Patent ID: 7904456

Claim:
A computer security monitoring method, comprising; storing information at at least one computer system about a plurality of known Hosts, each of the known hosts being an entity of a computer network, the at least one computer system programmed for computer security monitoring and operatively communicating with the computer network; receiving data at the at least one computer system from one or more sources; associating and storing with the at least one computer system at least some of the data and at least some information about a first of the known hosts with at least two hosts if it is determined by the at least one computer system that, based on the data, the information associated with the first known host is more accurately associated with the at least two hosts; and associating and storing with the at least one computer system at least some of the data and at least some information about at least two of the known hosts with a single host if it is determined by the at least one computer system that, based on the data, the information associated with the at least two known hosts is more accurately associated with the single host.