Patent ID: 11941626
Assignee: COGNYTE TECHNOLOGIES ISRAEL LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 5:
6. A method, comprising:
performing one or more probing transactions, in which respective amounts of a cryptocurrency are transferred to one or more cryptocurrency addresses;
monitoring communication traffic exchanged by the one or more cryptocurrency addresses with one or more Internet Protocol (IP) addresses,
ascertaining, based on monitored communication traffic, that at least one of the probing transactions was downloaded to a particular one IP address of the one or more IP addresses by at least one of the following:
computing an expected download size of the at least one of the one or more probing transactions, ascertaining that a difference between (i) a download size of a sequence of one or more encrypted packets downloaded to the particular one of the IP addresses and (ii) the expected download size, is within a predefined range, and in response to ascertaining that the difference is within the predefined range, ascertaining that the at least one of the one or more probing transactions was downloaded to the particular one of the IP addresses by virtue of the sequence specifying the at least one of the one or more probing transactions;
using an encrypted-packet classifier, ascertaining that the sequence of the one or more encrypted packets downloaded to the particular one of the IP addresses specifies a downloaded transaction in the cryptocurrency, and in response to ascertaining that the sequence specifies the downloaded transaction, ascertaining that the at least one of the one or more probing transactions was downloaded to the particular one of the IP addresses by virtue of the downloaded transaction being the at least one of the one or more probing transactions; or
subsequently to performing the at least one of the probing transactions, ascertaining that a first downloaded transaction in the cryptocurrency was downloaded to the particular one of the IP addresses and a second downloaded transaction in the cryptocurrency was downloaded to another IP address, ascertaining that another one of the probing transactions, in which some of the cryptocurrency is transferred to one of the cryptocurrency addresses that is different from the one or more cryptocurrency addresses of interest, was downloaded to another IP addresses, and in response to ascertaining that the other one of the probing transactions was downloaded to another IP addresses, ascertaining that the at least one of the probing transactions was downloaded to the particular one of the IP addresses, by virtue of the first downloaded transactions being the at least one of the probing transactions, and

generating, in response to the ascertaining, an output indicating an association between a cryptocurrency address of interest of the one or more cryptocurrency addresses and the particular one IP address of the one or more IP addresses.