GRAPH ANALYSIS-BASED ASSESSMENT TO DETERMINE RELATIVE NODE SIGNIFICANCE
Various embodiments include systems and methods to implement a graph analysis-based assessment to determine relative node significance. Network traffic data associated with a network may be obtained. A graph analysis-based assessment of the network may be performed to determine network traffic paths between a plurality of nodes in the network based at least in part on the network traffic data and to calculate, for each node and based at least in part on the network traffic paths, a respective centrality value. The respective centrality value may be indicative of a respective node being a potential source of disruption to the network relative to other nodes. At least one significant node in the network may be identified based at least in part on the centrality values, and a particular action to be performed with respect to the at least one significant node may be determined.
1 .- 20 . (canceled)
21 . A system, comprising:
one or more hardware processors with associated memory that implement an intrusion detection system (IDS), configured to:
monitor network traffic data in a network;
perform a graph analysis-based assessment of the network, comprising:
determining, based at least in part on the network traffic data, a graph of network traffic paths among a plurality of nodes in the network; and
calculating, based at least in part on the graph, centrality values for individual ones of the plurality of nodes, wherein a centrality value of a given node comprises a betweenness centrality value that indicates a number of shortest paths between two other nodes in the graph that traverses through the given node;
identify, based at least in part on the graph and the centrality values, a significant node in the network, wherein the significant node is determined to be, compared to other nodes of the network, a greater source of potential harm to the network if the significant is attacked or infected; and
in response to the identification of the significant node, cause the IDS to prioritize monitoring of the significant node.
22 . The system of claim 21 , wherein
the centrality values include different types of centrality values for individual nodes, including two or more of: an undirected centrality value; an in-degree centrality value; an out-degree centrality value; or an Eigenvector centrality value.
23 . The system of claim 21 , wherein
the significant node is identified without accounting for intrinsic attributes of the significant node, including:
users who use the significant node, and
a node type of the significant node.
24 . The system of claim 23 , wherein
the significant node is identified without accounting for intrinsic attributes of peer nodes connected to the significant node in the graph.
25 . The system of claim 21 , wherein
the significant node is identified based on a sensitivity type of information stored or received by the significant node.
26 . The system of claim 21 , wherein
the centrality value of the given node is dependent on an amount of traffic flow through the given node relative to other nodes in the network.
27 . The system of claim 21 , wherein
the prioritized monitoring of the significant node enables the IDS to detect anomalous network behavior of a peer node connected to the significant node in the graph without directly monitoring the peer node.
28 . The system of claim 21 , wherein
information generated by the graph analysis-based assessment is used to establish an alert mechanism for the network.
29 . The system of claim 28 , wherein
the alert mechanism is established based on user input received via a user interface, wherein the user interface displays one or more of the centrality values.
30 . The system of claim 21 , wherein
information concerning the identification of the significant node is used by a network management system to perform one or more actions with respect to the significant node, to:
prioritize patching of the significant node,
prioritize monitoring of the significant node,
control when the significant node can be taken offline,
implement stricter network segmentation in the network to protect the significant node, or
add an additional firewall to protect the significant node.
31 . A method comprising:
executing an intrusion detection system (IDS) implemented by one or more hardware processors with associated memory, comprising:
determining, based at least in part on the network traffic data, a graph of network traffic paths among a plurality of nodes in the network;
calculating, based at least in part on the graph, centrality values for individual ones of the plurality of nodes, wherein a centrality value of a given node comprises a betweenness centrality value that indicates a number of shortest paths between two other nodes in the graph that traverses through the given node;
identifying, based at least in part on the graph and the centrality values, a significant node in the network, wherein the significant node is determined to be, compared to other nodes of the network, a greater source of potential harm to the network if the significant is attacked or infected; and
in response to the identification of the significant node, causing the IDS to prioritize monitoring of the significant node.
32 . The method of claim 31 , wherein
the centrality values include different types of centrality values for individual nodes, including two or more of: an undirected centrality value; an in-degree centrality value; an out-degree centrality value; or an Eigenvector centrality value.
33 . The method of claim 31 , wherein
the significant node is identified without accounting for intrinsic attributes of the significant node, including:
users who use the significant node, and
a node type of the significant node.
34 . The method of claim 33 , wherein
the significant node is identified without accounting for intrinsic attributes of peer nodes connected to the significant node in the graph.
35 . The method of claim 31 , wherein
the significant node is identified based on a sensitivity type of information stored or received by the significant node.
36 . The method of claim 31 , wherein
the centrality value of the given node is dependent on an amount of traffic flow through the given node relative to other nodes in the network.
37 . The method of claim 31 , wherein
the prioritized monitoring of the significant node enables the IDS to detect anomalous network behavior of a peer node connected to the significant node in the graph without directly monitoring the peer node.
38 . The method of claim 31 , wherein
information generated by the graph analysis-based assessment is used to establish an alert mechanism for the network.
39 . The method of claim 38 , wherein
the alert mechanism is established based on user input received via a user interface, wherein the user interface displays one or more of the centrality values.
40 . The method of claim 31 , wherein
information concerning the identification of the significant node is used by a network management system to perform one or more actions with respect to the significant node, to:
prioritize patching of the significant node,
prioritize monitoring of the significant node,
control when the significant node can be taken offline,
implement stricter network segmentation in the network to protect the significant node, or
add an additional firewall to protect the significant node.