1. A system (100) for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, wherein the system (100) comprises: a server (102) for persistent and explainable attribution of threat actors over a dynamic network infrastructure, wherein the server (102) comprises: one or more processor(s) (104); and a memory (106) operatively coupled to the processors (104), wherein the memory (106) configured to store executable instructions which, when executed by the processors (104), cause the server (102) to: ingest raw network telemetry, comprises IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records; normalize the ingested IP addresses as infrastructure signals rather than identity identifiers, by classifying said IP addresses based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification, thereby forming infrastructure-based IP pool clusters; construct correlated session clusters and behavioral cohorts by analyzing temporal proximity, sequential traversal across adjacent subnets, reuse of shared infrastructure across multiple accounts, and alternation between mobile network endpoints and VPN or VPS endpoints; generate a forensic feature graph, wherein each forensic indicator is represented as an independent graph feature node, and where feature nodes correspond to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of network diversity, and repeatability of infrastructure across accounts; execute graph neural network inference engine (214) over nodes and edges of the forensic feature graph to produce normalized feature activations, in combination with deterministic, rule-bound evaluation logic applied to said feature activations; aggregate the normalized feature activations using predefined weighting parameters stored in the memory (106), to deterministically compute a continuous attribution confidence score representing the likelihood of association with a single threat actor or coordinated entity; resolve and rank suspected entities by mapping the attribution confidence score to a bounded set of candidate users or accounts, and generate a ranked list of suspected entities with descending confidence values; and maintain continuous attribution of threat actors despite reassignment or rotation of IP addresses, by updating graph structures, feature activations, and attribution scores as new network telemetry is ingested.

2. The system (100) as claimed in claim 1, wherein the graph neural network inference engine (214) is configured to perform multi-hop propagation across IP nodes, session clusters, and entity nodes to infer latent relationships.

3. The system (100) as claimed in claim 1, wherein the correlated session clusters and behavioral cohorts are constructed to detect coordinated behavior across multiple user accounts sharing temporally correlated infrastructure usage.

4. The system (100) as claimed in claim 1, wherein the forensic feature graph comprises feature nodes corresponding to IP rotation behavior, mobile network reassignment likelihood, VPN or VPS overlay frequency, and lack of ISP or geographic diversity.

5. The system (100) as claimed in claim 1, wherein the server (102) configured to perform the ingestion, normalization, and aggregation steps in real-time or near real-time to handle high-volume network telemetry.

6. The system (100) as claimed in claim 1, wherein the memory (106) configured to store dynamic graph structures representing IP nodes, infrastructure clusters, session clusters, forensic feature nodes, and entity relationships.

7. The system (100) as claimed in claim 1, further comprising a visualization interface module (220) operatively coupled to the server (102), configured to display entity networks, shared IP infrastructure clusters, feature weights, and ranked suspected threat actors.

8. The system (100) as claimed in claim 1, wherein the server (102) configured to update graph structures, feature activations, and attribution scores automatically as IP addresses are reassigned, rotated, or new IP addresses are observed, to maintain persistent attribution.

9. A computer-implemented method (300) for persistent identification, correlation, and attribution of threat actors operating over dynamically changing network infrastructure, wherein the method (300) comprises the steps of: ingesting (302) raw network telemetry comprises IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records; normalizing (304) the ingested IP addresses as infrastructure signals rather than identity identifiers, by classifying said IP addresses based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification, thereby forming infrastructure-based IP pool clusters; constructing (306) correlated session clusters and behavioral cohorts by analyzing temporal proximity, sequential traversal across adjacent subnets, reuse of shared infrastructure across multiple accounts, and alternation between mobile network endpoints and VPN or VPS endpoints; generating (308) a forensic feature graph, wherein each forensic indicator is represented as an independent graph feature node, and wherein feature nodes correspond to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of network diversity, and repeatability of infrastructure across accounts; executing (310) graph neural network inference engine (214) over nodes and edges of the forensic feature graph to produce normalized feature activations, in combination with deterministic, rule-bound evaluation logic applied to said feature activations; aggregating (312) the normalized feature activations using predefined weighting parameters, to deterministically compute a continuous attribution confidence score representing likelihood of association with a single threat actor or coordinated entity; resolving and ranking (314) suspected entities by mapping the attribution confidence score to a bounded set of candidate users or accounts, and generating a ranked list of suspected entities with descending confidence values; and maintaining (316) continuous attribution of threat actors despite reassignment or rotation of IP addresses, by updating graph structures, feature activations, and attribution scores as new network telemetry is ingested.

10. The method (300) as claimed in claim 9, further comprising: receiving a query specifying an IP address associated with a network event; identifying entities associated with the specified IP address using the infrastructure-based IP pool clusters and session clusters; performing secondary graph neural network inference engine (214) to discover multi-hop linked entities; constructing a relationship subgraph representing connections among the linked entities; and outputting a ranked list of the linked entities based on deterministic relationship strength scores derived from the predefined weighting parameters.

Description:TECHNICAL FIELD
[0001] The present disclosure relates generally to the field of computer-implemented cybersecurity system. More particularly, the disclosure pertains to a system and method for multi-dimensional graph neural network–based IP mapping that enables zeroing down on moving IP targets through associative threat intelligence analysis.

BACKGROUND
[0002] In the field of cybersecurity threat intelligence, identifying, monitoring, and attributing malicious activity relies heavily on IP address analysis, as IP addresses serve as primary network identifiers for users, devices, servers, and communication endpoints. Conventional threat intelligence systems, including IP reputation platforms such as VirusTotal and AbuseIPDB, evaluate whether an IP address has exhibited malicious behavior based on historical reports, blacklists, heuristic scoring, or aggregated reputation data. However, these systems operate unidirectionally, analyzing IP addresses in isolation without establishing associative relationships to discover all entities—such as user accounts, devices, or sessions—associated with a given IP.
[0003] Modern network environments exacerbate this limitation due to dynamic IP allocation through DHCP, carrier-grade NAT (CGNAT), mobile network gateways, cloud-hosted virtual instances, VPN overlays, proxy networks, and virtual private servers (VPS). In such environments, a single IP address may correspond to multiple distinct entities over time, and a single threat actor may utilize multiple IP addresses within short temporal windows. Conventional IP-centric systems are unable to maintain persistent attribution across these dynamically changing addresses, resulting in blind spots where sophisticated adversaries can evade detection.
[0004] Prior art systems have attempted to model network relationships using graph databases or network analysis frameworks. While such systems analyze nodes and edges representing devices, connections, or traffic flows, they generally rely on deterministic traversal and exact-match algorithms optimized for entity-to-IP forward exploration. These approaches do not incorporate probabilistic inference, such as graph neural network (GNN)–based reasoning, and cannot infer latent, multi-hop, or partially overlapping relationships between IP infrastructure and associated entities. Furthermore, existing graph-based systems degrade significantly in performance when scaling to datasets containing millions of nodes and edges, rendering real-time reverse IP-to-entity lookup computationally impractical. Similarly, IP geolocation and attribution services are limited to mapping IP addresses to geographic or ISP metadata, performing single-dimensional analysis without detecting shared infrastructure, multi-actor coordination, or cross-entity relationships.
[0005] As a result, several critical technical problems remain unaddressed in the prior art:
• Absence of Bidirectional Threat Intelligence: Conventional systems cannot efficiently discover all entities associated with a queried IP address or identify all IPs used by a specific entity, preventing comprehensive attribution.
• Inability to Track Moving Targets: Dynamic IP allocation, shared infrastructure usage, and rapid endpoint rotation cause existing systems to lose attribution continuity.
• Lack of Associative Intelligence: There is no mechanism to detect coordinated threat campaigns, identify secondary or mule accounts, infer probabilistic relationships between partially overlapping IP histories, or aggregate multi-hop relational evidence.
• Scalability Constraints: Linear search and forward-only traversal approaches are computationally prohibitive at scale, making real-time analysis of large IP-entity datasets infeasible.
[0006] Accordingly, there exists a technical need for a system capable of addressing these problems by:
• Constructing infrastructure-aware IP-entity interaction graphs;
• Applying graph neural network inference to identify latent associations and multi-hop relationships;
• Enabling reverse IP-to-entity discovery at scale;
• Detecting coordinated threat campaigns through shared infrastructure analysis;
• Maintaining deterministic, explainable, and persistent attribution across dynamic IP reassignments; and
• Delivering real-time, sub-second performance even with millions of IP-entity relationships.
[0007] Therefore, there exists a need for a bidirectional, graph-based threat intelligence framework that overcomes the limitations of traditional IP reputation and graph analysis systems. By combining infrastructure normalization, session correlation, forensic feature graph modeling, graph neural network inference, and weighted aggregation of evidence, the system enables security analysts to detect, track, and attribute threat actors across dynamic network environments in real time, representing a significant advancement over the prior art.

OBJECTS OF THE PRESENT DISCLOSURE
[0008] Some of the objects of the present disclosure, which at least one embodiment herein satisfies, are as listed herein below.
[0009] A general object of the present disclosure is to provide a computer-implemented system for persistent, explainable, and scalable identification, correlation, and attribution of threat actors across dynamic network infrastructures, including shared, reassigned, or rotating IP addresses.
[0010] An object of the present disclosure is to provide a system capable of bidirectional threat intelligence, enabling reverse discovery of all entities associated with a given IP address as well as identification of all IP addresses associated with a specific entity.
[0011] Another object of the present disclosure is to construct infrastructure-aware IP-entity interaction graphs, where IP addresses are treated as dynamic infrastructure signals rather than static identifiers, and relationships between entities, sessions, and network endpoints are modeled as weighted graph edges and nodes.
[0012] Another object of the present disclosure is to employ graph neural network (GNN) inference for probabilistic identification of latent, multi-hop associations between IP addresses and entities.
[0013] Another object of the present disclosure is to maintain persistent attribution of threat actors despite dynamic IP reassignments, endpoint rotation, or use of VPN/proxy infrastructure, ensuring continuous tracking of moving targets across distributed networks.
[0014] Yet another object of the present disclosure is to provide a weighted aggregation framework that deterministically combines normalized feature activations from forensic feature graphs to compute attribution confidence scores, enabling explainable and auditable threat intelligence suitable for compliance and operational decision-making.
[0015] An object of the present disclosure is to provide a visualization interface that presents ranked suspected threat actors, entity networks, shared infrastructure, and attribution scores in an interactive and comprehensible manner for security analysts.

SUMMARY
[0016] The present disclosure relates generally to the field of computer-implemented cybersecurity systems, and more particularly to graph-based threat intelligence platforms for identifying, correlating, and attributing network entities associated with dynamically changing IP address infrastructure. More specifically, the disclosure pertains to a system and method that employs graph neural network–based inference over infrastructure-aware relationship graphs to establish learned associations between IP addresses and network entities. The disclosed technology enables persistent and explainable attribution of threat actors across shared, reassigned, or rotating IP environments, including carrier-grade NAT (CGNAT), mobile gateways, and virtual private network (VPN) or virtual private server (VPS) infrastructure.
[0017] The present disclosure further relates to optimized graph traversal architectures and neural inference mechanisms configured to operate on large-scale datasets comprising millions of IP-to-entity relationships, thereby enabling sub-second query performance and real-time threat intelligence analysis at scale.
[0018] An aspect of the present disclosure provides a system for identifying and tracking network entities associated with IP addresses for a threat intelligence platform. The system includes a server configured for persistent and explainable attribution of threat actors over a dynamic network infrastructure. The server includes one or more processors and a memory operatively coupled to the processors, the memory storing executable instructions which, when executed by the processors, cause the server to ingest raw network telemetry comprising IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records. The server further normalizes the ingested IP addresses as infrastructure signals rather than identity identifiers by classifying the IP addresses based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification to form infrastructure-based IP pool clusters.
[0019] In an embodiment, the server constructs correlated session clusters and behavioral cohorts by analyzing temporal proximity, performing sequential traversal across adjacent subnets, evaluating reuse of shared infrastructure across multiple accounts, and detecting alternation between mobile network endpoints and VPN or VPS endpoints. The server generates a forensic feature graph comprising independent feature nodes corresponding to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of ISP or geographic diversity, and repeatability of infrastructure across accounts. Graph neural network inference is executed over the nodes and edges of the forensic feature graph to produce normalized feature activations, and multi-hop propagation is performed across IP nodes, session clusters, and entity nodes to infer latent relationships. The normalized feature activations are combined with deterministic, rule-bound evaluation logic to support explainable attribution.
[0020] In an embodiment, the server further aggregates the normalized feature activations using predefined weighting parameters to deterministically compute a continuous attribution confidence score representing a likelihood of association with a single threat actor or coordinated entity. Based on the computed score, the server resolves and ranks suspected entities by mapping the attribution confidence score to a bounded set of candidate users or accounts, generating a ranked list of suspected entities with descending confidence values. The ingestion, normalization, and aggregation steps are performed in real-time or near real-time to handle high-volume network telemetry. The memory stores dynamic graph structures representing IP nodes, infrastructure clusters, session clusters, forensic feature nodes, and entity relationships.
[0021] In an embodiment, the system may further include a visualization interface operatively coupled to the server, configured to display entity networks, shared IP infrastructure clusters, feature weights, and ranked suspected threat actors. The server automatically updates graph structures, feature activations, and attribution scores as IP addresses are reassigned, rotated, or newly observed to maintain persistent, high-confidence attribution of threat actors.
[0022] An aspect of the present disclosure pertains to a computer-implemented method for persistent identification, correlation, and attribution of threat actors operating over a dynamically changing network infrastructure. The method includes ingesting raw network telemetry, including IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records, and normalizing the ingested IP addresses as infrastructure signals rather than identity identifiers by classifying each IP based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification to form infrastructure-based IP pool clusters.
[0023] In an embodiment, the method further constructs correlated session clusters and behavioral cohorts by analyzing temporal proximity, performing sequential traversal across adjacent subnets, evaluating reuse of shared infrastructure across multiple accounts, and detecting alternation between mobile network endpoints and VPN or VPS endpoints. A forensic feature graph is generated, in which each forensic indicator is represented as an independent graph feature node, including features corresponding to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of network diversity, and repeatability of infrastructure across accounts.
[0024] In an embodiment, graph neural network inference is executed over the nodes and edges of the forensic feature graph to produce normalized feature activations, combined with deterministic, rule-bound evaluation logic. The normalized feature activations are aggregated using predefined weighting parameters to deterministically compute a continuous attribution confidence score representing a likelihood of association with a single threat actor or coordinated entity. Suspected entities are resolved and ranked by mapping the attribution confidence score to a bounded set of candidate users or accounts, generating a ranked list of suspected entities with descending confidence values. The method maintains continuous attribution of threat actors despite reassignment or rotation of IP addresses by updating graph structures, feature activations, and attribution scores as new network telemetry is ingested.
[0025] In one embodiment, the method further includes receiving a query specifying an IP address associated with a network event, identifying entities associated with the specified IP address using the infrastructure-based IP pool clusters and session clusters, performing secondary graph neural network inference to discover multi-hop linked entities, constructing a relationship subgraph representing connections among the linked entities, and outputting a ranked list of the linked entities based on deterministic relationship strength scores derived from the predefined weighting parameters.
[0026] Various objects, features, aspects, and advantages of the inventive subject matter will become more apparent from the following detailed description of preferred embodiments, along with the accompanying drawing figures in which like numerals represent components. 
BRIEF DESCRIPTION OF DRAWINGS
[0027] The accompanying drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification. The drawings illustrate exemplary embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure. The diagrams are for illustration only, which is not a limitation of the present disclosure.
[0028] FIG. 1 illustrates an exemplary block diagram of the proposed system for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0029] FIG. 1A illustrates an exemplary multi-layer graph-based threat attribution architecture, in accordance with some embodiments of the present disclosure.
[0030] FIG. 1B illustrates an exemplary detailed logical flow diagram showing the weighted aggregation mechanism, in accordance with some embodiments of the present disclosure.
[0031] FIG. 1C illustrates an exemplary functional block diagram of a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0032] FIG. 2 illustrates an exemplary module diagram of the system for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0033] FIG. 3 illustrates an exemplary flow diagram of a method for persistent identification, correlation, and attribution of threat actors operating over dynamically changing network infrastructure, in accordance with some embodiments of the present disclosure.

DETAILED DESCRIPTION OF THE PRESENT DISCLOSURE
[0034] The following is a detailed description of embodiments of the disclosure represented in the accompanying drawings. The disclosed embodiments are merely exemplary of the invention, which may be embodied in various forms. The embodiments are in such detail as to clearly communicate the disclosure. However, the amount of detail offered is not intended to limit the anticipated variations of embodiments; on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present disclosure as defined by the appended claims.
[0035] The present disclosure enables a computer-implemented system and method for persistent identification, correlation, and attribution of threat actors across dynamically changing network infrastructure, including shared mobile gateways, CGNAT, and VPN or VPS environments. The system ingests raw network telemetry such as IP addresses from logs, authentication attempts, API calls, and network events, and normalizes these IPs as infrastructure signals rather than fixed identifiers by classifying them based on ASN, CGNAT association, mobile gateway attribution, CIDR adjacency, subnet proximity, and infrastructure type. Correlated session clusters and behavioral cohorts are constructed to capture temporal and multi-account patterns, which are then represented in a forensic feature graph with independent nodes corresponding to features like IP rotation, mobile reassignment, VPN/VPS usage, and infrastructure clustering strength. Graph neural network inference over the graph produces normalized feature activations and infers multi-hop relationships, which are aggregated deterministically to compute an attribution confidence score. The system resolves and ranks suspected entities, maintains continuous attribution as IPs change, and optionally provides a visualization interface for real-time threat intelligence, thereby enabling high-confidence, scalable, and explainable threat actor tracking where traditional IP-based systems fail.
[0036] The manner, in which the proposed system works, is described in further details in conjunction with FIGs. 1 to 3. It may be noted that these figures are only illustrative, and should not be construed to limit the scope of the subject matter in any manner.
[0037] FIG. 1 illustrates an exemplary block diagram of the proposed system for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0038] In an embodiment, referring to FIG. 1, the system 100 employs a graph neural network–driven relationship inference engine that establishes learned graph-based associations between network entities and their IP address histories. By implementing a deterministic matching algorithm for IP-to-entity mapping, the system can identify all linked entities sharing common IP infrastructure, even when IP addresses change dynamically. The system 100 utilizes learned graph embeddings and neural message-passing mechanisms to perform real-time graph neural network IP lookups, enabling security analysts to trace threat actors across their entire IP footprint.
[0039] In an embodiment, the system 100 includes a server 102, which serves as the central computing unit for performing persistent identification, correlation, and attribution of threat actors over a dynamically changing network infrastructure. The server 102 provides the computational and storage framework required to ingest network telemetry, manage graph structures, execute graph neural network inference, perform multi-layered aggregation, and generate ranked threat actor outputs in real time. The server 102 also coordinates interactions with optional visualization interfaces, external databases, and other system modules, ensuring that all components operate cohesively within the threat intelligence platform.
[0040] In an embodiment, the server 102 includes one or more processors 104 (interchangeably referred to as processors 104, hereinafter), which execute the instructions stored in the memory 106 to perform the system’s core functions. The processors 104 handle complex computations such as normalization of IP addresses, construction of session clusters and behavioral cohorts, generation of forensic feature graphs, graph neural network inference, multi-hop relationship propagation, and deterministic aggregation of feature activations to compute attribution confidence scores. The processors 104 are capable of parallel processing and multi-threaded execution to enable real-time analysis over large-scale network telemetry and IP-entity datasets, ensuring high-performance and scalable threat intelligence computation.
[0041] In an embodiment, the system 100 further includes a memory 106 operatively coupled to the processors 104, configured to store executable instructions and dynamic data structures required for system operation. The memory 106 maintains infrastructure-based IP pool clusters, correlated session clusters, forensic feature graphs, normalized feature activations, and weighted aggregation parameters. It also stores historical IP-entity relationships and continuously updates graph structures and feature activations as new network telemetry is ingested or IP addresses are reassigned or rotated. The memory 106 ensures that the processors 104 have rapid access to the data necessary for multi-hop inference, real-time ranking of suspected threat actors, and persistent attribution, supporting both high-speed computation and deterministic, explainable decision-making.
[0042] In an embodiment, at a high level, the system 100 employs a multi-layered correlation architecture for threat actor attribution, rather than relying on individual IP addresses as fixed identifiers. In this architecture, IP addresses are treated as dynamic infrastructure signals that provide contextual information about network activity rather than direct identity markers. Network sessions are abstracted into behavioral cohorts, capturing temporal and structural patterns of activity across multiple IPs and accounts. Forensic indicators, such as IP rotation behavior, mobile reassignment likelihood, and VPN or VPS usage, are represented as independent graph feature nodes, enabling parallel analysis and cross-feature reinforcement. Attribution of threat actors is achieved through a weighted aggregation of evidence derived from these features, producing deterministic confidence scores that reflect the likelihood of association with a particular entity or coordinated group.
[0043] Furthermore, this layered decomposition allows persistent tracking of actors across moving or shared network targets, a capability not achievable with conventional IP-centric or static rule-based systems. In one embodiment, graph neural networks are employed to infer latent, multi-hop relationships within the correlation graph, while final attribution decisions are enforced through deterministic, rule-bound evaluation logic to ensure that results are both explainable and repeatable, and provide reliable threat intelligence even in highly dynamic network environments.
[0044] FIG. 1A illustrates an exemplary multi-layer graph-based threat attribution architecture, in accordance with some embodiments of the present disclosure.
[0045] In an embodiment, referring to FIG. 1A, the present disclosure implements a multi-layer graph-based threat attribution architecture 100A, designed for persistent identification, correlation, and attribution of threat actors across dynamically changing network infrastructures, including mobile gateways, carrier-grade NAT (CGNAT), VPNs, and VPS blocks. The process begins with an inbound network signal normalization layer 102A, where raw network telemetry, including IP addresses from access logs, authentication attempts, API calls, and other network events, is ingested and normalized. IPs are grouped into infrastructure-aware clusters based on Autonomous System Number (ASN), CIDR adjacency, subnet proximity, CGNAT or mobile gateway classification, and residential versus hosting or VPN/VPS categorization, forming inbound IP pool clusters. In this layer 102A, IPs are treated as infrastructure signals rather than fixed identities, decoupling identity from IP.
[0046] In an embodiment, the data then flows into a correlated session and behavioral cohort layer 104A, which analyzes temporal and behavioral relationships between normalized IP nodes. IPs are grouped into session clusters, represented as graph super-nodes capturing behavioral cohorts such as CGNAT reassignment clusters, sequential IP hopping, mobile reassignment, and VPN overlay clusters. This abstraction enables reasoning about patterns of activity rather than isolated events, effectively identifying coordinated usage of shared infrastructure.
[0047] In an embodiment, in a forensic feature graph layer 106A, session clusters feed into a multi-dimensional graph of independent feature nodes. Key forensic features include IP block clustering strength, sequential IP rotation behavior, mobile network reassignment likelihood, and VPN or VPS overlay frequency, lack of ISP or geographic diversity, and repeatability of infrastructure across accounts. Each feature produces a normalized activation value through graph neural network inference, enabling multi-hop propagation across IP nodes, session clusters, and entity nodes to uncover latent relationships. In FIG. 1A, features are shown with associated weights (e.g., 0.30 for IP block clustering, 0.25 for sequential rotation, and 0.15 for mobile reassignment), reflecting their relative importance in attribution.
[0048] In an embodiment, these outputs are then processed by a weighted attribution aggregation layer 108A, which deterministically computes a continuous attribution confidence score by applying predefined weighting parameters to the normalized feature activations, producing a scalar score representing the likelihood of association with a single threat actor or coordinated entity. In the depicted example, weighted aggregation yields an aggregated attribution score of approximately 0.95, demonstrating high-confidence inference.
[0049] In an embodiment, a threat actor resolution and ranking layer 110A maps the aggregated attribution score to a bounded set of candidate entities, producing a ranked list of suspected users with attention-weighted confidence values. As shown in FIG. 1A, the system 100A identifies the primary threat actor with the highest confidence (0.95), followed by secondary accounts with descending likelihoods (e.g., 0.20 for User 2 down to 0.03 for User 8). This comprehensive architecture allows persistent, explainable attribution across moving network targets, detection of coordinated campaigns, and identification of secondary or mule accounts, while maintaining real-time performance even as the underlying IP infrastructure continuously evolves.
[0050] FIG. 1B illustrates an exemplary detailed logical flow diagram showing the weighted aggregation mechanism, in accordance with some embodiments of the present disclosure.
[0051] In an embodiment, referring to FIG. 1B, a multi-layer graph-based threat attribution architecture 100B designed for the persistent identification, correlation, and ranking of threat actors operating across dynamic network infrastructures, as depicted in FIG. 1B. The process begins with Layer 1: inbound network signal normalization, where raw network telemetry—including IP addresses from access logs, API calls, authentication attempts, and other events—is ingested. Rather than treating IPs as static identifiers, the system performs infrastructure-aware normalization, grouping IPs into Inbound IP Pool Clusters based on autonomous system numbers (ASN), CGNAT or mobile gateway classification, CIDR adjacency, and subnet proximity. Each IP is treated as a dynamic infrastructure signal, decoupled from fixed identity, and enriched with metadata describing its origin (e.g., residential, hosting, VPN, or VPS).
[0052] In an embodiment, the normalized signals are then processed in Layer 2: correlated session and behavioral cohort mapping, where temporal and behavioral patterns are identified. IPs are aggregated into Session Clusters (labeled A, B, and C in FIG. 1C) representing behavioral cohorts such as mobile IP reassignments within the same ASN, sequential IP hopping patterns, and VPN overlay activity. These clusters function as intermediate graph super-nodes, allowing the system to reason about patterns of movement and infrastructure reuse rather than isolated IP events.
[0053] In an embodiment, in Layer 3: forensic feature graph analysis, each session cluster is transformed into a multi-dimensional forensic feature graph. Each behavioral or infrastructural signal is modeled as an independent graph feature node, enabling parallel computation and cross-feature reinforcement. Representative features include IP Block Clustering (weighted 0.30), Sequential Rotation Behavior (0.25), and Mobile Network Reassignment (0.15), with each node producing a normalized activation value derived through graph neural network (GNN) inference over node and edge embeddings combined with deterministic, rule-bound evaluation logic.
[0054] In an embodiment, the Layer 4: weighted attribution aggregation engine fuses these activations by applying a configurable weighting schema to compute a continuous attribution confidence score, deterministically converting multi-dimensional graph evidence into a scalar signal. As illustrated in FIG. 1B, weighted feature scores are aggregated to produce an Aggregated Attribution score of approximately 0.95, representing high-confidence attribution.
[0055] In an embodiment, the Layer 5: threat actor resolution and ranking maps the aggregated attribution signal to a bounded set of candidate entities, generating a descending-ranked list of Suspected Users. The system 100B assigns the primary threat actor the highest confidence (e.g., 0.95 for User 1), while secondary or mule accounts are scored lower (e.g., 0.20 for User 2, 0.15 for User 3), enabling persistent tracking even as IPs rotate across mobile, VPN, or CGNAT infrastructure.
[0056] In an embodiment, working example 1 demonstrates a moving IP threat actor performing malicious actions across mobile and VPN networks. IPs are clustered into mobile gateway and VPN pools, sequential IP hopping forms session clusters, forensic features activate for rotation and VPN overlay, and deterministic weighted aggregation produces a high attribution score, allowing identification of the primary actor and linked accounts despite dynamic IP changes. Working Example 2 illustrates coordinated multi-account activity, where seemingly benign accounts share infrastructure. Session clustering, feature activation for repeatability and lack of diversity, and weighted aggregation reveal coordinated behavior, enabling the discovery of hidden threat actor networks.
[0057] FIG. 1C illustrates an exemplary functional block diagram of a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0058] In an embodiment, referring to FIG. 1C, the system 100C is a functional block diagram of the threat intelligence platform 100C, highlighting the Graph Neural Network (GNN) Mapping Engine core, which comprises the GNN Inference Layer, the Graph Relationship Builder, and the Deterministic Attribution Engine for rule-bound evidence aggregation. The present disclosure includes a multi-layer graph-based attribution architecture designed to transform volatile network signals into stable behavioral intelligence across five distinct functional layers.
[0059] As illustrated in the high-level system FIG. 1C, the process begins with the inbound IP Pool Clustering Layer 102A, which ingests raw network telemetry, such as Mobile Gateway IPs and VPN/VPS blocks, and normalizes them into infrastructure-aware clusters based on metadata like ASN, CIDR adjacency, or residential vs. hosting classification. By treating IP addresses as dynamic infrastructure signals rather than fixed identity identifiers, the system 100C effectively decouples identity from specific IP addresses.
[0060] In an embodiment, the normalized data flows into the Correlated Sessions / Activity Layer, where temporal and behavioral relationships are mapped to form session clusters (e.g., Session Clusters A, B, and C). These clusters function as graph super-nodes representing behavioral cohorts such as CGNAT reassignments, sequential IP hopping, or VPN overlay patterns. Following this, the forensic feature analysis layer 106A evaluates these clusters against independent forensic feature nodes, such as IP Block Clustering, Sequential Rotation Behavior, and Mobile Network Reassignment, using a Graph Neural Network (GNN) mapping engine to generate specific activation values derived from node and edge embeddings.
[0061] In an embodiment, as depicted in the detailed flow and architectural FIG. 1C, the forensic activations are processed by a weighted aggregation engine. This engine applies a deterministic, rule-bound weighting schema (e.g., assigning a weight of 0.30 to IP Block Clustering or 0.25 to Sequential Rotation) to the GNN-derived scores to compute a continuous Aggregated Attribution confidence signal. Finally, the threat actor resolution and ranking layer 110A maps this scalar signal to a bounded set of Suspected Users. Rather than a binary result, the system outputs a ranked list of candidate entities with attention-weighted confidence scores (e.g., User 1 at 0.95), enabling the identification of primary threat actors and linked mule accounts even as their underlying network infrastructure continuously changes.
[0062] FIG. 2 illustrates an exemplary module diagram of the system for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, in accordance with some embodiments of the present disclosure.
[0063] In an exemplary embodiment, referring to FIG. 2, the architecture of the proposed system 200 may include a processor 104. The processor 104 may be implemented as one or more microprocessors, microcomputers, microcontrollers, edge or fog microcontrollers, digital signal processors, central processing units, logic circuitries, and/or any devices that process data based on operational instructions. Among other capabilities, the processor 104 may be configured to fetch and execute computer-readable instructions stored in a memory 106 of the system 200. The memory 106 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which can be fetched and executed to process data locally and/or create or share data packets over a network service. The memory 106 may include any non-transitory storage device, such as volatile memory (e.g., Random Access Memory (RAM)) or non-volatile memory (e.g., Erasable Programmable Read-Only Memory (EPROM), flash memory).
[0064] In an embodiment, the system 200 further includes one or more interfaces 208 operatively coupled to the server 102 and processors 104, configured to enable communication between the threat attribution platform and external systems, data sources, and user environments. The interfaces 208 may include network interfaces, application programming interfaces (APIs), data ingestion interfaces, and user interaction interfaces, facilitating the receipt of raw network telemetry such as IP logs, authentication records, and event streams from external databases, security information and event management (SIEM) systems, firewalls, or cloud services.
[0065] In addition, the interfaces 208 support outbound communication for transmitting attribution results, ranked suspected user lists, confidence scores, and graph visualizations to analyst dashboards or downstream security orchestration systems. The interfaces 208 may operate over wired or wireless communication protocols and support real-time, batch, or streaming data exchange. By enabling secure, high-throughput data transfer and interactive visualization, the interfaces 208 ensure seamless integration of the multi-layer graph-based attribution architecture within existing enterprise cybersecurity ecosystems.
[0066] In an exemplary embodiment, the processing unit/engine(s) 210 may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processing engine(s) 210. In examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processing engine(s) 210 may be processor-executable instructions stored on a non-transitory machine-readable storage medium, and the hardware for the processing engine(s) 210 may include a processing resource (for example, one or more processors) to execute such instructions.
[0067] In the present examples, the machine-readable storage medium may store instructions that, when executed by the processing resource, implement the processing engine(s) 210. In such examples, the system 200 may include the machine-readable storage medium storing the instructions and the processing resource to execute the instructions, or the machine-readable storage medium may be separate but accessible to the system 200 and the processing resource. In other examples, the processing engine(s) 210 may be implemented by electronic circuitry.
[0068] In an exemplary embodiment, the system 200 further includes one or more databases 208 operatively coupled to the server 102 and processors 104, configured to store, manage, and retrieve structured and unstructured data required for persistent threat attribution. The databases 208 maintain raw network telemetry, including IP addresses, access logs, authentication attempts, API call records, and session metadata, as well as derived data structures such as inbound IP pool clusters, correlated session clusters, behavioral cohorts, and forensic feature graphs. In addition, the database 208 stores graph embeddings, normalized feature activations, predefined weighting parameters, attribution confidence scores, and ranked suspected user records.
[0069] Furthermore, the databases 208 may include relational databases, graph databases, distributed storage systems, or hybrid architectures optimized for large-scale, low-latency graph traversal and multi-hop inference. By enabling efficient indexing, historical retention, and real-time updates of IP-entity relationships, the databases 208 support scalable processing of millions of records while maintaining deterministic, explainable attribution outputs across dynamically evolving network infrastructures.
[0070] In an exemplary embodiment, the processing engine 210 may include one or more engines selected from any of a graph database module 212, a graph neural network inference engine 214, an associative analysis module 216, a threat intelligence correlation engine 218, and a visualization interface module 220, each operatively configured to cooperatively process normalized network telemetry, construct and analyze multi-layer graph structures, perform graph-based inference and deterministic aggregation, compute attribution confidence scores, resolve and rank suspected threat actors, and generate explainable visualization outputs for real-time threat intelligence analysis.
[0071] In an exemplary embodiment, the graph database module 212 functions as a specialized software component within the processing engine 210 for storing, managing, and querying complex relational data. This module 212 represents IP addresses, network infrastructure clusters, session cohorts, forensic feature nodes, and associated entities as nodes and edges in a dynamic graph structure, allowing the system 100 to capture both direct and indirect relationships across the network. The graph database module 212 is designed to support efficient multi-hop traversals, subgraph extraction, and updates as new network telemetry is received, ensuring that IP-to-entity associations remain current even in dynamic environments with frequently changing IP addresses.
[0072] Furthermore, the module 212 also provides indexing and optimized storage of node and edge metadata, such as ASN, CIDR ranges, CGNAT classification, VPN or VPS association, and behavioral correlations across accounts. By maintaining these structured graphs, the graph database module 212 enables rapid execution of graph neural network inference, facilitates deterministic aggregation of forensic feature activations, and allows real-time, explainable attribution of threat actors over large-scale, complex network datasets.
[0073] In an embodiment, the graph neural network inference engine 214 is configured to analyze the structured graph data stored in the graph database module 212 and infer IP-to-entity associations through learned graph embeddings. This engine 214 leverages the relational structure of the graph, including nodes representing IP addresses, session clusters, and entities, as well as edges capturing temporal, behavioral, and infrastructural relationships, to identify latent connections that are not immediately apparent from raw network telemetry.
[0074] Furthermore, by propagating feature activations across multiple hops in the graph, the engine 214 can detect patterns such as IP rotation, mobile reassignment, VPN or VPS overlay usage, and repeated infrastructure reuse. These learned embeddings are then combined with deterministic, rule-bound evaluation logic to generate attribution signals that quantify the likelihood of association between network activity and specific threat actors or coordinated entities. The graph neural network inference engine 214 thus enables scalable, real-time, and explainable threat attribution, even across dynamically changing network infrastructures.
[0075] In an embodiment, the associative analysis module 216 is configured to construct detailed relationship graphs by analyzing shared IP infrastructure among network entities. This module 216 examines connections between IP addresses, session clusters, and associated accounts to identify overlapping infrastructure usage, such as common VPNs, mobile gateways, or hosting subnets. By correlating these shared resources across multiple entities, the associative analysis module 216 can reveal coordinated behavior, multi-actor campaigns, or indirect associations that are not evident from individual IP observations.
[0076] Furthermore, the resulting relationship graphs serve as an intermediate layer of intelligence, capturing the multi-hop connections and structural patterns within the network, which can then be used by the graph neural network inference engine 214 or threat intelligence correlation engine to generate deterministic attribution scores. This module 216 thus enhances the system’s ability to uncover latent associations and provides a foundation for persistent and explainable threat actor identification.
[0077] In an embodiment, the threat intelligence correlation engine 218 is configured to correlate entity attributes, risk scores, and behavioral patterns with IP relationships to provide comprehensive threat insights. This engine 218 integrates data from the graph database module 212, the associative analysis module 216, and the graph neural network inference engine 214 to evaluate the likelihood that a particular entity is associated with malicious activity. By combining temporal activity patterns, shared infrastructure usage, historical risk scores, and behavioral anomalies.
[0078] Furthermore, the threat intelligence correlation engine 218 generates a holistic view of potential threat actors. It produces deterministic attribution scores that quantify the confidence of association between entities and suspicious IPs, enabling accurate ranking of suspected users. The engine 218 ensures that correlations are both explainable and actionable, supporting real-time threat detection, persistent tracking of moving targets, and identification of coordinated attack campaigns across dynamic network infrastructures.
[0079] In an embodiment, the visualization interface module 220 is configured to graphically present complex threat intelligence data intuitively and interactively. This module 220 displays entity networks, illustrating connections between users, devices, or accounts based on shared IP infrastructure and correlated behaviors. It visually represents forensic feature activations, IP clusters, session clusters, and weighted attribution scores, allowing security analysts to quickly identify primary threat actors, secondary accounts, and potential coordinated campaigns.
[0080] Furthermore, the visualization interface module 220 supports real-time updates, enabling users to observe changes in network relationships as new telemetry is ingested or IP addresses rotate. By providing a clear, layered representation of IP-entity associations and threat intelligence indicators, this module 220 enhances explainability, facilitates decision-making, and allows actionable insights to be derived from the underlying graph-based analyses.
[0081] FIG. 3 illustrates an exemplary flow diagram of a method for persistent identification, correlation, and attribution of threat actors operating over dynamically changing network infrastructure, in accordance with some embodiments of the present disclosure.
[0082] In an embodiment, referring to FIG. 3, a computer-implemented method 300 (interchangeably referred to as a method 300, hereinafter) for persistent identification, correlation, and attribution of threat actors operating over a dynamically changing network infrastructure, where at step 302, the method 300 involves collecting IP addresses and associated data from diverse network sources. These sources include access logs recording user or device connections, authentication attempts capturing login or credential usage events, application programming interface (API) calls indicating interactions between software components, and various other network event records generated by servers, firewalls, or security appliances. During this step 302, the method 300 organizes and preprocesses the incoming telemetry to ensure completeness and consistency, transforming the raw inputs into a structured format suitable for subsequent analysis. By aggregating telemetry from multiple sources, the system 100 establishes a comprehensive dataset of IP activity, forming the foundational input for downstream normalization, clustering, and threat attribution processes.
[0083] In an embodiment, at step 304, the method 300 includes classifying each collected IP address according to its network and infrastructural characteristics, including autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and the type of infrastructure, such as residential, hosting, VPN, or VPS environments. By performing this classification, the method 300 abstracts away the notion of IPs as fixed identifiers tied to specific users, instead treating them as dynamic infrastructure signals. The normalized IPs are then organized into infrastructure-based IP pool clusters, which group IP addresses sharing common network characteristics. This normalization enables the system 100 to reason about IP behavior at a structural level, supporting multi-entity analysis and robust attribution even in environments with dynamic or shared IP usage.
[0084] In an embodiment, at step 306, the method 300 includes analyzing the normalized IP pool clusters to identify temporal and behavioral relationships among network events. Specifically, the method 300 examines temporal proximity, grouping IP activities that occur within similar timeframes; sequential traversal across adjacent subnets, detecting patterns where entities move through related network segments; reuse of shared infrastructure across multiple accounts, highlighting instances where the same network resources are utilized by different users; and alternation between mobile network endpoints and VPN or VPS endpoints, capturing behaviors indicative of endpoint switching to obscure identity.
[0085] Furthermore, by systematically combining these behavioral and temporal patterns, the method 300 forms session clusters that represent coherent user activity and aggregates them into behavioral cohorts, which function as intermediate graph nodes. These clusters allow the system 100 to interpret complex patterns of entity behavior over dynamic network infrastructure, enabling downstream forensic analysis and attribution even in scenarios with IP rotation, shared infrastructure, or multi-actor coordination.
[0086] In an embodiment, at step 308, the method 300 further includes generating a forensic feature graph, in which each forensic indicator is modeled as an independent graph feature node. The method 300 maps each session cluster and behavioral cohort into this graph structure, allowing parallel representation and analysis of multiple behavioral and infrastructural characteristics. Each feature node corresponds to a distinct aspect of network activity or infrastructure usage, including infrastructure clustering strength (indicating how tightly an entity is associated with specific network blocks), IP rotation behavior (capturing how frequently IP addresses change), mobile reassignment likelihood (estimating the probability of a device switching mobile network endpoints), VPN or VPS overlay frequency (tracking use of obfuscating network tunnels), lack of network diversity (highlighting repeated use of similar network infrastructure), and repeatability of infrastructure across accounts (identifying shared network resources among multiple entities).
[0087] Furthermore, by constructing this structured feature graph, the method 300 enables multi-dimensional analysis of entity behavior, allowing downstream graph neural network inference to detect latent relationships and produce accurate, persistent attribution signals, even in the presence of dynamic or shared network infrastructure.
[0088] In an embodiment, at step 310, the method 300 includes executing graph neural network (GNN) inference over the nodes and edges of the forensic feature graph, where each node represents a distinct forensic indicator and edges encode relationships between session clusters, behavioral cohorts, and infrastructure signals. The GNN propagates information across the graph, performing multi-hop aggregation to capture latent associations and interdependencies among IP addresses, entities, and network features.
[0089] Furthermore, this process 300 generates normalized feature activations, which quantitatively represent the strength, relevance, or likelihood of each forensic indicator in relation to potential threat actor behavior. Concurrently, the method 300 applies deterministic, rule-bound evaluation logic to these activations, ensuring that outputs are interpretable and consistent. This combination of learned inference through the GNN and deterministic evaluation allows the system to produce robust, explainable signals that can be used for subsequent aggregation into attribution scores, maintaining high fidelity in identifying and tracking entities across dynamically changing network infrastructure.
[0090] In an embodiment, at step 312, the method 300 includes aggregating the normalized feature activations produced by a graph neural network inference engine 214 by applying predefined weighting parameters to each feature node, reflecting the relative importance or reliability of the corresponding forensic indicator. The weighted activations are combined deterministically to generate a continuous attribution confidence score, which quantifies the likelihood that a specific entity, or a set of coordinated entities, is associated with observed network activity.
[0091] Furthermore, this deterministic aggregation ensures that the resulting confidence score is explainable and reproducible, providing a scalar measure of the strength of the inferred association among IP addresses, infrastructure signals, and potential threat actors. By systematically integrating multi-dimensional forensic evidence, this step 312 transforms complex graph-based feature activations into a single, actionable score suitable for ranking and decision-making in threat intelligence analysis.
[0092] In an embodiment, at step 314, the method 300 includes resolving and ranking suspected entities by first mapping the computed attribution confidence score to a bounded set of candidate users or accounts identified from the network telemetry and graph analysis. The system 100 then generates a ranked list of suspected entities, ordering them in descending confidence, so that entities with the highest likelihood of association with the observed network activity appear first. This ranking enables security analysts to prioritize investigation, identify the primary threat actors, and detect secondary or coordinated accounts, while ensuring that the ordering is deterministic, reproducible, and based on weighted, multi-dimensional forensic evidence derived from the preceding graph neural network inference engine 214 and feature aggregation steps.
[0093] In an embodiment, at step 316, the method 300 involves maintaining continuous attribution of threat actors by dynamically updating graph structures, feature activations, and attribution scores as new network telemetry is ingested. This process 300 ensures that the association between entities and IP addresses remains current even when IP addresses are reassigned, rotated, or transiently allocated across mobile gateways, CGNAT, VPNs, or VPS infrastructure. By continuously incorporating new telemetry, recalculating feature activations through graph neural network inference, and deterministically adjusting attribution scores, the system 100 provides persistent tracking of threat actors, preserves historical correlations, and ensures that security analysts have an up-to-date, reliable, and explainable view of evolving threat networks, despite the dynamic nature of network infrastructure.
[0094] In summary, the present disclosure provides a system and method for persistent identification and attribution of threat actors across dynamic IP infrastructures. Unlike traditional IP-centric systems, it uses graph neural networks to map IP addresses to all associated entities, enabling bidirectional, multi-hop inference. The system clusters IPs, forms session and behavioral cohorts, analyzes forensic features, and aggregates weighted evidence to produce a continuous attribution score, allowing real-time tracking of threat actors even as IPs change. This approach delivers persistent attribution, detection of coordinated campaigns, scalable real-time performance, and comprehensive visibility into complex threat networks.
[0095] If the specification states a component or feature “may”, “can”, “could”, or “might” be included or have a characteristic, that particular component or feature is not required to be included or have the characteristic.
[0096] As used in the description herein and throughout the claims that follow, the meaning of “a,” “an,” and “the” includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein, the meaning of “in” includes “in” and “on” unless the context clearly dictates otherwise.
[0097] Moreover, in interpreting the specification, all terms should be interpreted in the broadest possible manner consistent with the context. In particular, the terms “comprises” and “comprising” should be interpreted as referring to elements, components, or steps in a non-exclusive manner, indicating that the referenced elements, components, or steps may be present, or utilized, or combined with other elements, components, or steps that are not expressly referenced. Where the specification claims refer to at least one of something selected from the group consisting of A, B, C….and N, the text should be interpreted as requiring only one element from the group, not A plus N, or B plus N, etc.
[0098] While the foregoing describes various embodiments of the disclosure, other and further embodiments of the disclosure may be devised without departing from the basic scope thereof. The scope of the disclosure is determined by the claims that follow. The disclosure is not limited to the described embodiments, versions or examples, which are included to enable those having ordinary skill in the art to make and use the disclosure when combined with information and knowledge available to those having ordinary skill in the art. , Claims:1. A system (100) for identifying and tracking network entities associated with IP addresses for a threat intelligence platform, wherein the system (100) comprises:
a server (102) for persistent and explainable attribution of threat actors over a dynamic network infrastructure, wherein the server (102) comprises:
one or more processor(s) (104); and
a memory (106) operatively coupled to the processors (104), wherein the memory (106) configured to store executable instructions which, when executed by the processors (104), cause the server (102) to:
ingest raw network telemetry, comprises IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records;
normalize the ingested IP addresses as infrastructure signals rather than identity identifiers, by classifying said IP addresses based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification, thereby forming infrastructure-based IP pool clusters;
construct correlated session clusters and behavioral cohorts by analyzing temporal proximity, sequential traversal across adjacent subnets, reuse of shared infrastructure across multiple accounts, and alternation between mobile network endpoints and VPN or VPS endpoints;
generate a forensic feature graph, wherein each forensic indicator is represented as an independent graph feature node, and where feature nodes correspond to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of network diversity, and repeatability of infrastructure across accounts;
execute graph neural network inference engine (214) over nodes and edges of the forensic feature graph to produce normalized feature activations, in combination with deterministic, rule-bound evaluation logic applied to said feature activations;
aggregate the normalized feature activations using predefined weighting parameters stored in the memory (106), to deterministically compute a continuous attribution confidence score representing the likelihood of association with a single threat actor or coordinated entity;
resolve and rank suspected entities by mapping the attribution confidence score to a bounded set of candidate users or accounts, and generate a ranked list of suspected entities with descending confidence values; and
maintain continuous attribution of threat actors despite reassignment or rotation of IP addresses, by updating graph structures, feature activations, and attribution scores as new network telemetry is ingested.
2. The system (100) as claimed in claim 1, wherein the graph neural network inference engine (214) is configured to perform multi-hop propagation across IP nodes, session clusters, and entity nodes to infer latent relationships.
3. The system (100) as claimed in claim 1, wherein the correlated session clusters and behavioral cohorts are constructed to detect coordinated behavior across multiple user accounts sharing temporally correlated infrastructure usage.
4. The system (100) as claimed in claim 1, wherein the forensic feature graph comprises feature nodes corresponding to IP rotation behavior, mobile network reassignment likelihood, VPN or VPS overlay frequency, and lack of ISP or geographic diversity.
5. The system (100) as claimed in claim 1, wherein the server (102) configured to perform the ingestion, normalization, and aggregation steps in real-time or near real-time to handle high-volume network telemetry.
6. The system (100) as claimed in claim 1, wherein the memory (106) configured to store dynamic graph structures representing IP nodes, infrastructure clusters, session clusters, forensic feature nodes, and entity relationships.
7. The system (100) as claimed in claim 1, further comprising a visualization interface module (220) operatively coupled to the server (102), configured to display entity networks, shared IP infrastructure clusters, feature weights, and ranked suspected threat actors.
8. The system (100) as claimed in claim 1, wherein the server (102) configured to update graph structures, feature activations, and attribution scores automatically as IP addresses are reassigned, rotated, or new IP addresses are observed, to maintain persistent attribution.
9. A computer-implemented method (300) for persistent identification, correlation, and attribution of threat actors operating over dynamically changing network infrastructure, wherein the method (300) comprises the steps of:
ingesting (302) raw network telemetry comprises IP addresses obtained from access logs, authentication attempts, application programming interface calls, and network event records;
normalizing (304) the ingested IP addresses as infrastructure signals rather than identity identifiers, by classifying said IP addresses based on autonomous system number (ASN), carrier-grade NAT (CGNAT) association, mobile gateway attribution, CIDR adjacency, subnet proximity, and residential, hosting, VPN, or VPS infrastructure classification, thereby forming infrastructure-based IP pool clusters;
constructing (306) correlated session clusters and behavioral cohorts by analyzing temporal proximity, sequential traversal across adjacent subnets, reuse of shared infrastructure across multiple accounts, and alternation between mobile network endpoints and VPN or VPS endpoints;
generating (308) a forensic feature graph, wherein each forensic indicator is represented as an independent graph feature node, and wherein feature nodes correspond to infrastructure clustering strength, IP rotation behavior, mobile reassignment likelihood, VPN or VPS overlay frequency, lack of network diversity, and repeatability of infrastructure across accounts;
executing (310) graph neural network inference engine (214) over nodes and edges of the forensic feature graph to produce normalized feature activations, in combination with deterministic, rule-bound evaluation logic applied to said feature activations;
aggregating (312) the normalized feature activations using predefined weighting parameters, to deterministically compute a continuous attribution confidence score representing likelihood of association with a single threat actor or coordinated entity;
resolving and ranking (314) suspected entities by mapping the attribution confidence score to a bounded set of candidate users or accounts, and generating a ranked list of suspected entities with descending confidence values; and
maintaining (316) continuous attribution of threat actors despite reassignment or rotation of IP addresses, by updating graph structures, feature activations, and attribution scores as new network telemetry is ingested.
10. The method (300) as claimed in claim 9, further comprising:
receiving a query specifying an IP address associated with a network event;
identifying entities associated with the specified IP address using the infrastructure-based IP pool clusters and session clusters;
performing secondary graph neural network inference engine (214) to discover multi-hop linked entities;
constructing a relationship subgraph representing connections among the linked entities; and
outputting a ranked list of the linked entities based on deterministic relationship strength scores derived from the predefined weighting parameters.