METHOD AND SYSTEM FOR GENERATING DURABLE HOST IDENTIFIERS USING NETWORK ARTIFACTS

摘要

A host identification engine receives network traffic from a network and uses one or more artifact extractors to extract artifact data items that can identify a host. The artifact data items can be stored in a host signature database. Network addresses to which the hosts correspond can be stored in a network address database. A mapping table can be implemented to match the data in the signature database and network database to generate durable host identification data that can accurately track hosts as they use different identification data and/or move between hosts.

主权项

1. A computer-implemented method for generating network host identification data, comprising:
extracting one or more artifact data items from network traffic, the network traffic corresponding to communications between one or more hosts; generating durable host identification data, the durable host identification data corresponding to a collection of artifacts that identify a host across different network addresses; storing the durable host identification data in a signature database; and storing one or more network addresses and times the one or more network address were in use by the one or more hosts in a network address database, the one or more network addresses corresponding to the durable host identification data.