Systems and methods for automated networking rule production
The flow samples in a training set may be produced from a flow log, from an initial set of network rules, or from both. The flow samples may include header values for network flows and may be stored in a memory. A processor coupled to the memory may be configured for unsupervised and automatic networking rule production. The unsupervised and automatic rule production may include producing clusters of the flow samples and producing networking rules from the clusters, wherein each of the clusters may be used to produce one of the networking rules. An unsupervised learning algorithm may be used to produce the clusters.
1 . A system comprising:
a processor configured to execute a plurality of executable instructions that implement unsupervised production of a plurality of networking rules, wherein producing the plurality of networking rules includes:
producing a plurality of flow samples from a plurality of flow log entries, the flow samples including flow header values, where at least one of the flow header values of a flow sample is a single numerical value produced by combining octets of source IP addresses in the flow log entries or by combining octets of destination IP addresses in the flow log entries;
identifying a plurality of clusters of the flow samples within a multi-dimensional space, wherein each of the flow samples is multi-dimensional and the single numerical value serves as a coordinate for one dimension of a respective flow sample in the multi-dimensional space; and
producing the plurality of networking rules from the plurality of clusters,
wherein each one of the plurality of clusters is used to produce one of the plurality of networking rules; and
the networking rules are configured for use by a networking device that implements the networking rules.
2 . The system of claim 1 , wherein producing the plurality of networking rules from the plurality of clusters includes producing a cluster description for each of the plurality of clusters, wherein each cluster description includes a least source address value, a greatest source address value, a least destination address value, a greatest destination address value, a least destination port value, and a greatest destination port value derived from the flow samples in the respective cluster.
3 . The system of claim 2 , wherein each of the plurality of networking rules includes a matching criterion having a source address range set from the least source address value and the greatest source address value in the respective cluster description, a destination address range set from the least destination address value and the greatest destination address value in the respective cluster description, and a destination port range set from the least destination port value and the greatest destination port value in the respective cluster description.
4 . The system of claim 1 , wherein producing the plurality of flow samples includes selecting flow log entries having an allow outcome.
5 . The system of claim 1 , wherein a number of the plurality of clusters is based on a flow table size of the networking device.
6 . The system of claim 1 , wherein the processor is configured to use a nearest-neighbor clustering algorithm to identify the plurality of clusters.
7 . The system of claim 1 , wherein the processor is configured to use a random cut forest clustering algorithm to identify the plurality of clusters.
8 . The system of claim 1 , wherein the flow samples are samples of a plurality of network flows, and the plurality of networking rules are firewall rules that allow each of the network flows and that deny a network flow that is not one of the network flows.
9 . The system of claim 1 , wherein the flow samples are samples of a plurality of network flows, and at least one of the plurality of flow samples are produced from a flow log that has an entry for each of the network flows.
10 . The system of claim 1 , wherein at least one of the plurality of flow samples are produced from an initial networking rule set that includes a plurality of initial networking rules.
11 . The system of claim 10 , wherein:
one of the plurality of initial networking rules indicates a range of values; and
one of the plurality of flow samples includes a value that is a midpoint of the range of values.
12 . The system of claim 11 , wherein:
the one of the plurality of flow samples matches one of the plurality of networking rules; and
the one of the plurality of networking rules is adjusted to include the range of values.
13 . A method comprising:
producing a plurality of flow samples from a plurality of flow log entries, the flow samples including flow header values, where at least one of the flow header values of a flow sample is a single numerical value produced by combining octets of source IP addresses in the flow log entries or by combining octets of destination IP addresses in the flow log entries;
identifying a plurality of clusters of the flow samples within a multi-dimensional space, wherein each of the flow samples is multi-dimensional and the single numerical value serves as a coordinate for one dimension of a respective flow sample in the multi-dimensional space; and
producing a plurality of networking rules from the plurality of clusters,
wherein:
each of the plurality of clusters is used to produce one of the plurality of networking rules; and
the networking rules are configured for use by a networking device that implements the networking rules.
14 . The method of claim 13 , wherein at least one of the plurality of flow samples is a multi-dimensional flow sample that excludes a field having an ANY matching criterion from an initial networking rule, and the multi-dimensional flow sample is gathered into a separate training set from other flow samples having a different dimensionality.
15 . The method of claim 13 , further including:
using a nearest-neighbor clustering algorithm to identify the plurality of clusters.
16 . The method of claim 13 , wherein the flow samples are samples of a plurality of network flows, and the plurality of networking rules are firewall rules that allow each of the network flows and that deny a network flow that is not one of the network flows.
17 . The method of claim 13 , wherein the flow samples are samples of a plurality of network flows, and at least one of the plurality of flow samples are produced from a flow log that has an entry for each of the network flows.
18 . The method of claim 13 , wherein at least one of the plurality of flow samples are produced from an initial networking rule set that includes a plurality of initial networking rules.
19 . The method of claim 18 , wherein:
one of the plurality of initial networking rules indicates a range of values;
one of the plurality of flow samples includes a value that is a midpoint of the range of values;
the one of the plurality of flow samples matches one of the plurality of networking rules; and
the one of the plurality of networking rules is adjusted to include the range of values.
20 . A system comprising:
a clustering means for identifying a plurality of clusters of a plurality of flow samples within a multi-dimensional space, the plurality of flow samples including a plurality of flow header values of a plurality of network flows; and
a means for producing a plurality of networking rules from the plurality of clusters,
wherein:
the flow samples are produced from a plurality of flow log entries, the flow header values including a single numerical value produced by combining octets of source IP addresses in the flow log entries or by combining octets of destination IP addresses in the flow log entries;
each of the flow samples is multi-dimensional and the single numerical value serves as a coordinate for one dimension of a respective flow sample in the multi-dimensional space;
each one of the plurality of clusters is used to produce one of the plurality of networking rules; and
the networking rules are configured for use by a networking device that implements the networking rules.
21 . The system of claim 20 , wherein the multi-dimensional space is a 3-dimensional space.