Dynamic IP-to-Host Mapping via SIEM Log Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large enterprise networks, accurately associating computer system activity information from log files with specific hosts over an extended period is challenging due to dynamic IP addresses, incomplete data, and time zone inconsistencies, making it difficult to identify static and dynamic IP addresses and construct accurate IP-to-host mappings.
Innovation Solution
A method is developed to automatically classify IP addresses as static or dynamic, adjust log timestamps to a consistent time reference, and fill in missing data using a SIEM system that leverages logs from network monitoring devices, including firewalls, web proxies, and DHCP servers, to create a mapping of network addresses to unique hosts over time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP addresses are dynamically assigned to hosts, then network resource utilization is improved, but the ability to accurately track and associate activity with specific hosts over time deteriorates
Solution Approach 1:
The system continuously monitors network traffic and log data to detect changes in IP-to-host associations. When a host's IP address changes, the system detects this through anomalies in network behavior patterns and updates the mapping relationships in real-time, ensuring continuous accurate tracking despite dynamic reassignment
Solution Approach 2:
The patent introduces MAC addresses as an intermediary identifier that remains constant even when IP addresses change. By using MAC addresses as a stable reference point and maintaining mappings between MAC addresses and current IP addresses, the system can accurately track hosts through IP changes without losing association accuracy
2Measurement precision
If comprehensive logging is implemented to track all network activity, then monitoring accuracy is improved, but bandwidth overhead and system complexity increase
Solution Approach 1:
The system extracts and focuses on collecting only the specific log data elements necessary for host identification and tracking, such as IP addresses, MAC addresses, and timestamp information. By filtering out unnecessary logging details, the system maintains accurate host tracking while minimizing bandwidth consumption and processing overhead
Solution Approach 2:
The patent implements selective logging that captures sufficient information to accurately track host associations without recording every possible network event. The system logs only the critical data points needed for maintaining IP-to-host mappings, avoiding the bandwidth overhead of comprehensive logging while preserving monitoring accuracy
3Measurement precision
If manual documentation of static IP assignments is attempted, then initial mapping accuracy is improved, but maintenance difficulty increases due to network changes
Solution Approach 1:
The system automatically discovers and updates IP-to-host mappings by monitoring network traffic and analyzing log data from network devices. Instead of requiring manual updates when network configurations change, the system self-updates its mappings by detecting actual IP assignments through observed network behavior, eliminating the need for manual maintenance while maintaining accuracy
4Ease of operation
If log timestamps are stored in local time zones, then logging simplicity is improved, but data consistency and analysis accuracy deteriorate
Solution Approach 1:
The system performs preliminary conversion of timestamps from local time zones to a standardized reference time (such as UTC) at the point of log collection. By converting timestamps immediately when logs are gathered, the system ensures time consistency for subsequent analysis while allowing individual logging devices to continue operating with their local time zone configurations
Data Source
AI summary
Mapping network addresses in logs of network activity to corresponding host computers includes generating lists of known-dynamic addresses, static addresses and other-dynamic addresses from network addresses appearing in the logs. The static addresses and other-dynamic addresses are assigned to host computers having respective first host identifiers, and the known-dynamic addresses are associated with corresponding host computers having respective second host computer identifiers contained in dynamic address assignment activity. For the static and other-dynamic addresses, the first host identifiers are obtained, and first address-to-host bindings are created for address-based lookups of first host identifiers using respective addresses. For the known-dynamic addresses, the second host computer identifiers and log-time information from the dynamic address activity are used to create second address-to-host bindings usable to perform address-based lookup of second host identifiers and corresponding use-time information using respective addresses to which the second host identifiers are bound.