of the network event; and performing an action based on the level of confidence. ### Claim 16 (depends on 15) The non-transitory computer storage medium of claim 15, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises identifying a last user assigned the network address prior to the network event occurring. ### Claim 17 (depends on 15) The non-transitory computer storage medium of claim 15, wherein identifying the user that was assigned the network address at the time at which the network event occurred comprises: identifying, using the one or more network address assignment logs, a device identifier for a device that was assigned the network address at the time the network event occurred; and identifying, as the user that was assigned the network address at the time at which the network event occurred, a user associated with the device. ### Claim 18 (depends on 15) The non-transitory computer storage medium of claim 15, wherein performing the action based on the level of confidence comprises: determining that the level of confidence does not meet a threshold level of confidence; and in response to determining that the level of confidence does not meet the threshold level of confidence: identifying one or more additional users; for each additional user, determining, based on the identified network activity and one or more patterns of network activity initiated by the additional user, a respective level of confidence that the additional user initiated the network event; and identifying, from the user and the one or more additional users, a particular user for which the respective level of confidence is highest. ### Claim 19 (depends on 18) The non-transitory computer storage medium of claim 18, wherein identifying one or more additional users comprises identifying one or more additional users that were previously assigned the network address prior to the time at which the network event occurred. ### Claim 20 (depends on 15) The non-transitory computer storage medium of claim 15, wherein performing the action based on the level of confidence comprises: determining that the level of confidence meets a threshold level of confidence; and generating and transmitting data that identifies the user.