Network security policy configuration based on predetermined command groups

1. A method comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device and a count of the first set of commands;

determining a predetermined threshold;

providing a first predetermined command group, the first predetermined command group including a list of electronic commands and not a list of devices;

determining, using at least one hardware processor, that the first set of commands includes a threshold number of commands represented within the first predetermined command group, the threshold number of commands exceeding the predetermined threshold; and

dynamically generating, by the at least one hardware processor, a first policy based on the first predetermined command group;

wherein the first policy allows all commands in the command group to be transmitted between the first device and the second device.

2. The method of claim 1 , wherein determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises:

determining a number of unique commands from the first predetermined command group that were used in communications between the first device and the second device; and

comparing the number of unique commands to the threshold number of commands.

3. The method of claim 1 , wherein determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises:

determining a total number of occurrences of commands from the first predetermined command group that were transmitted between the first device and the second device; and

comparing the total number of occurrences of commands to the threshold number of commands.

4. The method of claim 1 , wherein the first policy is a whitelisting policy for communications transmitted between the first device and the second device, the whitelisting policy including the listing of the plurality of commands for the first predetermined command group.

5. The method of claim 1 , further comprising:

implementing the first policy to subsequent data traffic transmitted between the first device and the second device.

6. A method comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device;

determining, using at least one hardware processor, that the first set of commands includes a threshold number of commands from a first predetermined command group of a plurality of predetermined command groups, each predetermined command group including a listing of a plurality of commands; and

generating, by the at least one hardware processor, a first policy based on the first predetermined command group

wherein determining the first set of commands that were transmitted between the first device and the second device comprises:

searching the plurality of commands transmitted between the first device and the second device for commands originating from a first IP address and being transmitted to a second IP address, yielding a first subset of commands;

searching the plurality of commands transmitted between the first device and the second device for commands originating from the second IP address and being transmitted to the first IP address, yielding a second subset of commands; and

determining the first set of commands based on the first subset of commands and the second subset of commands.

7. The method of claim 6 , further comprising:

identifying from the first subset of commands and the second subset of commands, a set of commands transmitted within a specified period of time, wherein at least one command from the first subset of commands that was not transmitted within the specified period of time is not included in the first set of commands.

8. A network security system comprising:

one or more computer processors; and

one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the network security system to perform operations comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device and a count of the first set of commands;

determining a predetermined threshold;

providing a first predetermined command group, the first predetermined command group including a list of electronic commands and not a list of devices;

determining that the first set of commands includes a threshold number of commands represented within the first predetermined command group, the threshold number of commands exceeding the predetermined threshold; and

dynamically generating a first policy based on the first predetermined command group;

wherein the first policy allows all commands in the command group to be transmitted between the first device and the second device.

9. The network security system of claim 8 , wherein determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises:

determining a percentage of commands from the first predetermined command group that are included in the first set of commands; and

comparing the percentage to a threshold percentage.

10. The network security system of claim 8 , wherein determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises:

determining a total number of occurrences of commands from the first predetermined command group that were transmitted between the first device and the second device; and

comparing the total number of occurrences of commands to the threshold number of commands.

11. The network security system of claim 8 , wherein the first policy is a whitelisting policy for communications transmitted between the first device and the second device, the whitelisting policy including the listing of the plurality of commands for the first predetermined command group.

12. The network security system of claim 8 , the operations further comprising:

implementing the first policy to subsequent data traffic transmitted between the first device and the second device.

13. A network security system comprising:

one or more computer processors; and

one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the network security system to perform operations comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device;

determining that the first set of commands includes a threshold number of commands from a first predetermined command group of a plurality of predetermined command groups, each predetermined command group including a listing of a plurality of commands; and

generating a first policy based on the first predetermined command group;

wherein determining the first set of commands that were transmitted between the first device and the second device comprises:

searching the plurality of commands transmitted between the first device and the second device for commands originating from a first IP address and being transmitted to a second IP address, yielding a first subset of commands;

searching the plurality of commands transmitted between the first device and the second device for commands originating from the second IP address and being transmitted to the first IP address, yielding a second subset of commands; and

determining the first set of commands based on the first subset of commands and the second subset of commands.

14. The network security system of claim 13 , the operations further comprising:

identifying from the first subset of commands and the second subset of commands, a set of commands transmitted within a specified period of time, wherein at least one command from the first subset of commands that was not transmitted within the specified period of time is not included in the first set of commands.

15. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a network security system, cause the network security system to perform operations comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device and a count of the first set of commands;

determining a predetermined threshold;

providing a first predetermined command group, the first predetermined command group including a list of electronic commands and not a list of devices;

determining that the first set of commands includes a threshold number of commands represented within the first predetermined command group, the threshold number of commands exceeding the predetermined threshold; and

dynamically generating a first policy based on the first predetermined command group;

wherein the first policy allows all commands in the command group to be transmitted between the first device and the second device.

16. The non-transitory computer-readable medium of claim 15 , wherein the operation of determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises:

determining a number of unique commands from the first predetermined command group that were used in communications between the first device and the second device; and

comparing the number of unique commands to the threshold number of commands.

17. The non-transitory computer-readable medium of claim 15 , wherein the operation of determining that the first set of commands includes the threshold number of commands from the first predetermined command group comprises: determining a total number of occurrences of commands from the first predetermined command group that were transmitted between the first device and the second device; and

comparing the total number of occurrences of commands to the threshold number of commands.

18. The non-transitory computer-readable medium of claim 15 , wherein the first policy is a whitelisting policy for communications transmitted between the first device and the second device, the whitelisting policy including the listing of commands for the first predetermined command group.

19. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more computer processors, cause the network security system to perform operations further comprising:

identifying from the first subset of commands and the second subset of commands, a set of commands transmitted within a specified period of time, wherein at least one command from the first subset of commands that was not transmitted within the specified period of time is not included in the first set of commands.

20. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a network security system, cause the network security system to perform operations comprising:

monitoring data traffic transmitted between a first device and a second device in a network to identify a plurality of commands transmitted between the first device and the second device;

determining, from the plurality of commands, a first set of commands that were transmitted between the first device and the second device;

determining that the first set of commands includes a threshold number of commands from a first predetermined command group of a plurality of predetermined command groups, each predetermined command group including a listing of a plurality commands; and

generating a first policy based on the first predetermined command group;

wherein the operation of determining the first set of commands that were transmitted between the first device and the second device comprises:

searching the plurality of commands transmitted between the first device and the second device for commands originating from a first IP address and being transmitted to a second IP address, yielding a first subset of commands;

searching the plurality of commands transmitted between the first device and the second device for commands originating from the second IP address and being transmitted to the first IP address, yielding a second subset of commands; and

determining the first set of commands based on the first subset of commands and the second subset of commands.