Abstract—It is used to identify users’ connections by using the source IP addresses in the traffic log inside a firewall. In the case with pre-assigned IP addresses, the mapping relationship between IP addresses and users is fixed. However, an IP address
