How can I Find End User Connecting to Oracle
                    When v$session Shows "JDBC Thin Client"?

If you use middleware software such as Weblogic, Oracle v$session.program column
shows "JDBC Thin Client" and the terminal column shows "unknown". The way to
trace back to where this connection comes from is by looking at the Oracle
SQL*Net listener log. First look at v$session.logon_time with granularity down
to seconds

select to_char(logon_time, 'yyyymmdd hh24:mi:ss')
from v$session
where program like 'JDBC%';

or preferably

alter session set nls_date_format = 'yyyymmdd hh24:mi:ss';
select * from v$session where program like 'JDBC%';

Then view the listener log ("lsnrctl stat | grep Log" in UNIX to locate it).
Find the exact time corresponding to the time the above SQL statement returns.
The entry may look like

17-DEC-2000 10:56:46 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=)(HOST=__jdbc__)(US
ER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=128.80.143.230)(PORT=39987)) * estab
lish * ORCL * 0

That IP address is that of the machine that made the connection!

If you want to go one more step to identify the user, and if the Messenger
service on the remote computer is running, go to DOS and type this command to
see NetBIOS Remote Machine Name Table

nbtstat -A 128.80.143.230

Note that it's capital 'A'. Look at the lines that have <03> as the second
field. You'll probably see two or more of them, the first one for the computer
name, the others or the second and probably the last line for the user.

    YONGXH        <03>  UNIQUE      Registered

If the number of users is more than one, that computer may be a server which
multiple users are logged on.

If nbtstat does not give you anything, it means the messenger service is stopped on 
the remote machine. Try psloggedon \\clientmachineIPorHostname (download psloggedon 
from Sysinternals or Microsoft.com). Or the JDBC connection did not come from a 
Windows machine. Try nslookup 128.80.143.230 instead. It should return the
hostname for that IP address. If not, it simply means that the system
administrator hasn't assigned a name to it yet, which does happen sometimes.