Enterprise server behavior profiling
Generation of behavior profiling reports is provided for enterprise server devices in a network of enterprise server devices, as well as generation and association of severity scores for behavior profiling reports generated for enterprise server devices included in the network of enterprise server devices. A method can comprise receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device, and, as a function of the historical security event data and the owner data, an anomalous contact established between the first device and the second device can be identified. Further, in response to identifying the existence of the anomalous contact, the second device can be depicted on a connected graph of anomalous contacts established by the first device.
1. A device, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device;
as a function of the historical security event data and the owner data, identifying an existence of an anomalous contact established between the first device and a second device;
generating a severity score for the second device based on a weighted sum value determined as a function of the anomalous contact aggregated in a group of anomalous contacts that have occurred between the first device and the second device within a defined period of time, and as a function of a value representing a number of connections attempted by the second device to a port associated with the first device, wherein the port that has not been accessed prior to the defined period of time; and
in response to identifying the existence of the anomalous contact and based on the severity score, depicting the second device on a connected graph of anomalous contacts established by the first device.
2. The device of claim 1 , wherein the defined period of time is a first defined period of time, and wherein the operations further comprise determining the existence of the anomalous contact as a function of the first device being determined to have failed to establish a contact with the second device within a second defined period of time.
3. The device of claim 1 , wherein the operations further comprise connecting the first device and the second device as depicted on the connected graph of the anomalous contacts with an edge representing a connection between the first device and the second device.
4. The device of claim 1 , wherein the first device and the second device are part of a geographically distributed network of devices.
5. The device of claim 1 , wherein the owner data is received from a database device maintained by a regional Internet registry device.
6. The device of claim 1 , wherein the operations further comprise using a white-list of devices that are accorded a defined privilege, a defined service, a defined mobility, a defined access, or a defined recognition.
7. The device of claim 1 , wherein the defined period of time is a first defined period of time, and wherein the anomalous contact is a communication by the first device to the second device within a third defined period of time.
8. The device of claim 1 , wherein the defined period of time is a first defined period of time, and wherein the anomalous contact is a communication by the second device to the first device within a fourth defined period of time.
9. The device of claim 1 , wherein the historical security event data and the owner data is correlated as a function of an internet protocol address.
10. A method, comprising:
as a function of historical security event data and owner data, determining, by a system comprising a processor, an existence of an anomalous contact established between a first device and a second device;
generating, by the system, a severity score for the second device based on a weighted average value determined as a function of the anomalous contact aggregated in a grouping of anomalous contacts that have occurred between the first device and the second device within a determined period of time, and as a function of a value representing a number of connections by the second device using a port associated with the first device, wherein the port has not been accessed prior to the determined period of time; and
in response to identifying the existence of the anomalous contact and as a function of the severity score, depicting, by the system, the second device on a connected graph of anomalous contacts established by the first device.
11. The method of claim 10 , further comprising receiving, by the system, the historical security event data representing the historical security events of the first device and the owner data representing an identity associated with an owner of the first device.
12. The method of claim 10 , further comprising determining, by the system, the existence of the anomalous contact as a function of the first device being determined to have failed to establish a contact with the second device within a defined period of time.
13. The method of claim 10 , further comprising connecting, by the system, the first device and the second device as depicted on the connected graph of the anomalous contacts with an edge representing a connection between the first device and the second device.
14. The method of claim 10 , wherein the first device and the second device form part of a geographically distributed network of devices.
15. The method of claim 10 , further comprising receiving, by the system, the owner data from a database device populated by the first device.
16. The method of claim 10 , further comprising using, by the system, a list of devices that are accorded a defined privilege, a defined service, a defined mobility, a defined access, or a defined recognition.
17. The method of claim 10 , wherein the anomalous contact is a communication by the first device to the second device within a defined time period.
18. The method of claim 10 , wherein the anomalous contact is a communication by the second device to the first device within a defined period of time.
19. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
receiving security event data representing security events associated with a first device and owner data representing an owner identity associated with the first device;
as a function of the security event data and the owner data, determining an existence of an anomalous contact established between the first device and a second device;
generating a severity score for the second device based on a weighted sum value determined as a function of the anomalous contact aggregated into a collection of anomalous contacts that have occurred between the first device and the second device within a determined period of time, and based on a value representing a number of attempted connections by the second device to a port associated with the first device, wherein the port has not been accessed prior to the determined period of time; and
in response to determining the existence of the anomalous contact, depicting the second device on a graph of anomalous contacts established by the first device.
20. The non-transitory machine-readable storage medium of claim 19 , wherein the operations further comprise determining the existence of the anomalous contact as a function of the first device being determined to have failed to establish a contact with the second device within a defined time period.