Passively attributing anonymous network events to their associated users

• US 20080263197A1
• Filed: 04/23/2007
• Published: 10/23/2008
• Est. Priority Date: 04/23/2007
• Status: Active Grant

• Current Assignee: Mitre Corporation
• Original Assignee: Mitre Corporation
• Inventors: Stephens, Gregory D.
• Granted Patent: US 8,996,681 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0622 based on time
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Systems, methods, and computer program products for passively attributing anonymous network events to their associated users are provided herein. Embodiments include filtering network events over a pre-determined time interval to generate a filtered event list. In an embodiment, event attribution includes attributing an anonymous network event to a user associated with a nearest-neighbor event relative to the anonymous network event. In another embodiment, event attribution includes attributing an anonymous network event to a user associated with an event in the filtered event list, wherein that user maximizes an event attribution function. In a further embodiment, event attribution includes determining a first potential attribution user for an anonymous network event based on a nearest-neighbor attribution approach; determining a second potential attribution user for the anonymous network event based on an event attribution function approach; and comparing the first and second potential attribution users to determine the attribution of the anonymous event.

Claims

1. A method for passively attributing an anonymous network event to an associated user, comprising:

filtering network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list; and

attributing the anonymous network event to a user associated with an event in said filtered event list, wherein said user maximizes an event attribution function.

2. The method of claim 1, wherein said pre-determined time interval is selected according to a timestamp associated with the anonymous network event.

3. The method of claim 1, wherein said filtering step comprises determining network events originating from the same IP address as the anonymous network event.

4. The method of claim 1, wherein said filtering step comprises determining network events having direct and/or indirect attribution to associated users.

5. The method of claim 1, wherein said attributing step comprises:

calculating, for each user associated with an event in said filtered event list, an event attribution function value; and

selecting a user having the largest event attribution function value.

6. The method of claim 5, wherein, for each user associated with an event in said filtered list, the event attribution function value is related to events associated with said each user within said pre-determined time interval.

7. The method of claim 6, wherein the event attribution function value is related to one or more of event type, event attribution type, and event time proximity relative to the anonymous network event of said events associated with said each user.

8. The method of claim 5, wherein the event attribution function value is calculated according to:

Σ

<sub>ejε

S(u)</sub>K(e_i, e_j)

wherein e_i represents the anonymous network event, S^(u) represents a set of events associated with a given one of said each user, and K represents a kernel function.

9. The method of claim 8, wherein the kernel function is according to:

K(e_i, e_j)=ω

_je<sup>−

γ

(ti−

tj)2</sup>

wherein ω

_j represents a weight associated with an event according to event type and/or attribution type, γ

represents a width of the kernel function, and t_i represents the time of occurrence of the anonymous event.

10. The method of claim 1, wherein the event attribution type is one of direct attribution, indirect attribution, or unattributed.

19. The method of claim 1, wherein the event attribution type is one of direct attribution, indirect attribution, or unattributed.

11. A method for passively attributing an anonymous network event to an associated user, comprising:

filtering network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list; and

attributing the anonymous network event to a user associated with a nearest-neighbor event relative to said anonymous network event in said filtered event list.

12. The method of claim 11, wherein said pre-determined time interval is selected according to a timestamp associated with the anonymous network event.

13. The method of claim 11, wherein said filtering step comprises determining network events originating from the same IP address as the anonymous network event.

14. The method of claim 11, wherein said filtering step comprises determining network events having direct and/or indirect attribution to associated users.

15. The method of claim 11, wherein said attributing step comprises attributing the anonymous network event to a user associated with an event in said filtered event list, wherein said event has direct attribution and is nearest in distance to the anonymous network event in a chronological ordering of said filtered event list.

16. The method of claim 11, wherein said attributing step comprises attributing the anonymous network event to a user associated with an event in said filtered event list, wherein said event has direct attribution and is nearest in time to the anonymous network event.

17. The method of claim 11, wherein said attributing step comprises attributing the anonymous network event to a user associated with an event in said filtered event list, wherein said event has direct attribution and is nearest in distance to the anonymous network event based on an event count separating said event from the anonymous network event.

18. The method of claim 11, wherein said attributing step comprises attributing the anonymous network event to a user associated with an event in said filtered event list, wherein said event is nearest in time to the anonymous network event.

20. A method for passively attributing an anonymous network event to an associated user, comprising:

filtering network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list;

determining a first potential attribution user in said filtered event list, wherein said first potential attribution user is associated with a nearest-neighbor event relative to said anonymous event in said filtered event list;

determining a second potential attribution user in said filtered event list, wherein said second potential attribution user maximizes an event attribution function; and

attributing the anonymous network event to the first or second potential attribution user when said first and second potential attribution users are the same user.

21. The method of claim 20, further comprising:

maintaining the anonymous network event unattributed if the first and second potential attribution users are different.

22. The method of claim 20, wherein the method is performed off-line on in real-time.

23. A computer program product comprising a computer useable medium having computer program logic recorded thereon for enabling a processor to passively attribute an anonymous network event to an associated user, the computer program logic comprising:

filtering means for enabling a processor to filter network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list; and

attributing means for enabling a processor to attribute the anonymous network event to a user associated with an event in said filtered event list, wherein said user maximizes an event attribution function.

24. A computer program product comprising a computer useable medium having computer program logic recorded thereon for enabling a processor to passively attribute an anonymous network event to an associated user, the computer program logic comprising:

filtering means for enabling a processor to filter network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list; and

attributing means for enabling a processor to attribute the anonymous network event to a user associated with a nearest-neighbor event relative to said anonymous network event in said filtered event list.

25. A computer program product comprising a computer useable medium having computer program logic recorded thereon for enabling a processor to passively attribute an anonymous network event to an associated user, the computer program logic comprising:

filtering means for enabling a processor to filter network events occurring over a pre-determined time interval according to at least one of Internet Protocol (IP) address and event attribution type to generate a filtered event list;

first determining means for enabling a processor to determine a first potential attribution user in said filtered event list, wherein said first potential attribution user is associated with a nearest-neighbor event relative to said anonymous event in said filtered event list;

second determining means for enabling a processor to determine a second potential attribution user in said filtered event list, wherein said second potential attribution user maximizes an event attribution function; and

attributing means for enabling a processor to attribute the anonymous network event to the first or second potential attribution user when said first and second potential attribution users are the same user.