Role grouping of hosts in computer networks
View Patent ↗Techniques to assign nodes in a network to groups of nodes are described. The techniques include representing hosts in the network by property vectors that encode information about the hosts, identifying properties of the property vector by integers in the property vector for the host and determining proximity of hosts according to the property vectors and grouping the hosts according to the determined proximity.
1. A computer implemented method to assign nodes in a network to groups of nodes, comprising:
representing hosts in the network by corresponding property vectors that encode information about the operational characteristics of the hosts;
identifying properties corresponding to operational characteristics of the hosts by integers in the property vectors for a respective host;
determining a degree of similarity in operational characteristics of hosts according to the property vectors; and
grouping the hosts according to the determined similarity in operational characteristics, which comprises one or more of the following operations:
grouping the hosts by neighbors over N dimensions, wherein a value for dimension d comprises a first value if a host d is a neighbor of host h, and a second value otherwise;
grouping the hosts by protocols for P dimensions, wherein a value for dimension d comprises a third value if host h uses protocol d, and a fourth value otherwise; and
grouping the hosts by client-server over two dimensions, wherein a first dimension comprises a fifth value if host h is a client and a sixth value otherwise, and wherein a second dimension comprises a seventh value if host h is a server and an eighth value otherwise.
2. The method of claim 1 wherein each host is identified by an integer in the property vector {0, N−1} where N is the number of hosts in the network or the number of hosts being considered for grouping.
3. The method of claim 2 wherein each port/protocol is identified by an integer in the property vector {0, P−1} where P is the number of protocols and transport-level ports on the network.
4. The method of claim 3 wherein determining proximity includes determining proximity according to neighbor hosts, common protocols, or client-server relationships.
5. The method of claim 1 further comprising setting a grouping radius to control the degree of grouping.
6. The method of claim 5 wherein the grouping radius is a distance in a multi-dimensional property vector space.
7. The method of claim 1 , wherein grouping further comprises: grouping by combinations of properties.
8. The method of claim 7 wherein grouping by a combination of properties comprises producing a tensor product of the vector spaces for each individual property.
9. The method of claim 8 wherein grouping further comprises determining a group's center of gravity (COG(g)) as the sum of the property vectors of its member hosts, divided by the number of hosts.
10. The method of claim 9 wherein similarity of two hosts is obtained by producing a dot product of the property vectors of the hosts and dividing the value by the greater L 1 -norm in both vectors.
11. The method of claim 1 , wherein the first value comprises 1, and the second value comprises 0.
12. The method of claim 1 , wherein the third value comprises 1, and the fourth value comprises 0.
13. The method of claim 1 , wherein the fifth and seventh values comprise 1, and the sixth and eighth values comprise 0.
14. A computer readable medium encoded with a computer program product to assign nodes in a network to groups of nodes, the computer program product comprising instructions to cause a computer to:
construct property vectors to represent hosts in the network, the property vectors encoding information about the operational characteristics of the hosts; for the hosts
identify properties of the hosts by integers in the property vectors for a respective host; and
determine a proximity of hosts; and
group the hosts according to the determined proximity, which comprises one or more of the following operations:
grouping the hosts by neighbors over N dimensions, wherein a value for dimension d comprises a first value if a host d is a neighbor of host h, and a second value otherwise;
grouping the hosts by protocols for P dimensions, wherein a value for dimension d comprises a third value if host h uses protocol d, and a fourth value otherwise; and
grouping the hosts by client-server over two dimensions, wherein a first dimension comprises a fifth value if host h is a client and a sixth value otherwise, and wherein a second dimension comprises a seventh value if host h is a server and an eighth value otherwise.
15. The computer readable medium of claim 14 wherein each host is identified by an integer in the property vector {0, N−1} where N is the number of hosts in the network or the number of hosts being considered for grouping.
16. The computer readable medium of claim 14 wherein each port/protocol is identified by an integer in a property vector {0, P−1} where P is the number of protocols and transport-level ports on the network.
17. The computer readable medium of claim 14 wherein instructions to determine proximity determines proximity according to host neighbors, common protocols, or client-server relationships.
18. The computer readable medium of claim 14 further comprising instructions to set a grouping radius to control the degree of grouping.
19. The computer readable medium of claim 18 wherein the grouping radius is a distance in a multi-dimensional property vector space.
20. The computer readable medium of claim 14 wherein grouping further comprises instructions to: group by combinations of properties.
21. The computer readable medium of claim 20 wherein instructions to group by combination of properties comprises instructions to producing a tensor product of the vector spaces for each individual property.
22. The computer readable medium of claim 21 wherein instructions to group further comprises instructions to determine a group's center of gravity (COG(g)) as the sum of the property vectors of its member hosts, divided by the number of hosts.
23. The computer readable medium of claim 14 wherein a similarity of two hosts is obtained by producing a dot product of the property vectors of the hosts and dividing the value by the greater L 1 -norm in both vectors.
24. The computer readable medium of claim 14 , wherein the first value comprises 1, and the second value comprises 0.
25. The computer readable medium of claim 14 , wherein the third value comprises 1, and the fourth value comprises 0.
26. The computer readable medium of claim 14 , wherein the fifth and seventh values comprise 1, and the sixth and eighth values comprise 0.
27. An apparatus comprising:
a processor;
a memory for executing a computer program and
a computer readable medium for storing the computer program product for assigning nodes a network to groups of nodes, the computer program product comprising instructions to cause a computer to:
construct property vectors to represent hosts in the network, the property vectors encoding information about the operational characteristics of the hosts;
identify properties of the property vector by integers in the property vectors for the hosts; and
determine a proximity of hosts based on the property vectors; and
group the hosts according to the determined proximity, which comprises one or more of the following operations:
grouping the hosts by neighbors over N dimensions, wherein a value for dimension d comprises a first value if a host d is a neighbor of host h, and a second value otherwise;
grouping the hosts by protocols for P dimensions, wherein a value for dimension d comprises a third value if host h uses protocol d, and a fourth value otherwise; and
grouping the hosts by client-server over two dimensions, wherein a first dimension comprises a fifth value if host h is a client and a sixth value otherwise, and wherein a second dimension comprises a seventh value if host h is a server and an eighth value otherwise.
28. The apparatus of claim 27 wherein each host is identified by an integer in the property vector {0, N−1} where N is the number of hosts in the network or the number of hosts being considered for grouping.
29. The apparatus of claim 27 wherein each port/protocol is identified by an integer in a property vector {0, P−1} where P is the number of protocols and transport-level ports on the network.
30. The apparatus of claim 27 , wherein the first value comprises 1, and the second value comprises 0.
31. The apparatus of claim 27 , wherein the third value comprises 1, and the fourth value comprises 0.
32. The apparatus of claim 27 , wherein the fifth and seventh values comprise 1, and the sixth and eighth values comprise 0.
33. A computer implemented method to assign nodes in a network to groups of nodes, comprising:
representing hosts in the network by corresponding property vectors that encode information about the operational characteristics of the hosts;
identifying properties corresponding to operational characteristics of the hosts by integers in the property vectors for a respective host;
determining a degree of similarity in operational characteristics of hosts according to the property vectors; and
grouping the hosts according to the determined similarity in operational characteristics, which comprises grouping the hosts by neighbors over N dimensions, wherein a value for dimension d comprises a first value if a host d is a neighbor of host h, and a second value otherwise.
34. A computer implemented method to assign nodes in a network to groups of nodes, comprising:
representing hosts in the network by corresponding property vectors that encode information about the operational characteristics of the hosts;
identifying properties corresponding to operational characteristics of the hosts by integers in the property vectors for a respective host;
determining a degree of similarity in operational characteristics of hosts according to the property vectors; and
grouping the hosts according to the determined similarity in operational characteristics, which comprises grouping the hosts by protocols for P dimensions, wherein a value for dimension d comprises a first value if host h uses protocol d, and a second value otherwise.
35. A computer implemented method to assign nodes in a network to groups of nodes, comprising:
representing hosts in the network by corresponding property vectors that encode information about the operational characteristics of the hosts;
identifying properties corresponding to operational characteristics of the hosts by integers in the property vectors for a respective host;
determining a degree of similarity in operational characteristics of hosts according to the property vectors; and
grouping the hosts according to the determined similarity in operational characteristics, which comprises grouping the hosts by client-server over two dimensions, wherein a first dimension comprises a first value if host h is a client and a second value otherwise, and wherein a second dimension comprises a third value if host h is a server and a fourth value otherwise.