# US 8,782,783 B2 · Method and system for tracking machines on a network using fuzzy guid technology

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,783 B2
- Document ID: US8782783B2
- Status: Granted
- Kind: B2
- Application number: 13/372,480
- Filed: 2012-02-13
- Published: 2013-02-28
- Granted: 2014-07-15
- Earliest claimed: 2006-08-16
- Assignees: ThreatMETRIX PTY LTD
- Applicants: Scott Thomas; David G. Jones
- Inventors: Scott Thomas; David G. Jones
- Web page: https://patentgrep.com/patent/US8782783B2

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G06F 16/951: Indexing; Web crawling techniques
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 2201/86: Event-based monitoring
- G06F 2221/2127: Bluffing
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 2463/146: Tracing the source of attacks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for querying a knowledgebase of malicious hosts numbered from 1 through N. The method includes providing a network of computers, which has a plurality of unknown malicious host machines. In a specific embodiment, the malicious host machines are disposed throughout the network of computers, which includes a world wide network of computers, e.g., Internet. The method includes querying a knowledge base including a plurality of known malicious hosts, which are numbered from 1 through N, where N is an integer greater than 1. In a preferred embodiment, the knowledge base is coupled to the network of computers. The method includes receiving first information associated with an unknown host from the network; identifying an unknown host and querying the knowledge base to determine if the unknown host is one of the known malicious hosts in the knowledge base. The method also includes outputting second information associated with the unknown host based upon the querying process.

## Claims

### Claim 1

In a computer-based system which includes a processor, a method for tracking machines on a network of computers, the method comprising:
identifying a malicious host coupled to the network of computers;
determining, using the processor, a first IP (Internet Protocol) address and attributes associated with the malicious host during a first time period;
determining, using the processor, an attribute fuzzy GUID (Globally Unique Identifier) for the first IP address and each of the attributes, the attribute fuzzy GUID being a globally unique identifier associated with the first IP address and each of the attributes;
forming, using the processor, a host fuzzy GUID of the malicious host based on the first IP address and the attributes by processing the attribute fuzzy GUID associated with the first IP address and each of the attributes, wherein the host fuzzy GUID is a globally unique identifier for each host and includes behavior information;
classifying the malicious host to be in a determined state;
during a second time period, classifying the malicious host to be in a latent state;
identifying, using the processor, an unknown host during the second time period, the unknown host being associated with a second IP address and one or more attributes;
processing, using the processor, the second IP address and the one or more attributes of the unknown host in conjunction with the first IP address and the one or more attributes of the malicious host; and
determining, using the processor, if the malicious host has moved from the first IP address to the second IP address, thereby identifying if the unknown host is the malicious host.

### Claim 2 (depends on 1)

The method of claim 1 wherein the one or more attributes comprises an IP range, ISP, country, ISP practice, or range class within the ISP.

### Claim 3 (depends on 1)

The method of claim 1 further comprising determining if the unknown host is a different machine than the malicious host.

### Claim 4

In a computer-based system which includes a processor, a method for querying a knowledgebase of malicious hosts, the method comprising:
providing a network of computers, the network of computers including a plurality of unknown malicious host machines, the plurality of unknown malicious host machines being disposed throughout the network of computers;
querying, using the processor, a knowledge base including a plurality of known malicious hosts, the knowledge base being coupled to the network of computers;
receiving, using the processor, first information and attributes associated with an unknown host from the network;
determining, using the processor, an attribute fuzzy GUID (Globally Unique Identifier) for the first information and each of the attributes, the attribute fuzzy GUID being a globally unique identifier associated with the first information and each of the attributes;
forming, using the processor, a host fuzzy GUID (Globally Unique Identifier) of the unknown host by processing each of the attribute fuzzy GUID associated with the received first information and attributes, wherein the host fuzzy GUID is a globally unique identifier for each host and includes behavior information;
querying, using the processor, the knowledge base to determine if the unknown host is one of the known malicious hosts in the knowledge base; and
outputting, using the processor, second information associated with the unknown host based upon the querying process.

### Claim 5 (depends on 4)

The method of claim 4 further comprising, if the unknown host is one of the known malicious hosts, updating a filter to block access of the malicious host to one or more segments of the network of computers.

### Claim 6 (depends on 4)

The method of claim 4 further comprising outputting an alert to signify the malicious host, if the unknown host is determined to be one of the malicious hosts.

### Claim 7 (depends on 4)

The method of claim 4 wherein the identifying of the unknown host further comprising:
determining a plurality of identity attributes;
assigning a quality measure to each of the plurality the identity attributes;
collecting one or more evidences from the unknown host;
determining an attribute fuzzy GUID for each of the plurality of identity attributes for the unknown host, the attribute fuzzy GUID being associated with the evidences;
processing the attribute fuzzy GUID for each of the plurality of attributes to determine a host fuzzy GUID for the unknown host.

### Claim 8 (depends on 7)

The method of claim 7 wherein the attributes comprise an IP (Internet Protocol) range, ISP (Internet Service Provider), country, ISP practice, or range class within the ISP.

### Claim 9 (depends on 7)

The method of claim 7 further comprising selecting a second plurality of identity attributes characterized by quality measures higher than a predetermined value.

### Claim 10

A computer based method for populating a database to form a knowledge base of malicious host entities, the method comprising:
collecting one or more evidences from an unknown host;
determining a plurality of identity attributes from the one or more evidences, the plurality of identity attributes being associated with the unknown host;
assigning a quality measure to each of the plurality the identity attributes;
determining an attribute fuzzy GUID (Globally Unique Identifier) for each of the plurality of identity attributes for the unknown host, the attribute fuzzy GUID being a globally unique identifier associated with the plurality of identity attributes;
processing the attribute fuzzy GUID for each of the plurality of identity attributes according to the quality measure to determine a host fuzzy GUID for the unknown host, wherein the host fuzzy GUID is a globally unique identifier for each host and includes behavior information; and
storing the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base.

### Claim 11 (depends on 10)

The method of claim 10 wherein the plurality of attributes comprises an IP range, ISP, country, ISP practice, or range class within the ISP.

### Claim 12 (depends on 10)

The method of claim 10 further comprising selecting a second plurality of identity attributes characterized by quality measures higher than a predetermined value.

### Claim 13

A computer based system for populating a database to form a knowledge base of malicious host entities, the system comprising a machine readable memory or memories, the memory or memories comprising:
one or more codes directed to collecting one or more evidences from an unknown host;
one or more codes directed to determining a plurality of identity attributes from the one or more evidences, the plurality of identity attributes being associated with the unknown host;
one or more codes directed to assigning a quality measure to each of the plurality the identity attributes;
one or more codes directed to determining an attribute fuzzy GUID (Globally Unique Identifier) for each of the plurality of identity attributes for the unknown host, the attribute fuzzy GUID being associated with the plurality of identity attributes;
one or more codes directed to processing the attribute fuzzy GUID for each of the plurality of identity attributes, in order from a highest quality measure to a lowest quality measure, to determine a host fuzzy GUID for the unknown host, wherein the host fuzzy GUID is a globally unique identifier for each host and includes behavior information; and
one or more codes directed to storing the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base.

### Claim 14 (depends on 13)

The system of claim 13 wherein the unknown host is one of a plurality of computing devices in a world wide network of computers.

### Claim 15 (depends on 13)

The system of claim 13 wherein the one or more codes directed to storing is an executable code.

### Claim 16 (depends on 13)

The system of claim 13 wherein the knowledge base comprises a plurality of malicious host information.

### Claim 17 (depends on 13)

The system of claim 13 wherein the host fuzzy GUID comprises an identifier.

### Claim 18 (depends on 1)

The system of claim 1 wherein each of the plurality of identity attribute is characterized by an attribute quality that is a function of time and accuracy.

### Claim 19 (depends on 10)

The system of claim 10 wherein each of the plurality of identity attribute is characterized by an attribute quality that is a function of time and accuracy.

### Claim 20 (depends on 13)

The system of claim 13 wherein each of the plurality of identity attribute is characterized by an attribute quality that is a function of one or more of time, generic, accuracy, and subversion.