System and method for characterizing security entities in a computing environment
System and method to characterize a security entity in a computing environment is disclosed. Communication between a user computer and at least one destination computer by a security appliance is monitored by a security appliance. Selective information from the communication is extracted by the security appliance, selective information indicative of the security entity. A plurality of words from the communication between the identified security entity and at least one destination computer are selectively extracted. A word cloud is generated based on the selectively extracted plurality of words. The word cloud is evaluated to characterize the identified security entity.
1. A method for characterizing a security entities in a computing environment, comprising:
monitoring a communication between a user computer and at least one destination computer by a security appliance;
extracting selective information from the communication by the security appliance, selective information indicative of an identity of the security entity;
selectively extracting a plurality of words from the communication between the identified security entity and at least one destination computer;
generating at least one word cloud based on the extracted plurality of words;
evaluating the word cloud to assign a characteristic to the identified security entity;
assigning words from a plurality of word clouds to one or more topic clusters; and
periodically evaluating a plurality of topic clusters and merging at least two topic clusters to generated an updated topic cluster based on a first consolidation index,
wherein at least two topic clusters are merged based on a commonality between the words in the topic clusters, indicated by a first consolidation index value.
2. The method of claim 1 , wherein each of the topic cluster is associated with a plurality of security entities and at least two topic clusters are merged based on a second consolidation index value.
3. The method of claim 1 , further including presenting the words in the word cloud on a display device by the security appliance.
4. The method of claim 1 , further including, presenting the plurality of topic clusters and associated words on a display device by the security appliance.
5. The method of claim 1 , further including, periodically classifying a subset of the topic clusters associated with the security entity as a recurring topic clusters and another subset of the topic clusters as a transient topic clusters.
6. The method of claim 5 , further including, triggering a security investigation for the security entity, when a new topic cluster associated with the security entity is classified as a transient topic cluster.
7. The method of claim 5 , wherein the security appliance will not trigger the security investigation when the new topic cluster is newly associated with a plurality of additional security entities.
8. A system to characterize a security entity in a computing environment, comprising:
a security appliance configured to
monitor a communication between a user computer and a destination computer;
extract selective information from the communication, selective information indicative of an identity of the security entity;
selectively extract a plurality of words from the communication between the identified security entity and at least one destination computer;
generate at least one word cloud based on the extracted plurality of words; and
evaluate the word cloud to assign a characteristic to the identified security entity,
wherein, words from a plurality of word clouds are assigned to one or more topic clusters;
wherein, a plurality of topic clusters are periodically evaluated and at least two topic clusters are merged to generated an updated topic cluster based on a first consolidation index; and
wherein at least two topic clusters are merged based on a commonality between the words in the topic clusters, indicated by the first consolidation index value.
9. The system of claim 8 , wherein each of the topic cluster is associated with a plurality of security entities and at least two topic clusters are merged based on a second consolidation index value.
10. The system of claim 8 , wherein the words in the word cloud are presented on a display device by the security appliance.
11. The system of claim 8 , wherein, the plurality of topic clusters and associated words are displayed on a display device by the security appliance.
12. The system of claim 8 , wherein, a subset of the topic clusters associated with the security entity are classified as a recurring topic clusters and another subset of the topic clusters are classified as a transient topic clusters.
13. The system of claim 12 , wherein, a security investigation is triggered for the security entity, when a new topic cluster associated with the security entity is classified as a transient topic cluster.
14. The system of claim 12 , wherein the security appliance will not trigger the security investigation when the new topic cluster is newly associated with a plurality of additional security entities.