Research on user identification algorithm based on massive multi-site VPN log

VPN (Virtual Private Network) is the primary mean for users to access network information by crossing the border currently. There is little research about VPN users, though the number of users who using VPN is pretty large. Consequently, it is desiderated to find a solution to strengthen the ability to observe and discover cross-border access users. This paper proposes a novel user identification algorithm according to massive multi-site VPN log. First of all, a formal description of VPN user identification problems is given, then we analyze quantitatively for probability distribution of VPN log in two dimensions: usernames and CIP (Client Internet Protocol) addresses. Based on this, we give the solution of problems in VPN user identification, and propose a user identification algorithm based on the combination of access vector similarity, username similarity, the number of regions where users surf the internet and the connected subgraphs. Then we test the algorithm in VPN log within two months, which has proved the effectiveness and correctness of user identification algorithm.