System and method for correlating network identities and addresses
The system and method for correlating network identities and addresses described herein may include a log correlation engine distributed on a network that identifies relationships between certain network identities and Internet Protocol (IP) and Ethernet addresses in the network. In particular, the log correlation engine may analyze various event logs that describe activity in a network to learn relationships between network identities and network addresses and generate alerts in response to discovering changes in the learned relationships. For example, the log correlation engine may identify authentication events described in the logs to map network identities to IP addresses, and may further analyze the logs to map the IP addresses to Ethernet addresses. Thus, the log correlation engine may discover new and changed relationships between the network identities, the IP addresses, and the Ethernet addresses.
1. A computer system for correlating network identities and addresses, comprising:
at least one processing device coupled to a machine-readable storage medium with computer executable instructions for implementing a log correlation engine in a network, wherein the log correlation engine causes the at least one processing device to:
receive one or more logs that describe traffic observed on the network, wherein the network traffic includes one or more network sessions observed on the network;
identify an authentication event described in the one or more logs, wherein the authentication event includes a network identity and a first network address observed in the one or more network sessions;
map the first network address to a second network address from information in the one or more logs that describe the traffic observed in the network;
map the network identity to one or more of the first network address or the second network address from the information in the one or more logs that describe the traffic observed in the network; and
identify a relationship between the network identity, the first network address, and the second network address in response to mapping the first network address to the second network address and mapping the network identity to the first network address or the second network address, wherein a network identity and address list comprises a hash value generated from the first network address, the network identity, and a login type to provide an index that can be referenced to determine whether a corresponding entry in the network identity and address list includes new or updated information.
2. The system of claim 1 , wherein the first network address includes an Internet Protocol address and the second network address includes a Media Access Control address.
3. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to generate an alert in response to the identified relationship between the network identity, the first network address, and the second network address.
4. The system of claim 3 , wherein the alert indicates that the network identity accessed the first network address or the second network address and that another network identity previously had a relationship to the first network address or the second network address.
5. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to generate an alert in response to determining that the authentication event describes an invalid authentication event.
6. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to update a network identity and address list in response to the identified relationship between the network identity, the first network address, and the second network address.
7. The system of claim 1 , wherein the network identity and address list includes a time stamp that describes when the relationship between the network identity, the first network address, and the second network address was identified.
8. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to:
identify a hardware device detection event described in the one or more logs, wherein the hardware device detection event includes a Media Access Control network address for a new hardware device that an active vulnerability scanner observes in the one or more network sessions; and
identify a relationship between the new hardware device and the Media Access Control network address.
9. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to:
identify a hardware device detection event described in the one or more logs, wherein the hardware device detection event includes a Media Access Control network address for a new hardware device that an active vulnerability scanner detects in the network; and
identify a relationship between the new hardware device and the Media Access Control network address.
10. The system of claim 1 , wherein the log correlation engine further causes the at least one processing device to:
identify a media activity event described in the one or more logs, wherein the media activity event describes an insertion or removal of a media device from another device in the network; and
generate an alert in response to the media activity event.
11. A method for correlating network identities and addresses, comprising:
distributing a log correlation engine on a network;
receiving, at the log correlation engine, one or more logs that describe traffic observed on the network, wherein the network traffic includes one or more network sessions observed on the network;
identifying, by the log correlation engine, an authentication event described in the one or more logs, wherein the authentication event includes a network identity and a first network address observed in the one or more network sessions;
mapping, by the log correlation engine, the first network address to a second network address from information in the one or more logs that describe the traffic observed in the network;
mapping, by the log correlation engine, the network identity to one or more of the first network address or the second network address from the information in the one or more logs that describe the traffic observed in the network; and
identifying, by the log correlation engine, a relationship between the network identity, the first network address, and the second network address in response to mapping the first network address to the second network address and mapping the network identity to the first network address or the second network address, wherein a network identity and address list comprises a hash value generated from the first network address, the network identity, and a login type to provide an index that can be referenced to determine whether a corresponding entry in the network identity and address list includes new or updated information.
12. The method of claim 11 , wherein the first network address includes an Internet Protocol address and the second network address includes a Media Access Control address.
13. The method of claim 11 , further comprising generating an alert in response to the log correlation engine identifying the relationship between the network identity, the first network address, and the second network address.
14. The method of claim 13 , wherein the alert indicates that the network identity accessed the first network address or the second network address and that another network identity previously had a relationship to the first network address or the second network address.
15. The method of claim 11 , further comprising generating an alert in response to the log correlation engine determining that the authentication event describes an invalid authentication event.
16. The method of claim 11 , further comprising updating a network identity and address list in response to the log correlation engine identifying the relationship between the network identity, the first network address, and the second network address.
17. The method of claim 11 , wherein the network identity and address list includes a time stamp that describes when the relationship between the network identity, the first network address, and the second network address was identified.
18. The method of claim 11 , further comprising:
identifying, by the log correlation engine, a hardware device detection event described in the one or more logs, wherein the hardware device detection event includes a Media Access Control network address for a new hardware device that an active vulnerability scanner observes in the one or more network sessions; and
identifying, by the log correlation engine, a relationship between the new hardware device and the Media Access Control network address.
19. The method of claim 11 , further comprising:
identifying, by the log correlation engine, a hardware device detection event described in the one or more logs, wherein the hardware device detection event includes a Media Access Control network address for a new hardware device that an active vulnerability scanner detects in the network; and
identifying, by the log correlation engine, a relationship between the new hardware device and the Media Access Control network address.
20. The method of claim 11 , further comprising:
identifying, by the log correlation engine, a media activity event described in the one or more logs, wherein the media activity event describes an insertion or removal of a media device from another device in the network; and
generating an alert in response to the log correlation engine identifying the media activity event.