Ranking of enterprise devices using activity-based network profiles and functional characterization-based device clustering
Techniques are provided for generating activity-based network profiles for devices, and for ranking such devices using the activity-based network profiles. One method comprises evaluating device communications to identify services that communicated with devices of an enterprise; generating an activity-based network profile for each device based on the services that communicated with each respective device; clustering the devices into a plurality of clusters based on a functional characterization of the devices derived from the activity-based network profiles; and ranking the devices within a cluster based on network activity and/or network exposure. The activity-based network profile for a given device: (i) identifies the services that communicated with the given device, (ii) identifies other devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based on network metrics of the other devices that communicate with the respective service on the given device.
1. A method comprising:
identifying device communications over at least one network of an enterprise;
evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network;
generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device;
clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles;
ranking the devices within one or more clusters based on a usage ranking factor, wherein the usage ranking factor is based on a number of distinct IP addresses that access a service that defines a main function of the one or more clusters;
ranking the devices within one or more clusters based on risk factors of:
a total number of services exported; and
a total number of IP addresses that access the network;
computing a product value of the risk factors and the usage ranking factor; and
generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk, wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device.
3. The method of claim 1 , wherein the activity-based network profile for the given device further identifies, for each accessed service, (i) other devices that connect to the respective accessed service on the given device, and (ii) a local fraction metric based at least in part on a ratio of one or more network metrics of communications of other devices that accessed the respective accessed service on the given device to the one or more network metrics of communications of other devices that accessed any service on the given device.
4. The method of claim 1 , further comprising:
computing a centroid for each of the plurality of clusters;
receiving a search request for the devices in the plurality of devices similar to a specified device;
comparing the specified device to the computed centroids for the plurality of clusters; and
returning the devices in the clusters having centroids similar to the specified device.
5. The method of claim 1 , wherein the activity-based network profile for the given device further identifies, for each service accessed by the given device, (i) other devices where the given device accessed the respective service accessed by the given device, and (ii) a local fraction metric based at least in part on a ratio of one or more network metrics of communications of the given device with the respective service accessed by the given device to the one or more network metrics of communications with any service accessed by the given device.
6. The method of claim 1 , wherein the functional characterization is further derived from one or more of the activity-based profile, the local fraction metric, a threshold value for a minimum number of network addresses that communicated with the given device, and a threshold value for the ratio of the number of services communicating with the given device, and a threshold for the ratio between the number of services and the number of network addresses communicating with the device.
7. The method of claim 1 , wherein the ranking the devices within each cluster based at least in part on the network activity orders the devices assigned to a given cluster based at least in part on one or more network metrics of devices that communicated with only the services related to a main function of the given cluster.
8. The method of claim 1 , wherein the ranking the devices within each cluster based at least in part on the network exposure orders the devices assigned to a given cluster based at least in part on one or more of a total number of distinct services communicating with the given device, a number of network addresses external to the at least one network of the enterprise that communicated with each given device, and a total number of network addresses that communicated with each given device.
9. The method of claim 1 , further comprising assigning devices that do not demonstrate a functional characterization to a cluster using a divide and conquer clustering algorithm to form groupings based at least in part on one or more of a profile-similarity, a network proximity, and a device address proximity, wherein the divide and conquer clustering algorithm evaluates, for the given device, one or more of a set of services communicating with the given device, a total number of network addresses communicating with the given device and a network address of the given device.
10. The method of claim 1 , wherein the activity-based network profile for the given device is based at least in part on one or more network metrics comprising one or more of a number of distinct network addresses, a total amount of data transferred, a total amount of data uploaded, a total amount of data downloaded and a duration of communication.
11. The method of claim 1 , wherein the functional characterization of the given device is provided by a subject matter expert, and wherein at least one additional device that satisfies at least one similarity criteria is assigned to the same cluster as the given device.
12. The method of claim 1 , wherein the activity-based network profile for the given device of the plurality of devices is generated by associating, with each device of the plurality of devices, a numeric feature vector that represents quantitative information about services the device exports and imports.
13. The method of claim 1 , wherein the identifying is passive with respect to the devices connected to the at least one network.
14. The method of claim 1 , further comprising evaluating the device communications to identify one or more previously unknown devices or a deviation of the given device from an original profile.
15. The method of claim 1 , further comprising generating content or contextual details for at least one of the plurality of devices based at least in part on one or more of: (a) the activity-based network profile for each of the plurality of devices, (b) the devices within at least one cluster, and (c) the ranking of the devices within at least one cluster.
16. The method of claim 1 , wherein the identifying device communications comprises processing one or more of network traffic on the at least one network and log entries for one or more of the devices connected to the at least one network.
17. An apparatus comprising: at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps: identifying device communications over at least one network of an enterprise;
evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network;
generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device;
clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles;
ranking the devices within one or more clusters based on a usage ranking factor, wherein the usage ranking factor is based on a number of distinct IP addresses that access a service that defines a main function of the one or more clusters;
ranking the devices within one or more clusters based on factors of:
a number of external IP addresses that access each device; and
a total number of IP addresses that access the network;
computing a product value of the risk factors and the usage ranking factors; and
generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk.
18. The apparatus of claim 17 , wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device.
19. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
identifying device communications over at least one network of an enterprise;
evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network;
generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device;
clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles;
ranking the devices within one or more clusters based on a usage ranking factor, wherein the usage ranking factor is based on a number of distinct IP addresses that access a service that defines a main function of the one or more clusters;
ranking the devices within one or more clusters based on risk factors of:
a total number of services exported; and
a total number of IP addresses that access the network;
computing a product of the risk factors and the usage ranking factor; and
generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk.
20. The non-transitory processor-readable storage medium of claim 19 , wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device.