I think what you're getting at is Grapl's identification process. It's timestamp based, primarily, at the moment, yes. A bit of the algorithm is described here

I think what you're getting at is Grapl's identification process. It's timestamp based, primarily, at the moment, yes. A bit of the algorithm is described here: https://insanitybit.github.io/2019/03/09/grapl https://insanitybit.github.io/2019/03/09/grapl More specifically Grapl defines a type of identity called a Session - this is an ID that is valid for a time, such as a PID on every major OS. Sessions are tracked or otherwise guessed based on logs, such as process creation or termination logs. Because Grapl assumes that logs will be dropped or come out of order/ extremely delayed it makes the effort to "guess" at identities. It's been quite accurate in my experience but the algorithm has many areas for improvement - it's a bit naive right now. Happy to answer more questions about it though. Based on what you seem to be interested I'd like to recommend CloudMapper by Scott Piper. https://github.com/duo-labs/cloudmapper https://github.com/duo-labs/cloudmapper