Entity identification for enclave segmentation in a network

1. A method comprising:

identifying, by a device in a network, a set of network entities;

determining, by the device, characteristics of the network entities;

assigning, by the device, each of the set of network entities to at least one of three different types of hyperedges of a hypergraph based on the determined characteristics, wherein the three different types of hyperedges include a trusted enclave of entities, a guest enclave of entities, and a quarantine enclave of entities and assigning each of the set of network entities to one or more hyperedges of a hypergraph includes:

using, by the device, reinforced learning to assign the network entities to one or more of the hyperedges of the hypergraph; and

applying, by the device, a security policy to a network entity in the set of network entities based on the type of hyperedge the network entity is assigned.

2. The method as in claim 1 , wherein assigning each of the set of network entities to one or more hyperedges of a hypergraph comprises:

labeling, by the device, one of the network entities using a set of labels that are based on the determined characteristics for the entity; and

using, by the device, the set of labels for the labeled entity to infer labels for the unlabeled network entities.

3. The method as in claim 2 , wherein using the labeled one or more network entities to infer labels for the unlabeled network entities comprises:

determining, by the device, a distribution of the set of labels for the labeled entity;

propagating, by the device, the distribution to the other network entities in the hypergraph to infer a distribution for each of the entities; and

assigning, by the device, those of the entities with similar distributions to the same hyperedge of the hypergraph.

4. The method as in claim 3 , wherein propagating the distribution to one of the other network entities in the hypergraph to infer a distribution for the other entity comprises:

minimizing, by the device, a loss term and a Kullback-Leibler (KL)-based regularization term.

5. The method as in claim 1 , wherein the network entities comprise one or more of: a physical node in the network or a virtual service in the network.

6. The method as in claim 1 , wherein using reinforced learning to assign the network entities to one or more of the hyperedges of the hypergraph comprises:

applying, by the device, hierarchical Bayesian optimization to assign one of the network entities to one of the hyperedges.

7. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute a process; and

a memory configured to store the process executable by the processor, the process when executed operable to:

identify a set of network entities;

determine characteristics of the network entities;

assign each of the set of network entities to at least one of three different types of hyperedges of a hypergraph based on the determined characteristics, wherein the three different types of hyperedges include a trusted enclave of entities, a guest enclave of entities, and a quarantine enclave of entities and the apparatus assigns each of the set of network entities to one or more hyperedges of a hypergraph by:

using reinforced learning to assign the network entities to one or more of the hyperedges of the hypergraph; and

apply a security policy to a network entity in the set of network entities based on the type of hyperedge the network entity is assigned.

8. The apparatus as in claim 7 , wherein the apparatus assigns each of the set of network entities to one or more hyperedges of a hypergraph by:

labeling one of the network entities using a set of labels that are based on the determined characteristics for the entity; and

using the set of labels for the labeled entity to infer labels for the unlabeled network entities.

9. The apparatus as in claim 8 , wherein the apparatus uses the labeled one or more network entities to infer labels for the unlabeled network entities by:

determining a distribution of the set of labels for the labeled entity;

propagating the distribution to the other network entities in the hypergraph to infer a distribution for each of the entities; and

assigning those of the entities with similar distributions to the same hyperedge of the hypergraph.

10. The apparatus as in claim 9 , wherein the apparatus propagates the distribution to one of the other network entities in the hypergraph to infer a distribution for the other entity by:

minimizing a loss term and a Kullback-Leibler (KL)-based regularization term.

11. The apparatus as in claim 7 , wherein the network entities comprise one or more of: a physical node in the network or a virtual service in the network.

12. The apparatus as in claim 7 , wherein the apparatus uses reinforced learning to assign the network entities to one or more of the hyperedges of the hypergraph by:

applying hierarchical Bayesian optimization to assign one of the network entities to one of the hyperedges.

13. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a network, cause the device to perform a process comprising:

identifying, by the device, a set of network entities;

determining, by the device, characteristics of the network entities;

assigning, by the device, each of the set of network entities to at least one of three different types of hyperedges of a hypergraph based on the determined characteristics, wherein the three different types of hyperedges include a trusted enclave of entities, a guest enclave or entities, and a quarantine enclave of entities and assigning each of the set of network entities to one or more hyperedges of a hypergraph includes:

using, by the device, reinforced learning to assign the network entities to one or more of the hyperedges of the hypergraph; and

applying, by the device, a security policy to a network entity in the set of network entities based on the type of hyperedge the network entity is assigned.

14. The computer-readable medium as in claim 13 , wherein assigning each of the set of network entities to one or more hyperedges of a hypergraph comprises:

labeling, by the device, one of the network entities using a set of labels that are based on the determined characteristics for the entity; and

using, by the device, the set of labels for the labeled entity to infer labels for the unlabeled network entities.

15. The computer-readable media as in claim 13 , wherein the network entities comprise one or more of: a physical node in the network or a virtual service in the network.