Patent ID: 8732293
Filing Date: 2014-05-20
Classification: H04L

Abstract:
1. A computer-implemented method for identifying a target entity in a data network, the method comprising: monitoring the target entity to determine a first plurality of hosts with which the target entity communicates over a period of time; creating a first core community of interest associated with the target entity, wherein creating the first core community of interest comprises excluding a first host from the first plurality of hosts with which the target entity communicates only once over the period of time such that the first core community of interest comprises second hosts from the first plurality of hosts with which the target entity communicates more than once over the period of time; monitoring a first entity to determine a second plurality of hosts with which the first entity communicates over the period of time and a second entity to determine a third plurality of hosts with which the second entity communicates over the period of time; creating a joint community of interest associated with the first entity and the second entity, wherein creating the joint community of interest comprises intersecting a second core community of interest associated with the first entity with a third core community of interest associated with the second entity such that the joint community of interest comprises third hosts which the first entity and the second entity have in common; comparing the first core community of interest associated with the target entity with the joint community of interest associated with the first entity and the second entity to determine a fourth host which the first core community of interest and the joint community of interest have in common; excluding the fourth host which the first core community of interest and the joint community of interest have in common from the first core community of interest to create a target community of interest associated with the target entity, the target community of interest comprising a fifth host from the first core community of interest which the target entity and the first and second entities do not have in common; and using the target community of interest to identify the target entity.