Mapping IP Addresses to Organizations via User Activity Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations face challenges in managing and securing their network resources due to a lack of knowledge about their network footprint, making them more vulnerable to cyberattacks, especially with numerous users and temporary network connections.
Innovation Solution
A computer-implemented method that maps Internet Protocol (IP) addresses and domain names to organizations using user activity data, employing machine learning techniques and quality filters to discover, filter, and manage these resources by unifying domain name information with IP addresses, and utilizing historical data to assign and understand network characteristics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large organizations use traditional network management methods, then they have simpler management processes, but they lack knowledge of their network footprint making them vulnerable to cyberattacks
Solution Approach 1:
The patent introduces an intermediary system that acts as a mediator between network traffic and organization identification. This system collects IP address and domain name data, enriches it with additional information, and maps it to organizations using machine learning techniques. The intermediary nature of this system allows organizations to gain visibility into their network footprint without directly monitoring all network traffic themselves.
Solution Approach 2:
The patent replaces traditional mechanical network management approaches with machine learning-based automation. Instead of manual network inventory and tracking, the system uses trained machine learning models to automatically identify organizations associated with IP addresses and domain names, enabling scalable network footprint discovery that adapts to changing network conditions.
2Productivity
If organizations manually track network resources, then they have better control over data quality, but the process becomes time-consuming and inefficient
Solution Approach 1:
The system implements self-service capabilities where the machine learning models automatically perform data enrichment, quality filtering, and organization mapping without requiring manual intervention. The models continuously learn from incoming data and automatically update their parameters, enabling the system to serve itself while maintaining high productivity in network resource discovery.
Solution Approach 2:
The patent establishes continuous data collection, enrichment, and mapping processes that operate continuously rather than in discrete batches. The machine learning models continuously process incoming IP address and domain name data, continuously refine their parameters based on feedback, and continuously update organization mappings, ensuring uninterrupted network footprint discovery and management.
3Adaptability or versatility
If organizations expand their network to accommodate more users, then they increase their operational capacity, but they increase vulnerability to cyberattacks due to larger network footprint
Solution Approach 1:
The system implements feedback mechanisms where machine learning models continuously receive feedback from enriched network data and adjust their parameters accordingly. This feedback loop enables the system to adapt to expanding network footprints by automatically learning new patterns and associations, allowing organizations to scale their networks while maintaining security through improved visibility and automated anomaly detection.
Data Source
AI summary
A computer-implemented method is provided for mapping IP addresses and domain names to organizations. The method includes receiving, by a mapping system from an data provider, a dataset related to a plurality of users of the data provider. The dataset includes (a) an IP address for a user device of each user of the plurality of users, and (b) a domain name for a user account of each user of the plurality of users; enriching, by an analytics engine of the mapping system, the received dataset with enrichment data from an enrichment source; receiving, by the analytics engine from a storage medium, historical data relevant to the enriched dataset; and mapping, by the analytics engine, (i) the IP address and/or (ii) the domain name of each user of a portion of the plurality of users to an organization based on the enriched dataset and the historical data.