System and method for analyzing network objects in a cloud environment
A method and system for determining abnormal configuration of network objects deployed in a cloud computing environment are provided. The method includes collecting network object data on a plurality of network objects deployed in the cloud computing environment; constructing a network graph based on the collected network object data, wherein the network graph includes a visual representation of network objects identified in the cloud computing environment; determining relationships between the identified network objects in the network graph, wherein the determined relationships between the identified network objects includes descriptions of connections between the identified network objects; and analyzing the network graph and the determined relationships to generate insights, wherein the generated insights include at least a list of abnormal connections between the identified network objects.
1. A method for determining abnormal configuration of network objects deployed in a cloud computing environment, comprising:
collecting network object data on a plurality of network objects deployed in the cloud computing environment;
constructing a network graph based on the collected network object data, wherein the network graph includes a visual representation of network objects identified in the cloud computing environment;
determining relationships between the identified network objects in the network graph, wherein the determined relationships between the identified network objects includes descriptions of connections between the identified network objects;
analyzing the network graph and the determined relationships to generate insights, wherein the generated insights include at least a list of abnormal connections between the identified network objects; and
tagging network objects in the network graph for which the insight is generated.
2. The method of claim 1 , wherein the cloud computing environment includes a plurality of different cloud computing platforms.
3. The method of claim 2 , wherein collecting network object data further comprises:
connecting through an application programing interface (API) each of the plurality of different cloud computing platforms to collect network object data of network objects deployed in the respective cloud computing platform.
4. The method of claim 1 , wherein generating insights to include at least the list of abnormal connections further comprises:
detecting any one of: a rare network configuration, a novel network configuration, a rare network event, a novel network event, a connection of a new device to a network, an unauthorized connection, a re-connection of a user device to a subnet which the user is not permitted to access, a connection demonstrating anomalous behavior or misconfiguration, and a connection demonstrating spikes of network activity.
5. The method of claim 4 , further comprising:
determining impermissible relationships between the network objects.
6. The method of claim 1 , wherein determining relationships between the identified objects further comprises:
determining the relationships using a static analytic method.
7. The method of claim 1 , wherein determining the relationships between the identified network objects in further comprises:
determining the relationships using at least one of: observational methods, and active logging methods.
8. The method of claim 1 , further comprising:
adding visual representations of the determined relationships to the visual representations of the network graph.
9. The method of claim 1 , wherein each of the plurality of network objects includes any one of: a virtual network, a firewall, a network interface card, a proxy, a gateway, a software container, container, a management object, a virtual machine, a subnet, a hub, a virtual private network (VPN).
10. The method of claim 1 , wherein a generated insight of the generated insights is generated utilizing natural language representation.
11. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for determining abnormal configuration of network objects deployed in a cloud computing environment, the process comprising:
collecting network object data on a plurality of network objects deployed in the cloud computing environment;
constructing a network graph based on the collected network object data, wherein the network graph includes a visual representation of network objects identified in the cloud computing environment;
determining relationships between the identified network objects in the network graph, wherein the determined relationships between the identified network objects includes descriptions of connections between the identified network objects;
analyzing the network graph and the determined relationships to generate insights, wherein the generated insights include at least a list of abnormal connections between the identified network objects; and
tagging network objects in the network graph for which the insight is generated.
12. A system for determining abnormal configuration of network objects deployed in a cloud computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
collect network object data on a plurality of network objects deployed in the cloud computing environment;
construct a network graph based on the collected network object data, wherein the network graph includes a visual representation of network objects identified in the cloud computing environment;
determine relationships between the identified network objects in the network graph, wherein the determined relationships between the identified network objects includes descriptions of connections between the identified network objects;
analyze the network graph and the determined relationships to generate insights, wherein the generated insights include at least a list of abnormal connections between the identified network objects; and
tagging network objects in the network graph for which the insight is generated.
13. The system of claim 12 , wherein the cloud computing environment includes a plurality of different cloud computing platforms.
14. The system of claim 13 , wherein the system is further configured to:
connect through an application programing interface (API) each of the plurality of different cloud computing platforms to collect network object data of network objects deployed in the respective cloud computing platform.
15. The system of claim 12 , wherein the system is further configured to:
detect any one of: a rare network configuration, a novel network configuration, a rare network event, a novel network event, a connection of a new device to a network, an unauthorized connection, a re-connection of a user device to a subnet which the user is not permitted to access, a connection demonstrating anomalous behavior or misconfiguration, and a connection demonstrating spikes of network activity.
16. The system of claim 12 , wherein the system is further configured to:
determine impermissible relationships between the network objects.
17. The system of claim 12 , wherein the system is further configured to:
determine the relationships using a static analytic method.
18. The system of claim 12 , wherein the system is further configured to:
determine the relationships using at least one of: observational methods, and active logging methods.
19. The system of claim 12 , wherein the system is further configured to:
adding visual representations of the determined relationships to the visual representations of the network graph.
20. The system of claim 12 , wherein each of the plurality of network objects includes any one of: a virtual network, a firewall, a network interface card, a proxy, a gateway, a software container, container, a management object, a virtual machine, a subnet, a hub, a virtual private network (VPN).
21. The system of claim 12 , wherein a generated insight of the generated insights is generated utilizing natural language representation.