MINING USER BEHAVIOR DATA FOR IP ADDRESS SPACE INTELLIGENCE

• US 20090249480A1
• Filed: 03/26/2008
• Published: 10/01/2009
• Est. Priority Date: 03/26/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mehr, John, Hulten, Geoffrey, Osipkov, Ivan, Yu, Fang, Xie, Yinglian
• Granted Patent: US 8,789,171 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The claimed subject matter is directed to mining user behavior data for increasing Internet Protocol (“IP”) space intelligence. Specifically, the claimed subject matter provides a method and system of mining user behavior within an IP address space and the application of the IP address space intelligence derived from the mined user behavior.

In one embodiment, the IP address space intelligence is formed and/or increased with information obtained from the mined user behavior data. A system of uniquely-identified users is monitored and their behavior within the IP address space is recorded. Further data is mined from estimated characteristics about the user, including the nature of the IP address the user uses to log into the service, and characterizing the IP address according to a network type.

Claims

1. A method for mining behavioral data from users of a system of identified users, the method comprising:

monitoring user behavior in the system; and

deriving information about the user behavior in an Internet Protocol address space based on the monitored user behavior.

2. The method of claim 1, wherein deriving information about the user behavior in an Internet Protocol address space based on the monitored user behavior further comprises:

compiling information about the behavior of a user of the system within the Internet Protocol address space;

estimating the nature of the Internet Protocol address the user uses to access the system; and

characterizing the Internet Protocol address according to a network type.

3. The method of claim 2, wherein estimating the nature of the Internet Protocol address of the user further comprises determining whether the Internet Protocol address is static or dynamic.

4. The method of claim 2, wherein estimating the nature of the Internet Protocol address used to access the system further comprises determining whether the Internet Protocol address is a proxy address or an address used by a NAT device.

5. The method of claim 3, wherein determining whether the Internet Protocol address is dynamic further comprises monitoring user log-ins over a period of time to determine the dynamic pools of Internet Protocol addresses available to the user when connecting to the Internet.

6. The method of claim 5, wherein determining a dynamic pool of Internet Protocol addresses an identified user can use to access the Internet with a dynamic Internet Protocol address further comprises:

collecting user data of the presence of a user seen on a first subnet;

monitoring one or more second subnets for the presence of the user; and

grouping the first subnet and the second subnets together to form a dynamic pool of Internet Protocol addresses the user can be assigned to when connecting to the Internet with a dynamic Internet Protocol address.

7. The method of claim 2, wherein characterizing the Internet Protocol address according to a network type further comprises using a time series analysis of user activities at the determined Internet Protocol address of the user.

8. The method of claim 7, wherein a time series analysis of user activities further comprises comparing a log of the user activities with certain distinctions corresponding to the various network types.

9. The method of claim 4, wherein determining if the Internet Protocol Address is a proxy address or an address used by a NAT device further comprises evaluating heavy user activity on a given Internet Protocol Address.

10. The method of claim 3, the method further comprising estimating dynamic characteristics related to the Internet Protocol address.

11. A method of tracking behavior in a system of identified users based on mined behavior data for an Internet Protocol address space, the method comprising:

mining behavioral data from a system of identified users by monitoring user behavior in the system, and deriving information about user behavior in an Internet Protocol address space based on the monitored user behavior;

identifying one or more activities;

tracking the one or more activities to one or more Internet Protocol Address(es); and

mapping the identified activity to the one or more Internet Protocol Addresses of a user.

12. The method of claim 11, the method further comprising recording a log of user data, the log of user data including:

the identity of the user;

one or more actions of the user;

the Internet Protocol address from which the user was observed performing an action; and

the time the action was performed.

13. The method of claim 12, the method further comprising recording a log of identified activities and the Internet Protocol addresses the activities access the system from.

14. The method of claim 13, wherein mapping a user to the identified activity from the Internet Protocol address of the user further comprises cross referencing the log of user data with the log of identified activities to determine the probability that a specific user is associated with the identified activity.

15. The method of claim 14, the method further comprising recording a log of infected users, wherein the log of infected users records the users mapped to identified malicious activity.

16. A system for tracking malicious behavior in a system of identified users based on mined behavior data for an Internet Protocol address space, the system comprising:

a computer system having a processor coupled to a memory, the memory having computer readable code, which when executed by the processor causes the computer system to implement an application for tracking user behavior in a system of identified users based on mined behavior data for the Internet Protocol address space,

wherein, the application tracks user behavior in a system by mining behavioral data from users of a system of identified users by deriving information about user behavior in the Internet Protocol address space, linking a specific user of the system to activity occurring with the Internet Protocol address space based upon the information obtained, identifying malicious activity and tracking the malicious activity to the Internet Protocol Address of a user, and mapping a user to the identified malicious activity coming from the Internet Protocol Address of the user

17. The system according to claim 16, wherein the user accesses the system from a remote computing device.

18. The system according to claim 17, wherein the remote computing device is a computer system.

19. The system according to claim 17, wherein the remote computing device is a hand-held computing device.

20. The system according to claim 17, wherein the use accesses the system via the Internet.