Cross-Telemetry Entity Matching Using Time Windows and Address Books
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network environments, differentiating entities from observed information and attributing information to known entities is difficult due to varying types and sources of telemetry, leading to inefficient management and security of networks.
Innovation Solution
A method involving a server device that receives telemetry data, establishes time windows, and maintains an address book to map identifying and associated information, enabling entity matching across different telemetry sources using a heuristic approach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional telemetry collection methods are used, then data collection from multiple sources is simple, but entity differentiation and attribution become difficult
Solution Approach 1:
The patent segments the entity matching process into distinct components: telemetry data reception, time window establishment, entity information extraction, and address book maintenance. This segmentation allows the system to handle complex multi-source telemetry data by processing it in manageable stages, improving entity differentiation capability while keeping the system architecture organized and maintainable
Solution Approach 2:
The patent introduces an address book as an intermediary data structure that stores entity information extracted from telemetry data. This address book acts as a mediator between raw telemetry data and entity attribution processes, enabling the system to match entities across different telemetry sources by comparing against stored entity profiles, thereby enhancing adaptability without proportionally increasing complexity
2Loss of information
If telemetry data from multiple sources is collected, then information completeness improves, but entity differentiation difficulty increases
Solution Approach 1:
The patent performs preliminary entity information extraction and storage in the address book before the actual entity matching process. By pre-processing telemetry data to extract and store key entity attributes (such as device identifiers, user profiles, and behavioral patterns) in advance, the system reduces the complexity of real-time entity differentiation while maintaining complete information from multiple telemetry sources
Solution Approach 2:
The patent transforms raw telemetry data into standardized entity parameters by extracting relevant attributes and storing them in a uniform format in the address book. This parameter transformation enables consistent entity comparison across different telemetry sources, improving information completeness while making entity differentiation more manageable through standardized parameter matching
3Measurement precision
If entity attribution is performed without time windows, then processing speed is faster, but attribution accuracy decreases
Solution Approach 1:
The patent implements periodic action by establishing time windows that divide the continuous telemetry data stream into discrete temporal segments. Entity information is extracted and stored in the address book within these time-bound windows, allowing the system to perform accurate entity attribution by comparing data within specific time contexts. This periodic structuring improves attribution accuracy by capturing temporal patterns while maintaining efficient processing through batch-oriented operations within each time window
Data Source
AI summary
This disclosure describes techniques for matching entities across a computing network using data from different telemetries. The techniques include receiving telemetry data of the computing network, the telemetry data including identifying information corresponding to an entity, associated information of the computing network, and/or timestamps. The techniques also include establishing one or more time windows based at least in part on the timestamps. A particular time window may be determined to correspond to the associated information. The techniques may include attributing the associated information to the entity. In some cases, an address book may be maintained, including mappings of the identifying information, the associated information, and/or time windows.