Behavioral based device clustering

1. A method comprising:

receiving, via a network connection with a plurality of devices, a log including network traffic of the plurality of devices in a network;

extracting, from the log, a plurality of features of the plurality of devices;

aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, wherein each entry of the plurality of entries is specific to one particular device and includes, for a combination of a particular feature and the particular device, a value based on a respective plurality of events having the particular feature for the particular device;

clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups; and

assigning one or more devices of the plurality of devices on the network to one of the plurality of device groups to obtain an assignment.

2. The method of claim 1 , further comprising:

updating the assignment of the one or more devices of the plurality of devices to the one of the plurality of device groups when the log is updated.

3. The method of claim 1 , wherein clustering the plurality of devices comprises:

selecting a traffic behavior subset of the aggregated feature matrix corresponding to traffic behavior;

applying the topic modeling algorithm to the traffic behavior subset to obtain a plurality of traffic behavior device groups;

selecting an application behavior subset of the aggregated feature matrix corresponding to application behavior; and

applying, per a traffic behavior device group of the plurality of traffic behavior device groups, the topic modeling algorithm to the application behavior subset to obtain a plurality of application behavior device subgroups,

wherein the plurality of device groups is the plurality of application behavior device subgroups.

4. The method of claim 1 , wherein clustering the plurality of devices comprises:

defining a particular device group of the plurality of device groups matching a plurality of behavior groups.

5. The method of claim 1 , further comprising:

preprocessing a plurality of log entries of the log to remove extraneous information from the plurality of log entries and obtain a preprocessed log, wherein the plurality of features is extracted from the preprocessed log.

6. The method of claim 1 , wherein aggregating the plurality of features comprises:

totaling a number of instances of an application matching an application type being associated, in the log, with the particular device of the plurality of devices; and

storing the number of instances in an entry of the aggregated feature matrix matching the particular device and the particular feature corresponding to the application type.

7. The method of claim 1 , further comprising:

establishing the network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and an analyzer server;

receiving source data at the server group from at least one of the one or more source network nodes via a respective network connection and transforming, by the indexer server, the source data to a plurality of timestamped entries of machine data, the plurality of timestamped entries corresponding to a plurality of log entries of the log; and

storing the plurality of timestamped entries in a data store,

wherein aggregating the plurality of features comprises:

obtaining a device identifier of the particular device in the plurality of devices;

querying the data store for a subset of the plurality of timestamped entries that each comprise the device identifier; and

aggregate the plurality of features in the subset of the plurality of timestamped entries into a feature set for the device, the feature set being in the aggregated feature matrix.

8. The method of claim 1 , wherein the receiving the log comprises:

receiving the log of one or more devices from a firewall device.

9. The method of claim 1 , wherein the aggregating, per device of the plurality of devices, comprises:

aggregating, for the particular device, the plurality of features of the particular device into a portion of the aggregated feature matrix corresponding to the particular device, wherein the aggregated feature matrix describes one or more of an application used by the particular device, a destination of data sent by the particular device, and whether the data sent by the particular device crosses a firewall.

10. A system comprising:

memory comprising instructions; and

a computer processor for executing the instructions that cause the computer processor to perform operations comprising:

receiving, via a network connection with a plurality of devices, a log including network traffic of the plurality of devices in a network;

extracting, from the log, a plurality of features of the plurality of devices;

aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, each entry of the plurality of entries specific to one particular device and including, for a combination of a particular feature and the particular device, a value based on a respective plurality of events having the particular feature for the particular device;

clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups; and

assigning the plurality of devices on the network to one of the plurality of device groups to obtain an assignment.

11. The system of claim 10 , wherein the operations further comprise:

updating the assignment of one or more devices of the plurality of devices to the one of the plurality of device groups when the log is updated.

12. The system of claim 10 , wherein clustering the plurality of devices comprises:

selecting a traffic behavior subset of the aggregated feature matrix corresponding to traffic behavior;

applying the topic modeling algorithm to the traffic behavior subset to obtain a plurality of traffic behavior device groups;

selecting an application behavior subset of the aggregated feature matrix corresponding to application behavior; and

applying, per a traffic behavior device group of the plurality of traffic behavior device groups, the topic modeling algorithm to the application behavior subset to obtain a plurality of application behavior device subgroups,

wherein the plurality of device groups is the plurality of application behavior device subgroups.

13. The system of claim 10 , wherein clustering the plurality of devices comprises:

generating, by applying the topic modeling algorithm to the aggregated feature matrix, a topic feature matrix comprising a plurality of feature scores for each of a plurality of topics;

generating, by the topic modeling algorithm using the aggregated feature matrix and the topic feature matrix, a device topic matrix comprising a plurality of device topic scores for a device in the plurality of devices; and

assigning, by applying a Bayesian classifier to the plurality of device topic scores of the device, a device group to the device.

14. The system of claim 10 , wherein clustering the plurality of devices comprises:

defining a particular device group of the plurality of device groups matching a plurality of behavior groups.

15. The system of claim 10 , wherein the operations further comprise:

preprocessing a plurality of log entries of the log to remove extraneous information from the plurality of log entries and obtain a preprocessed log, wherein the plurality of features is extracted from the preprocessed log.

16. The system of claim 10 , wherein aggregating the plurality of features comprises:

totaling a number of instances of an application matching an application type being associated, in the log, with the particular device of the plurality of devices; and

storing the number of instances in an entry of the aggregated feature matrix matching the particular device and the particular feature corresponding to the application type.

17. A non-transitory computer-readable storage medium storing computer-readable program code which, when executed by one or more processors, cause the one or more processors to perform operations, comprising:

receiving, via a network connection with a plurality of devices, a log including network traffic of the plurality of devices in a network;

extracting, from the log, a plurality of features of the plurality of devices;

aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, each entry of the plurality of entries specific to one particular device and including, for a combination of a particular feature and the particular device, a value based on a respective plurality of events having the particular feature for the particular device;

clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups; and

assigning one or more devices of the plurality of devices on the network to one of the plurality of device groups to obtain an assignment.

18. The non-transitory computer-readable storage medium of claim 17 , the operations further comprising:

updating the assignment of the one or more devices of the plurality of devices to the one of the plurality of device groups when the log is updated.

19. The non-transitory computer-readable storage medium of claim 17 , wherein clustering the plurality of devices comprises:

selecting a traffic behavior subset of the aggregated feature matrix corresponding to traffic behavior;

applying the topic modeling algorithm to the traffic behavior subset to obtain a plurality of traffic behavior device groups;

selecting an application behavior subset of the aggregated feature matrix corresponding to application behavior; and

applying, per a traffic behavior device group of the plurality of traffic behavior device groups, the topic modeling algorithm to the application behavior subset to obtain a plurality of application behavior device subgroups,

wherein the plurality of device groups is the plurality of application behavior device subgroups.

20. The non-transitory computer-readable storage medium of claim 17 , wherein aggregating the plurality of features comprises:

totaling a number of instances of an application matching an application type being associated, in the log, with the particular device of the plurality of devices; and

storing the number of instances in an entry of the aggregated feature matrix matching the particular device and a particular feature corresponding to the application type.