Mining user behavior data for IP address space intelligence

A method of tracking behavior in a system of identified users based on mined behavior data for an Internet Protocol address space, the method comprising:

• mining behavioral data from a system of identified users by monitoring user behavior in the system and deriving information about user behavior in an Internet Protocol address space based on the monitored user behavior;
• identifying one or more activities;
• tracking the one or more activities to one or more Internet Protocol Address(es);
• determining if the one or more Internet Protocol Address(es) are static or dynamic;
• mapping the identified activity to the one or more Internet Protocol Addresses of a user, the identified activity comprising identified malicious activity;
• and
• performing a plurality of proactive measures against the malicious activity, each of the plurality of proactive measures being performed for a length of time, wherein which proactive measures are performed and the length of time for which a proactive measure of the plurality of proactive measures is performed are based on whether the Internet Protocol Address(es) are static or dynamic,
• wherein the mining, the identifying, the determining, the mapping and the performing are performed in a computer system.

A system for tracking malicious behavior in a system of identified users based on mined behavior data for an Internet Protocol address space, the system comprising:

• a computer system having a processor coupled to a memory, the memory having computer readable code, which when executed by the processor causes the computer system to implement an application for tracking user behavior in a system of identified users based on mined behavior data for the Internet Protocol address space,
• wherein, the application tracks user behavior in a system by mining behavioral data from users of a system of identified users by deriving information about user behavior in the Internet Protocol address space, linking a specific user of the system to activity occurring with the Internet Protocol address space based upon the information obtained, identifying malicious activity and tracking the malicious activity to a Internet Protocol Address of a user, and mapping the user to the identified malicious activity coming from the Internet Protocol Address of the user,
• wherein, deriving information about user behavior in the Internet Protocol address space comprises estimating a nature of the Internet Protocol address the user uses to access the system by determining whether the Internet Protocol address is static or dynamic,
• further wherein, the application performs a plurality of proactive measures against the malicious activity, each of the plurality of proactive measures being performed for a length of time, wherein which proactive measures are performed and the length of time for which a proactive measure of the plurality of proactive measures is performed are based on whether the Internet Protocol Address(es) are static or dynamic.