User identification using multifaceted footprints

摘要

A method for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts includes receiving a plurality of priors for the facets with respect to the contexts, receiving a plurality of footprints of known users, aggregating the footprints of the users to determine an ensemble prior, receiving a plurality of network traces relevant to an unknown user in a computer environment, matching the network traces against each of the footprints to determine a plurality of matches, aggregating the matches using the ensemble prior according to the facets and the contexts, and outputting a probable user identity for the unknown user.

主权项

1. A computer program product for identifying an unknown user, the computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising: computer readable program code configured to provide a plurality of historical network traces of user activity; computer readable program code configured to extract a footprint for each of a plurality of users from the historical network traces; computer readable program code configured to aggregate the footprints of the users to determine an ensemble prior; computer readable program code configured to receive a plurality of network traces relevant to an unknown user in a computer environment; computer readable program code configured to match the network traces against each of the footprints to determine a plurality of matches; computer readable program code configured to aggregate the matches using the ensemble prior according to a plurality of contexts and a plurality of facets; and computer readable program code configured to output a probable user identity for the unknown user.