Multiple granularity classification
Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A first model associated with a first level of granularity is accessed. A first classification result of the entity based on the first model is determined by a processing device. A second model associated with a second level of granularity is accessed. The second level of granularity is higher than the first level of granularity and the second model is accessed based on the first classification result. A second classification result of the entity based on the second model is determined. At least one of the first classification result or the second classification result is stored.
1. A method comprising:
accessing network traffic from a network, wherein the network traffic is associated with a plurality of entities;
selecting an entity of the plurality of entities;
determining one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
accessing a first model associated with a first level of granularity, wherein the first level of granularity comprises a first specificity of entity classifications performed by the first model;
determining, by a processing device, a first classification result of the entity based on the first model;
accessing a second model associated with a second level of granularity, wherein the second level of granularity is higher than the first level of granularity and wherein the second model is accessed based on the first classification result, and wherein the second level of granularity comprises a second specificity of entity classifications performed by the second model;
determining, by the processing device, a second classification result of the entity based on the second model; and
storing at least one of the first classification result or the second classification result.
2. The method of claim 1 further comprising:
performing an action based on at least one of the first classification result or the second classification result.
3. The method of claim 1 , wherein the second model is accessed in response to a confidence associated with the first classification result being above a confidence threshold associated with the first model.
4. The method of claim 1 , wherein the second model being trained on a select set of properties associated with the second level of granularity.
5. The method of claim 1 , wherein the first model is operable to classify an entity as an information technology (IT) entity or an operational technology (OT) entity.
6. The method of claim 5 , wherein the second model is operable to classify an entity as a type of IT entity or a type of OT entity.
7. The method of claim 1 , wherein the first model is operable to classify an entity based on an operating system (OS) associated with the entity and the second model is operable to classify the entity based on a version associated with the OS associated with the entity.
8. The method of claim 7 , wherein a third model is operable to classify the entity based on a patch level associated with the OS associated with the entity.
9. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
select an entity;
determine one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
access a first model associated with a first level of granularity, wherein the first level of granularity comprises a first specificity of entity classifications performed by the first model;
determine, by the processing device, a first classification result of the entity based on the first model;
access a second model associated with a second level of granularity, wherein the second level of granularity is higher than the first level of granularity and wherein the second model is accessed based on the first classification result, and wherein the second level of granularity comprises a second specificity of entity classifications performed by the second model;
determine, by the processing device, a second classification result of the entity based on the second model; and
store at least one of the first classification result or the second classification result.
10. The system of claim 9 , the processing device further to:
perform an action based on at least one of the first classification result or the second classification result.
11. The system of claim 9 , wherein the second model is accessed in response to a confidence associated with the first classification result being above a confidence threshold associated with the first model.
12. The system of claim 9 , wherein the second model being trained on a select set of properties associated with the second level of granularity.
13. The system of claim 9 , wherein the first model is operable to classify an entity as an information technology (IT) entity or an operational technology (OT) entity.
14. The system of claim 13 , wherein the second model is operable to classify an entity as a type of IT entity or a type of OT entity.
15. The system of claim 9 , wherein the first model is operable to classify an entity based on an operating system (OS) associated with the entity and the second model is operable to classify the entity based on a version associated with the OS associated with the entity.
16. The system of claim 15 , wherein a third model is operable to classify the entity based on a patch level associated with the OS associated with the entity.
17. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
select an entity;
determine one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
access a first model associated with a first level of granularity, wherein the first level of granularity comprises a first specificity of entity classifications performed by the first model;
determine, by the processing device, a first classification result of the entity based on the first model;
access a second model associated with a second level of granularity, wherein the second level of granularity is higher than the first level of granularity and wherein the second model is accessed based on the first classification result, and wherein the second level of granularity comprises a second specificity of entity classifications performed by the second model;
determine, by the processing device, a second classification result of the entity based on the second model; and
store at least one of the first classification result or the second classification result.
18. The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the processing device to:
perform an action based on at least one of the first classification result or the second classification result.
19. The non-transitory computer readable medium of claim 17 , wherein the second model is accessed in response to a confidence associated with the first classification result being above a confidence threshold associated with the first model.
20. The non-transitory computer readable medium of claim 17 , wherein the second model being trained on a select set of properties associated with the second level of granularity.