Network Entity Tracking via Dynamic ID Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to tracking network entities across a network rely on ephemeral IDs, which are temporary and inaccurate when treated as static, leading to inaccurate cybersecurity threat detection due to the difficulty in accessing ground-truth identities.
Innovation Solution
The solution involves analyzing network log data to track and update associations between static and ephemeral IDs over time, creating time-aware associations that allow for accurate network entity tracking without relying on intrusive software agents, enabling decentralized tracking even in IoT networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If ephemeral IDs are used to track network entities, then tracking can be performed without intrusive software agents, but tracking accuracy deteriorates because ephemeral IDs are temporary and do not represent ground-truth identities
Solution Approach 1:
The patent introduces a correlation module as an intermediary that mediates between ephemeral IDs observed in network logs and static IDs from authoritative sources. This correlation module maintains and updates associations between ephemeral and static IDs, allowing the system to track entities using easy-to-obtain ephemeral IDs while achieving accurate identification through the intermediary's mapping to ground-truth static IDs.
Solution Approach 2:
The system creates a copy or representation of the ground-truth identity through the correlation module's mapping. Instead of directly accessing the actual ground-truth identity (which would require intrusive agents), the system uses ephemeral IDs as proxies and maintains accurate tracking by copying the association relationship through the correlation module, which stores and updates the mapping between ephemeral and static IDs.
2Device complexity
If static IDs are assumed for ephemeral identifiers, then entity tracking becomes simpler, but reliability deteriorates due to ID changes over time
Solution Approach 1:
The patent makes the ID association system dynamic by implementing a correlation module that continuously updates the mapping between ephemeral and static IDs. Instead of assuming a fixed static ID for each ephemeral ID, the system dynamically adjusts associations based on observed changes, allowing entities to change their ephemeral IDs over time while maintaining reliable tracking through the updated correlations.
Solution Approach 2:
The system implements feedback mechanisms where the correlation module continuously monitors network logs for new ephemeral ID associations and updates the mapping accordingly. This feedback loop ensures that the system adapts to ID changes by observing actual usage patterns and updating the ephemeral-to-static ID associations, thereby maintaining reliable tracking despite changes in identifiers over time.
Data Source
AI summary
Technologies are provided for tracking network entities over time. By analyzing network log data, static identifiers (IDs) may be associated with ephemeral IDs corresponding to respective network entities. Existing associations between static IDs and ephemeral IDs may be updated over time, based on analysis of incoming network log data. Accordingly, an ephemeral ID may correspond to one static ID during a first time period, and may correspond to another static ID during a second time period.