Patent ID: 8141148

Claim:
A method for tracking machines on a network of computers, the method comprising: identifying a malicious host coupled to the network of computers; determining a first IP (Internet Protocol) address and attributes associated with the malicious host during a first time period, the attributes being associated with two or more network layers; determining an attribute fuzzy GUID for the first IP address and each of the attributes, the attribute fuzzy GUID being a globally unique identifier associated with the first IP address and each of the attributes; forming a fuzzy GUID (Globally Unique Identifier) of the malicious host by processing the attribute fuzzy GUID associated with the first IP address and each of the attributes, wherein the host fuzzy GUID is a globally unique identifier for each host and includes behavior information; classifying the malicious host to be in a determined state; during a second time period, classifying the malicious host to be in a latent state; identifying an unknown host during the second time period, the unknown host being associated with a second IP address and one or more attributes; processing the second IP address and the one or more attributes of the unknown host in conjunction with the first IP address and the one or more attributes of the malicious host; and determining if the malicious host has moved from the first IP address to the second IP address, thereby identifying if the unknown host is the malicious host.