System and method for identifying security entities in a computing environment

1. A method for identifying a security entity in a computing environment, comprising:

monitoring a communication between a user computer and at least one destination computer by a security appliance;

extracting selective information from the communication by the security appliance;

assigning a first virtual identifier to a subset of the communication within a first time interval;

extending the first time interval so that the subset of the communication to which the first virtual identifier is assigned applies to a larger portion of the communication;

identifying at least one security entity based on a subset of the extracted selective information within a duration of the extended first time interval;

associating one or more of the extracted selective information from the communication within the duration of the extended first time interval to the identified at least one security entity; and

associating the assigned first virtual identifier to the identified at least one security entity, for the duration of the extended first time interval.

2. The method of claim 1 , further including, confirming an identity of the identified at least one security entity within duration of the extended first time interval, based on an association between a decisive identifier present in the extracted selective information during the extended first time interval and the identified at least one security entity during the extended first time interval; and

associating a first entity identifier to the identified at least one security entity, for the duration of the extended first time interval.

3. The method of claim 2 , further including evaluating another subset of selective information belonging to a second time interval;

assigning a second virtual identifier for the second time interval;

associating the second virtual identifier with the identified at least one security entity; and

confirming the identity of the identified at least one security entity for the second time interval, based on an association between another decisive identifier present in the extracted selective information during the second time interval and the identified at least one security entity; and

associating the first entity identifier to the identified at least one security entity, for the second time interval, when the another decisive identifier present in the second time interval is same as the decisive identifier present in the extended first time interval.

4. The method of claim 3 , wherein the extended first time interval and the second time interval are contiguous.

5. The method of claim 3 , wherein the extended first time interval and the second time interval are separated by one or more additional time intervals.

6. The method of claim 3 , further including associating a second entity identifier to the identified at least one security entity, for the second time interval, when the another decisive identifier present in the second time interval is different than the decisive identifier present in the extended first time interval.

7. The method of claim 6 , further including:

associating an activity identifier for one or more activities occurring within each time intervals for each of the virtual identifiers;

receiving a request to identify attribute associated with a security entity based on its entity identifier;

identifying one or more virtual identifiers associated with the requested entity identifier of the security entity; and

presenting attribute associated with the requested entity identifier, based on the association between the identified one or more virtual identifiers and the activity identifier.

8. The method of claim 1 , further including, confirming an identity of the identified at least one security entity for the first interval, based on an association between a decisive identifier present in the extracted selective information during the extended first time interval and the identified at least one security entity.

9. The method of claim 1 , wherein the security entity is associated with a network address.

10. The method of claim 2 , further including:

associating an activity identifier for one or more activities occurring within each time intervals for the first virtual identifier;

receiving a request to identify attribute associated with the identified at least one security entity, based on the first entity identifier;

identifying the virtual identifier associated with the first entity identifier of the identified at least one security entity; and

presenting attribute associated with the identified at least one security entity based on the association between the identified virtual identifier and the activity identifier.

11. A system to identify a security entity in a computing environment, comprising:

a security appliance configured to

monitor a communication between a user computer and a destination computer;

extract selective information from the communication;

assign a first virtual identifier to a subset of the communication within a first time interval;

extend the first time interval so that the subset of the communication to which the first virtual identifier is assigned applies to a larger portion of the communication;

identify at least one security entity based on a subset of the extracted selective information within a duration of the extended first time interval;

associated one or more of the extracted selective information from the communication within the duration of the extended first time interval to the identified at least one security entity; and

associate the assigned first virtual identifier to the identified at least one security entity, for the duration of the extended first time interval.

12. The system of claim 11 , further including, confirming an identity of the identified at least one security entity within the duration of the extended first time interval, based on an association between a decisive identifier present in the extracted selective information during the extended first time interval and the identified at least one security entity during the extended first time interval; and

associating a first entity identifier to the identified at least one security entity, for the duration of the extended first time interval.

13. The system of claim 12 , wherein another subset of selective information belongs to a second time interval is evaluated;

a second virtual identifier is assigned for the second time interval;

the second virtual identifier is associated with the identified at least one security entity; and

the identity of the identified at least one security entity for the second time interval is confirmed based on an association between another decisive identifier present in the extracted selective information during the second time interval and the identified at least one security entity; and

the first entity identifier is associated with the identified at least one security entity, for the second time interval, when the another decisive identifier present in the second time interval is same as the decisive identifier present in the extended first time interval.

14. The system of claim 13 , wherein the extended first time interval and the second time interval are contiguous.

15. The system of claim 13 , wherein the extended first time interval and the second time interval are separated by one or more additional time intervals.

16. The system of claim 13 , wherein, a second entity identifier is associated with the identified at least one security entity, for the second time interval, when the another decisive identifier present in the second time period is different than the decisive identifier present in the extended first time interval.

17. The system of claim 16 , wherein an activity identifier is associated with one or more activities occurring within each time intervals for each of the virtual identifiers;

a request to identify attribute associated with a security entity based on its entity identifier is received;

one or more virtual identifiers associated with the requested entity identifier of the security entity is identified; and

attribute associated with the requested entity identifier is presented based on the association between the identified one or more virtual identifiers and the activity identifier.

18. The system of claim 11 , wherein an identity of the identified at least one security entity for the first interval is confirmed based on an association between a decisive identifier present in the extracted selective information during the extended first time interval and the identified at least one security entity.

19. The system of claim 11 , wherein the security entity is associated with a network address.

20. The system of claim 12 further including:

an activity identifier for one or more activities occurring within each time intervals is associated with the first virtual identifier;

a request to identify attribute associated with the identified at least one security entity is received, based on the first entity identifier;

the virtual identifier associated with the first entity identifier of the identified at least one security entity is identified; and

attribute associated with the identified at least one security entity is presented based on the association between the identified virtual identifier and the activity identifier.

21. The method of claim 2 , wherein, no other decisive identifier is identified during the duration of the extended first time interval.

22. The system of claim 12 , wherein, no other decisive identifier is identified during the duration of the extended first time interval.