Patent attributes
An example embodiment may involve communicating with a server to separately access first and second records of sessions between the server and computing devices of a network, the first record including a first set of fields not present in the second record and the second record includes a second set of fields not present in the first record; identifying a common field present the first and second records; correlating information across the first and second records using the common field; using a set of license misuse criteria to identify, from the correlated information, (i) a set of the sessions that meets the set of criteria and (ii) a network address of a target device involved in the set of sessions; identifying the target device using the network address; and storing an indication identifying the target device as a potential source of misuse of licensed software executable on the server.
