GRAPH-BASED VISUALIZATIONS OF NETWORK FLOWS USING ENTITY CLUSTERING

1 . A method for providing a graphical user interface (“GUI”) for graph-based visualizations of network flows using entity clustering, comprising:

assigning entities in the network to a first set of clusters according to a first clustering type;

creating metadata relating to each cluster in the first set of clusters;

receiving a first selection of a first entity and a second selection of the first clustering type;

determining that a second entity does not have a cluster assignment;

creating, based on the metadata, a best guess cluster assignment for the second entity; and

displaying, in a GUI, a visualization of the first set of clusters according to the first clustering type, including displaying the second entity as part of a cluster in the first set of clusters corresponding to the best guess assignment.

2 . The method of claim 1 , wherein creating the metadata comprises:

calculating, for each cluster in the first set of clusters, an average name length of entities in the cluster;

determining, for each cluster in the first set of clusters, a most frequent character at each character location in the names of the entities in the cluster; and

generating a meta name for each cluster in the first set of clusters, wherein the meta name has a name length equal to the average name length of entities assigned to the corresponding cluster and each character in the meta name being the most frequent character at the character location in the names of the entities in the cluster.

3 . The method of claim 2 , wherein creating the best guest cluster assignment comprises:

comparing a name of the second entity to meta names of clusters in the first cluster set;

determining which meta name most closely matches the name of the second entity; and

assigning the second entity to the cluster in the first cluster set corresponding to the most closely matched meta name.

4 . The method of claim 1 , further comprising:

prior to receiving the first user selection, saving the entity assignments to a cache; and

prior to displaying the visualization of entities:

saving the best guest cluster assignment of the second entity to the cache;

retrieving the entity assignments and the best guest cluster assignment from the cache; and

generating a GUI canvas based on the entity assignments and the best guest cluster assignment.

5 . The method of claim 1 , further comprising:

receiving a third selection of a second clustering type, the second clustering type being based on tags assigned to entities in the network;

retrieving, from a database, information on entity-to-tag mappings;

assigning, based on the mappings, each entity with a mapped tag to a second set of clusters; and

modifying, in the GUI, the visualization of the entities according to assignments of each entity with a mapped tag to the second set of clusters.

6 . The method of claim 1 , wherein the entities are assigned to the first set of clusters based on at least one of:

similar names of the entities;

processes running on the entities;

network flows between entities; and

security events associated with the entities.

7 . The method of claim 1 , wherein the entities include an entity selected from at least one of a workload and virtual machine.

8 . A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, causes the processor to perform stages for providing a graphical user interface (“GUI”) for graph-based visualizations of network flows using entity clustering, the stages comprising:

assigning entities in the network to a first set of clusters according to a first clustering type;

creating metadata relating to each cluster in the first set of clusters;

receiving a first selection of a first entity and a second selection of the first clustering type;

determining that a second entity does not have a cluster assignment;

creating, based on the metadata, a best guess cluster assignment for the second entity; and

displaying, in a GUI, a visualization of the first set of clusters according to the first clustering type, including displaying the second entity as part of a cluster in the first set of clusters corresponding to the best guess assignment.

9 . The non-transitory, computer-readable medium of claim 8 , wherein creating the metadata comprises:

calculating, for each cluster in the first set of clusters, an average name length of entities in the cluster;

determining, for each cluster in the first set of clusters, a most frequent character at each character location in the names of the entities in the cluster; and

generating a meta name for each cluster in the first set of clusters, wherein the meta name has a name length equal to the average name length of the corresponding cluster and each character in the meta name being the most frequent character at the character location in the names of the entities in the cluster.

10 . The non-transitory, computer-readable medium of claim 10 , wherein creating the best guest cluster assignment comprises:

comparing a name of the second entity to meta names of clusters in the first cluster set;

determining which meta name most closely matches the name of the second entity; and

assigning the second entity to the cluster in the first cluster set corresponding to the most closely matched meta name.

11 . The non-transitory, computer-readable medium of claim 8 , the stages further comprising:

prior to receiving the first user selection, saving the entity assignments to a cache; and

prior to displaying the visualization of entities:

saving the best guest cluster assignment of the second entity to the cache,

retrieving the entity assignments and the best guest cluster assignment from the cache, and

generating a GUI canvas based on the entity assignments and the best guest cluster assignment.

12 . The non-transitory, computer-readable medium of claim 8 , the stages further comprising:

receiving a third selection of a second clustering type, the second clustering type being based on tags assigned to entities in the network;

retrieving, from a database, information on entity-to-tag mappings;

assigning, based on the mappings, each entity with a mapped tag to a second set of clusters; and

modifying, in the GUI, the visualization of the entities according to assignments of each entity with a mapped tag to the second set of clusters.

13 . The non-transitory, computer-readable medium of claim 8 , wherein the entities are assigned to the first set of clusters based on one selected from:

similar names of the entities,

processes running on the entities,

network flows between entities, and

security events associated with the entities.

14 . The non-transitory, computer-readable medium of claim 8 , wherein the entities include an entity selected from at least one of a workload and virtual machine.

15 . A system for providing a graphical user interface (“GUI”) for graph-based visualizations of network flows using entity clustering, comprising:

a memory storage including a non-transitory, computer-readable medium comprising instructions; and

a hardware-based processor that executes the instructions to carry out stages comprising:

assigning entities in the network to a first set of clusters according to a first clustering type;

creating metadata relating to each cluster in the first set of clusters;

receiving a first user selection of a first entity and a second selection of the first clustering type;

determining that a second entity does not have a cluster assignment;

creating, based on the metadata, a best guess cluster assignment for the second entity; and

displaying, in a GUI, a visualization of the first set of clusters according to the first clustering type, including displaying the second entity as part of a cluster in the first set of clusters corresponding to the best guess assignment.

16 . The system of claim 15 , wherein creating the metadata comprises:

calculating, for each cluster in the first set of clusters, an average name length of entities in the cluster;

determining, for each cluster in the first set of clusters, a most frequent character at each character location in the names of the entities in the cluster; and

generating a meta name for each cluster in the first set of clusters, wherein the meta name has a name length equal to the average name length of the corresponding cluster and each character in the meta name being the most frequent character at the character location in the names of the entities in the cluster.

17 . The system of claim 16 , wherein creating the best guest cluster assignment comprises:

comparing a name of the second entity to meta names of clusters in the first cluster set;

determining which meta name most closely matches the name of the second entity; and

assigning the second entity to the cluster in the first cluster set corresponding to the most closely matched meta name.

18 . The system of claim 15 , the stages further comprising:

prior to receiving the first user selection, saving the entity assignments to a cache; and

prior to displaying the visualization of entities:

saving the best guest cluster assignment of the second entity to the cache,

retrieving the entity assignments and the best guest cluster assignment from the cache, and

generating a GUI canvas based on the entity assignments and the best guest cluster assignment.

19 . The system of claim 15 , the stages further comprising:

receiving a third selection of a second clustering type, the second clustering type being based on tags assigned to entities in the network;

retrieving, from a database, information on entity-to-tag mappings;

assigning, based on the mappings, each entity with a mapped tag to a second set of clusters; and

modifying, in the GUI, the visualization of the entities according to assignments of each entity with a mapped tag to the second set of clusters.

20 . The system of claim 15 , wherein the entities are assigned to the first set of clusters based on one of:

similar names of the entities;

processes running on the entities;

network flows between entities; and

security events associated with the entities.