Machine learning techniques for associating network addresses with information object access locations
Disclosed embodiments includes a network classification system (NCS) that generates a set of machine learning (ML) features from information about information objects accessed by various users, and determines an organization (org) type associated with the network address based on the set of ML features. Obtained network events may include the information about the accessed information objects. A content consumption monitor (CCM) generates consumption scores for the network addresses based on the identified org types. The CCM can generate more accurate intent and consumption data by filtering out events unrelated to content consumption for that org type. The NCS and the CCM may be implemented as the same network function, or the NCS and CCM may be implemented as separate network functions. Other embodiments may be described and/or claimed.
1 . One or more non-transitory computer readable media (NTCRM) comprising instructions for analyzing network events associated with a network address, wherein execution of the instructions by one or more processors is operable to cause a computing system to:
receive, from a service provider, network events including information about users accessing information objects from the network address;
generate, using a feature generator, a set of ML features from the information about the users accessing the information objects, wherein the set of ML features includes:
time-based features indicating percentages of the network events that occur at different time periods at respective locations, including ratios of events during business hours versus non-business hours,
duration-based features indicating an average amount of time individual users access the information objects at the respective locations,
event-based features indicating an average amount of the network events generated by individual users at the respective locations, and
device-based features indicating types of computing devices used for accessing the information objects at the respective locations;
train a ML model using labeled training data comprising known private organization locations, known public organization locations, and known non-organization locations;
determine an organization (org) type associated with the network address based on the set of ML features by classifying, using the trained ML model, the network address as associated with one of a private organization based at least on detecting when a ratio of events during business hours is above a threshold and a majority of the types of computing devices comprise desktop or laptop computers, a public organization based at least on detecting extended hours of activity and diverse device types, or a non-organization based at least on patterns distinct from private and public organizations;
calculate consumption scores for the network addresses based on the determined org;
filter network traffic based on the calculated consumption scores to improve network resource utilization; and
retrain, periodically, the ML model using newly received network events to improve classification accuracy.
2 . The one or more NTCRM of claim 1 , wherein to generate the set of ML features, execution of the instructions is further operable to cause the computing system to:
identify a time range associated with operation of each org type of a set of org types; and
determine, for each org type, a ratio of a number of the network events generated within the identified time range to a number of the network events generated outside of the identified time range,
wherein the ratio is generated to be at least one ML feature of the set of ML features.
3 . The one or more NTCRM of claim 2 , wherein execution of the instructions is further operable to cause the computing system to:
determine the org type to be a private org location when the ratio is above the threshold; and
determine the org type to be a public org location or a non-org location when the ratio is below the threshold.
4 . The one or more NTCRM of claim 1 , wherein to generate the set of ML features, execution of the instructions is further operable to cause the computing system to:
identify one or more days associated with operation of each org type of a set of org types; and
determine, for each org type, a ratio of a number of the network events generated on the one or more days to a number of the network events generated on other days different than the one or more days,
wherein the ratio is generated to be at least one ML feature of the set of ML features.
5 . The one or more NTCRM of claim 1 , wherein at least one ML feature of the set of ML features indicates a duration of the user accesses of the information objects, and execution of the instructions is further operable to cause the computing system to:
identify the org type associated with the network address based on the at least one ML feature indicating the duration of the user accesses.
6 . The one or more NTCRM of claim 1 , wherein at least one ML feature of the set of ML features indicates device types used to access the information objects from the network address, and execution of the instructions is further operable to cause the computing system to:
identify the org type based on the at least one ML feature indicating the device types.
7 . The one or more NTCRM of claim 6 , wherein execution of the instructions is further operable to cause the computing system to:
determine a number of laptop computers used to access the information objects from the network address, a number of desktop computers used to access the information objects from the network address, and a number of mobile devices used to access the information objects from the network address;
determine the org type to be a private org location when a ratio of the number of laptop computers and the number of desktop computers to the number of mobile devices is at or above a threshold; and
determine the org type to be a public org location when the ratio is below the threshold.
8 . The one or more NTCRM of claim 1 , wherein execution of the instructions is further operable to cause the computing system to:
identify a domain for the network address when the org type associated with the network address is identified as a private org location; and
generate a consumption score for the domain when the org type associated with the network address is identified as a private org location.
9 . An apparatus to be employed as network address classification system (NACS), the apparatus comprising:
at least one processor; and
a memory device communicatively coupled with the at least one processor, the memory device storing one or more sequences of instructions, and the at least one processor is configurable to:
operate a feature generator to generate a set of ML features based on aspects of user accesses to information objects indicated by received network session events from a service provider, the network session events indicating network addresses associated with locations from which the information objects are accessed by the users, wherein the set of ML features includes:
time-based features indicating percentages of the network events that occur at different time periods at respective locations, including ratios of events during business hours versus non-business hours,
duration-based features indicating an average amount of time individual users access the information objects at the respective locations,
event-based features indicating an average amount of the network events generated by individual users at the respective locations, and
device-based features indicating types of computing devices used for accessing the information objects at the respective locations;
train a ML model using labeled training data comprising known private organization locations, known public organization locations, and known non-organization locations
operate the ML model to determine organization (org) types associated with the locations from which the information objects are accessed based on the ML features by classifying the network address as associated with one of a private organization based at least on detecting when a ratio of events during business hours is above a threshold and a majority of the types of computing devices comprise desktop or laptop computers, a public organization based at least on detecting extended hours of activity and diverse device types, or a non-organization based at least on patterns distinct from private and public organizations;
calculate consumption scores for the network addresses based on the determined org type;
filter network traffic based on the calculated consumption scores to improve network resource utilization; and
retrain, periodically, the ML model using newly received network events to improve classification accuracy.
10 . The apparatus of claim 9 , wherein the network session events include timestamps indicating a time at which the users accessed the information objects, and the at least one processor is configurable to:
operate the feature generator to generate the set of ML features to include one or more time-based features, the one or more time-based features indicating a time of day when individual users accessed the information objects at the respective locations based on the timestamps and percentages of the events that occur at different time periods at the respective locations; and
operate the ML model to determine the org types associated with the network addresses based on the one or more time-based features.
11 . The apparatus of claim 10 , wherein the at least one processor is configurable to operate the ML model to:
determine the org type associated with the network addresses to be private org locations when the one or more time-based features indicate that some or all of the information objects were accessed outside of a specified time period.
12 . The apparatus of claim 9 , wherein the at least one processor is configurable to operate the ML model to:
determine the org type associated with the network addresses to be private org locations when the one or more duration-based features indicate that some or all of the information objects were accessed for a threshold amount of time.
13 . The apparatus of claim 9 , wherein the at least one processor is configurable to:
operate the ML model to determine the org types associated with the network addresses based on the one or more event-based features.
14 . The apparatus of claim 9 , wherein the at least one processor is configurable to:
operate the ML model to determine the org types associated with the network addresses based on the one or more device-based features.
15 . The apparatus of claim 9 , wherein to operate the ML model to determine the org types, the at least one processor is configurable to:
use a logistic regression model to determine the org types.
16 . The apparatus of claim 9 , wherein the at least one processor is configurable to operate a content consumption monitor to:
filter the network addresses based on the org types associated with the network addresses;
calculate consumption scores for the filtered network addresses;
identify a number of events associated with the network addresses over a series of time periods;
adjust the consumption scores based on changes in the number of events over the series of time periods; and
determine surge scores based on an increase in respective consumption scores within a predefined period of time.
17 . The one or more NTCRM of claim 1 , wherein execution of the instructions is further operable to cause the computing system to:
filter the network addresses to determine the network addresses classified as private organizations;
identify a number of events associated with the network addresses over a series of time periods;
adjust the consumption scores based on changes in the number of events over the series of time periods; and
determine topic scores and surge scores based on an increase in respective consumption scores within a predefined period of time.
18 . The one or more NTCRM of claim 1 further comprising, apply network security policies based on the determined org types to improve security.
19 . The apparatus of claim 9 further comprising, apply network security policies based on the determined org types to improve security.