Methods for mapping IP addresses and domains to organizations using user activity data

• US 10,554,619 B2
• Filed: 08/16/2019
• Issued: 02/04/2020
• Est. Priority Date: 06/22/2017
• Status: Active Grant

• Current Assignee: BitSight Technologies, Inc.
• Original Assignee: BitSight Technologies, Inc.
• Inventors: Dahlberg, Daniel, Boyer, Stephen, Venna, Nagarjuna, Gladstone, Philip John Steuart
• Primary Examiner(s): Chacko, Joe
• Application Number:
  US16/543,075
• Publication Number:
  US 20190379632A1
• Time in Patent Office: 172 Days
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/4505 using standardised directories; using standardised directory access protocols
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 67/306 User profiles

Abstract

A computer-implemented method is provided for mapping IP addresses and domain names to organizations. The method includes receiving, by a mapping system from an data provider, a dataset related to a plurality of users of the data provider. The dataset includes (a) an IP address for a user device of each user of the plurality of users, and (b) a domain name for a user account of each user of the plurality of users; enriching, by an analytics engine of the mapping system, the received dataset with enrichment data from an enrichment source; receiving, by the analytics engine from a storage medium, historical data relevant to the enriched dataset; and mapping, by the analytics engine, (i) the IP address and/or (ii) the domain name of each user of a portion of the plurality of users to an organization based on the enriched dataset and the historical data.

Claims

1. A computer-implemented method for mapping Internet Protocol (IP) addresses and domain names to organizations, the method comprising:

receiving, by a mapping system from a data provider, a dataset related to a plurality of users of the data provider, the dataset having at least one of;

(a) an IP address for a user device of each user of the plurality of users, or

(b) a domain name for a user account of each user of the plurality of users;

enriching, by an analytics engine of the mapping system, the received dataset with enrichment data from an enrichment source;

receiving, by the analytics engine from a storage medium, historical data relevant to the enriched dataset;

mapping, by the analytics engine, at least one of (i) the IP address or (ii) the domain name of each user of a portion of the plurality of users to an organization based on the enriched dataset and the historical data;

receiving another dataset related to at least a portion of the plurality of users;

assessing whether the mapped IP address and/or the mapped domain name should be terminated based on the other dataset; and

terminating the mapping of the IP address and/or the domain name based on the assessment.

2. The method of claim 1, wherein the data provider is an email service provider and the plurality of users is a plurality of email users that send or receive email through the email service provider.

3. The method of claim 2, wherein enriching, by the analytics engine of the mapping system, the received dataset with enrichment data from the enrichment source further comprises at least one of:

determining whether a domain of the email service provider is a free or paid email service provider domain and adding information related to the determined domain to the received dataset;

or

determining whether a network of an IP address of the email user is of a cellular network or a guest network and adding information related to the determined network to the received dataset.

4. The method of claim 1, wherein the data provider is a messaging service provider and the plurality of users is a plurality of messaging users that send or receive messages through the messaging service provider.

5. The method of claim 1, wherein the data provider is a website that requires registration for use of the website by the plurality of users.

6. The method of claim 1, wherein the data provider is a cryptography-related service that provides at least one of the IP address or domain name of each of the plurality of users.

7. The method of claim 1, wherein the historical data includes at least one of previously mapped IP addresses or previously mapped domain names of at least a portion of the plurality of users to the organization.

8. The method of claim 1, further comprising:

normalizing, by a collector of the mapping system, the received dataset.

9. The method of claim 8, wherein normalizing the received data further comprises at least one of:

(i) checking integrity of the dataset;

(ii) reformatting a portion of the dataset;

(iii) removing duplicates in the dataset;

or

(iv) removing irrelevant data from the dataset.

10. The method of claim 8, further comprising:

storing, by the storage medium, the normalized dataset before enriching by the analytics engine; and

receiving, by the analytics engine, the normalized dataset from the storage medium.

11. The method of claim 1, further comprising:

receiving, by the analytics engine from an entity management system, information about existing associations of organizations to IP addresses and domain names; and

mapping, by the analytics engine, at least one of (i) the IP address or (ii) the domain name of a portion of the plurality of users to the organization based on the information about existing associations.

12. The method of claim 1, further comprising:

storing, by the storage medium, the enriched data from the analytics engine.

13. The method of claim 1, wherein the historical data includes a greater number of data points over time than data points of the dataset.

14. The method of claim 1, further comprising:

applying a predictive model of the mapping system to the processed dataset and the historical data.

15. The method of claim 14, further comprising:

processing, by the predictive model, two or more datasets over a time period, the two or more datasets including data related to a common set of users of the plurality of users;

determining, by the predictive model, whether the IP address of at least a portion of the common set of users are consistent over the time period; and

mapping, by the mapping system, the IP address of each of the at least the portion of the common set of users to the organization based on the determination.

16. The method of claim 1, further comprising:

applying deterministic rules to the processed dataset and the historical data.

17. The method of claim 16, wherein the deterministic rules comprise a minimum number of unique mailboxes associated with an IP address, the method further comprising:

mapping, by the mapping system, the IP address to the organization based whether one or more received datasets have the minimum or greater number of unique mailboxes associated with the IP address.

18. The method of claim 1, wherein the dataset is a first dataset and the plurality of email users is a first plurality of email users, the method further comprising:

receiving, by the analytics engine, a second dataset associated with a second plurality of email users, the second plurality of email users mutually non-exclusive with the first plurality of email users;

comparing, by the analytics engine, the second dataset to the first dataset; and

terminating, by the analytics engine, one or more existing mappings between the at least one of (i) the IP address or (ii) the domain name and the organization based on the comparison.

19. The method of claim 18, wherein the terminating, by the analytics engine, one or more existing mappings is based on a threshold.

20. The method of claim 1, further comprising:

storing, by the storage medium, the mapping of the IP address and domain name to the organization.