Classification including correlation
Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed. One or more values associated with one or more properties associated with an entity may be determined. The one or more values may be determined from the network traffic. A first classification attribute is determined based on the one or more values associated with one or more properties associated with the entity. A second classification attribute is determined, by a processing device, based on the first classification attribute and the one or more values associated with one or more properties associated with the entity. The second classification attribute is stored.
1 . A method comprising:
accessing network traffic via an enforcement point communicatively coupled to an entity of a network;
determining, based on the network traffic, one or more values associated with one or more properties associated with the entity;
determining, at a first classifier stage, a first classification attribute based on the one or more values using a first classification model, wherein the first classification attribute comprises a first output vector comprising a first entity classification result and a first confidence score associated with the first entity classification result;
determining, by a processing device and at the first classifier stage, a second classification attribute based on the first classification attribute and the one or more values using the first output vector and the one or more properties associated with the entity as input for a second classification model, wherein the second classification attribute comprises a second output vector comprising a second entity classification result different from the first entity classification result and a second confidence score associated with the second entity classification result, wherein the second classification attribute has a higher granularity than the first classification attribute, and the second confidence score of the second output vector is greater than the first confidence score of the first output vector, and wherein the second classification model determines the second classification attribute based on a correlation between the second classification attribute and the first classification attribute determined by applying one or more correlation rules to the first classification attribute and the one or more properties associated with the entity, the correlation rules to determine a new classification from a prior classification without collection of additional entity properties;
determining, at a second classifier stage and based on the second classification attribute, an enhanced classification output, wherein the first classifier stage and the second classifier stage are arranged in a distributed manner, one of the first classifier stage and the second classifier stage uses a local classification resource, and the other one of the first classifier stage and the second classifier stage uses a cloud classification resource.
2 . The method of claim 1 , wherein a first classification result comprises the first classification attribute and a second classification result comprises the second classification attribute, and wherein the second classification result is not present in the first classification result.
3 . The method of claim 1 , wherein the second classification attribute is different from the first classification attribute.
4 . The method of claim 1 , wherein the first classification attribute is at least one of a vendor, a function, or an operating system (OS).
5 . The method of claim 1 , wherein the second classification attribute is at least one of a vendor, a function, or an operating system (OS).
6 . The method of claim 1 , wherein the second classification attribute is further based on additional information not present in the one or more values associated with one or more properties associated with the entity.
7 . The method of claim 1 , wherein the second classification attribute is based on at least one of a rule or a machine learning (ML) model.
8 . A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access network traffic via an enforcement point communicatively coupled to an entity of a network;
determine, based on the network traffic, one or more values associated with one or more properties associated with the entity;
determine, at a first classifier stage, a first classification attribute based on the one or more values using a first classification model, wherein the first classification attribute comprises a first output vector comprising a first entity classification result and a first confidence score associated with the first entity classification result;
determine, by a processing device and at the first classifier stage, a second classification attribute based on the first classification attribute and the one or more values using the first output vector and the one or more properties associated with the entity as input for a second classification model, wherein the second classification attribute comprises a second output vector comprising a second entity classification result different from the first entity classification result and a second confidence score associated with the second entity classification result, wherein the second classification attribute has a higher granularity than the first classification attribute, and the second confidence score of the second output vector is greater than the first confidence score of the first output vector, and wherein the second classification model determines the second classification attribute based on a correlation between the second classification attribute and the first classification attribute determined by applying one or more correlation rules to the first classification attribute and the one or more properties associated with the entity, the correlation rules to determine a new classification directly from a prior classification without collection of additional entity properties;
determine, at a second classifier stage and based on the second classification attribute, an enhanced classification output, wherein the first classifier stage and the second classifier stage are arranged in a distributed manner, one of the first classifier stage and the second classifier stage uses a local classification resource, and the other one of the first classifier stage and the second classifier stage uses a cloud classification resource.
9 . The system of claim 8 , wherein a first classification result comprises the first classification attribute and a second classification result comprises the second classification attribute, and wherein the second classification result is not present in the first classification result.
10 . The system of claim 8 , wherein the second classification attribute is different from the first classification attribute.
11 . The system of claim 8 , wherein the second classification attribute is further based on additional information not present in the one or more values associated with one or more properties associated with the entity.
12 . The system of claim 8 , wherein the second classification attribute is based on at least one of a rule or a machine learning (ML) model.
13 . A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic via an enforcement point communicatively coupled to an entity of a network;
determine, based on the network traffic, one or more values associated with one or more properties associated with the entity;
determine, at a first classifier stage, a first classification attribute based on the one or more values using a first classification model, wherein the first classification attribute comprises a first output vector comprising a first entity classification result and a first confidence score associated with the first entity classification result;
determine, by the processing device and at the first classifier stage, a second classification attribute based on the first classification attribute and the one or more values using the first output vector and the one or more properties associated with the entity as input for a second classification model, wherein the second classification attribute comprises a second output vector comprising a second entity classification result different from the first entity classification result and a second confidence score associated with the second entity classification result, wherein the second classification attribute has a higher granularity than the first classification attribute, and the second confidence score of the second output vector is greater than the first confidence score of the first output vector and wherein the second classification model determines the second classification attribute based on a correlation between the second classification attribute and the first classification attribute determined by applying one or more correlation rules to the first classification attribute and the one or more properties associated with the entity, the correlation rules to determine a new classification directly from a prior classification without collection of additional entity properties;
determine, at a second classifier stage and based on the second classification attribute, an enhanced classification output, wherein the first classifier stage and the second classifier stage are arranged in a distributed manner, one of the first classifier stage and the second classifier stage uses a local classification resource, and the other one of the first classifier stage and the second classifier stage uses a cloud classification resource.
14 . The non-transitory computer readable medium of claim 13 , wherein a first classification result comprises the first classification attribute and a second classification result comprises the second classification attribute, and wherein the second classification result is not present in the first classification result.