Timing-Based Network Entity Resolution for Reliable Session Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-based correlation methods, such as IP address correlation, are unreliable due to non-unique and frequently reassigned addresses, leading to false positives and a lack of effective alternatives for matching communication events between network entities.
Innovation Solution
A method to identify communication between networked entities by correlating communication request and acceptance messages based on unique identifiers and timestamps, regardless of network addresses, using a digital security system to detect and analyze event data from multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If IP address correlation is used to match communication events, then the method is simple to implement, but the reliability is poor due to non-unique and frequently reassigned addresses
Solution Approach 1:
The patent introduces timing information as an intermediary element to match communication events. Instead of relying solely on IP addresses, the system uses timestamps from request and acceptance messages as a mediating factor to reliably correlate communications between network entities, resolving the unreliability of IP address correlation.
Solution Approach 2:
The patent changes the matching parameter from IP address alone to a combination of timing parameters (timestamps from request and acceptance messages). This parameter transformation enables reliable communication matching even when IP addresses are reassigned or non-unique, as the timing relationship between request and acceptance messages remains consistent.
2Reliability
If timing-based correlation is implemented to improve matching accuracy, then the reliability improves, but the device complexity increases due to additional timestamp processing requirements
Solution Approach 1:
The system extracts timing information directly from the communication messages themselves (request and acceptance messages contain timestamps). This self-service approach means the messages carry their own correlation data, eliminating the need for external timing synchronization infrastructure and reducing system complexity while maintaining high reliability.
3Ease of operation
If traditional address-based methods are used, then the system is easy to operate, but measurement precision of communication sessions is poor
Solution Approach 1:
The patent adds a temporal dimension to communication matching by incorporating timestamps into the correlation process. This moves the system from one-dimensional IP address matching to two-dimensional matching (IP address + timing relationship), significantly improving precision while maintaining ease of operation through automated timestamp-based correlation.
Data Source
AI summary
A first request message is received from a first device that specifies a destination network address and identifier for a second device, and a first timestamp. A first acceptance message is received from the second device that specifies a destination network address and identifier for the first device, and a second timestamp. A second request message is received from the first device that specifies the destination network address and identifier for the second device, and a third timestamp. A second acceptance message is received from the second device that specifies the destination network address and identifier for the first device, and a fourth timestamp. The first device is determined to be communicating with the second device when the first and second timestamps indicate the first request and acceptance messages, and when the third and the fourth timestamps indicate the second request and acceptance messages, occurred at substantially the same time.