Dynamic identity attribution

A system, comprising:

• a processor configured to:
• receive, from a service application having a protocol, a communication for a data source, the communication indicating a user of the service application and being consistent with the protocol, the user corresponding to the communication;
• utilize a plurality of signatures dynamically updated from a control plane to is determine the service application based on the communication and a corresponding signature of the plurality of signatures;
• identify the user based on the communication, the service application, and the protocol;
• and
• a memory coupled to the processor and configured to provide the processor with instructions;
• wherein each of the plurality of signatures includes executable code for identifying features of the protocol of a corresponding service application and obtaining an identity of the user from a corresponding communication.

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

• receiving, from a service application having a protocol, a communication for a data source, the communication indicating a user of the service application and being consistent with the protocol, the user corresponding to the communication;
• utilizing a plurality of signatures dynamically updated from a control plane to determine the service application based on the communication and a corresponding signature of the plurality of signatures;
• and
• identifying the user based on the communication, the service application, and the protocol;
• wherein each of the plurality of signatures includes executable code for identifying features of the protocol of a corresponding service application and obtaining an identity of the user from a corresponding communication.