Patent ID: 8127353

Claim:
A method performed by a computer system, for determining a user name likely to be associated with an attack, a configuration, or a vulnerability, comprising: obtaining first data which associates user names with individual IP addresses onto which the user names were logged in by the computer system; obtaining second data which associates attacks, configurations, or vulnerabilities with individual IP addresses on which the attacks occurred or on which the configurations were changed or vulnerabilities existed; determining whether the user name from the first data was logged-in to the IP address at a time of the attack, the configuration change, or the vulnerability existence; and associating the user names from the first data with the attacks, configurations or vulnerabilities from the second data based on having the same IP address during a log-in, wherein an individual user name is indicated as being associated with attacks which occurred or with configurations which were changed or with vulnerabilities which existed, while the individual user name was logged in instead of while logged out for an IP address onto which the user logs in.