User identification using multifaceted footprints

Patent metadata

Field	Value
Publication number	US-9251328-B2
Application number	US-201213553415-A
Country	US
Kind code	B2
Filing date	Jul 19, 2012
Priority date	Jul 5, 2012
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

A method for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts includes receiving a plurality of priors for the facets with respect to the contexts, receiving a plurality of footprints of known users, aggregating the footprints of the users to determine an ensemble prior, receiving a plurality of network traces relevant to an unknown user in a computer environment, matching the network traces against each of the footprints to determine a plurality of matches, aggregating the matches using the ensemble prior according to the facets and the contexts, and outputting a probable user identity for the unknown user.

First claim

What is claimed is:

1. A computer program product for identifying an unknown user, the computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to provide a plurality of historical network traces of user activity;
computer readable program code configured to extract a footprint for each of a plurality of users from the historical network traces;
computer readable program code configured to aggregate the footprints of the users to determine an ensemble prior;
computer readable program code configured to receive a plurality of network traces relevant to an unknown user in a computer environment;
computer readable program code configured to match the network traces against each of the footprints to determine a plurality of matches;
computer readable program code configured to aggregate the matches using the ensemble prior according to a plurality of contexts and a plurality of facets; and
computer readable program code configured to output a probable user identity for the unknown user.

2. The computer program product of 1 , wherein the network traces are received as an input stream, and the computer readable storage medium further comprising computer readable program code configured to perform the matching on the stream of network traces using an indexing structure.

3. The computer program product of 1 , further comprising computer readable program code configured to output a plurality of user identities, ranked by probability.

4. The computer program of claim 1 , wherein outputting further comprises outputting a sorted list of user identifies according to a probability of being the unknown user.

5. The computer program of claim 1 , wherein each context indicated at least one of a time and a location of user activity.

6. The computer program of claim 1 , wherein each facet is a measurement dimension of user activity.

7. A system for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts, the system comprising:
a memory storing a plurality of priors for the facets with respect to the contexts and an ensemble prior based on a plurality of footprints of known users; and
a processor configured to receive a plurality of network traces relevant to an unknown user in a computer environment, match the network traces against each of the footprints to determine a plurality of matches, aggregate the matches using the ensemble prior according to the facets and the contexts, and output a probable user identity for the unknown user.

8. The system of claim 7 , wherein the network traces are received as an input stream, and the method further comprising performing the matching on the stream of network traces using an indexing structure.

9. The system of claim 7 , wherein the processor is configured to output a plurality of user identities, ranked by probability.

10. The system of claim 9 , wherein outputting further comprises outputting a sorted list of user identifies according to a probability of being the unknown user.

11. The system of claim 9 , wherein each context indicated at least one of a time and a location of user activity.

12. The system of claim 9 , wherein each facet is a measurement dimension of user activity.

13. The system of claim 9 , wherein the memory embodies computer readable program code executed by the processor to identify the unknown user.

Assignees

• Christodorescu Mihai
• Sailer Reiner
• Schales Douglas Lee
• Stoecklin Marc
• Wang Ting
• IBM

Inventors

• Christodorescu Mihai
• Sailer Reiner
• Schales Douglas Lee
• Stoecklin Marc
• Wang Ting

Classifications

• G06F2221/2117

  User registration · CPC title

• H04L41/5096

  wherein the managed service relates to distributed or central networked applications · CPC title

• H04L41/5058

  Service discovery by the service manager · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title