Server-client determination
Systems, methods, and computer-readable media are provided for determining whether a node in a network is a server or a client. In some examples, a system can collect, from one or more sensors that monitor at least part of data traffic being transmitted via a pair of nodes in a network, information of the data traffic. The system can analyze attributes of the data traffic such as timing, port magnitude, degree of communication, historical data, etc. Based on analysis results and a predetermined rule associated with the attributes, the system can determine which node of the pair of nodes is a client and which node is a server.
1. A method comprising:
receiving, from a sensor that monitors at least part of data traffic exchanged between a pair of nodes in a network, information of the data traffic, the pair of nodes comprising a first node and a second node;
determining, based on the information, that the first node is a client and that the second node is a server;
creating one or more classifiers of servers and clients in the network from the result of the determining;
generating at least a first communication graph for the network, the first communication graph comprising the first node, the second node, and one or more other nodes; and
based on the one or more classifiers of servers and clients in the network, assigning one or more of the one or more classifiers of servers or clients to the one or more other nodes.
2. The method of claim 1 , wherein the determining is further based on one or more rules associated with timing, port magnitude, degree of communication, or historical data obtained from the information.
3. The method of claim 1 , further comprising:
associating a weight with the sensor, the weight based on one or more of accuracy, margin of error, length of time of observation, or amount of information collected by the sensor, wherein the information of the data traffic reported by the sensor is weighted using the weight.
4. The method of claim 1 , further comprising:
generating at least a second communication graph for the network, the first communication graph and the second communication graph associated with a first time period and a second time period, respectively.
5. The method of claim 4 , further comprising:
determining combined influences between the first communication graph and the second communication graph.
6. The method of claim 1 , further comprising:
determining confidence levels associated with the classifiers of servers and clients in the network; and
propagating the confidence levels to one or more of the first node, the second node, or the one or more other nodes.
7. A system, comprising:
one or more processors; and
a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more processors, cause the one or more processors to perform operations including:
receiving, from a sensor that monitors at least part of data traffic exchanged between a pair of nodes in a network, information of the data traffic, the pair of nodes comprising a first node and a second node;
determining, based on the information, that the first node is a client and that the second node is a server;
creating one or more classifiers of servers and clients in the network from the result of the determining;
generating at least a first communication graph for the network, the first communication graph comprising the first node, the second node, and one or more other nodes; and
based on the one or more classifiers of servers and clients in the network, assigning one or more of the one or more classifiers of servers or clients to the one or more other nodes.
8. The system of claim 7 , wherein the determining is further based on one or more rules associated with timing, port magnitude, degree of communication, or historical data obtained from the information.
9. The system of claim 7 , wherein the operations further comprise:
associating a weight with the sensor, the weight based on one or more of accuracy, margin of error, length of time of observation, or amount of information collected by the sensor, wherein the information of the data traffic reported by the sensor is weighted using the weight.
10. The system of claim 7 , wherein the operations further comprise:
generating at least a second communication graph for the network, the first communication graph and the second communication graph associated with a first time period and a second time period, respectively.
11. The system of claim 10 , wherein the operations further comprise:
determining combined influences between the first communication graph and the second communication graph.
12. The system of claim 7 , wherein the operations further comprise:
determining confidence levels associated with the classifiers of servers and clients in the network; and
propagating the confidence levels to one or more of the first node, the second node, or the one or more other nodes.
13. A non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to perform operations including:
receiving, from a sensor that monitors at least part of data traffic exchanged between a pair of nodes in a network, information of the data traffic, the pair of nodes comprising a first node and a second node;
determining, based on the information, that the first node is a client and that the second node is a server;
creating one or more classifiers of servers and clients in the network from the result of the determining;
generating at least a first communication graph for the network, the first communication graph comprising the first node, the second node, and one or more other nodes; and
based on the one or more classifiers of servers and clients in the network, assigning one or more of the one or more classifiers of servers or clients to the one or more other nodes.
14. The non-transitory machine-readable storage medium of claim 13 , wherein the determining is further based on one or more rules associated with timing, port magnitude, degree of communication, or historical data obtained from the information.
15. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise:
associating a weight with the sensor, the weight based on one or more of accuracy, margin of error, length of time of observation, or amount of information collected by the sensor, wherein the information of the data traffic reported by the sensor is weighted using the weight.
16. The non-transitory machine-readable storage medium of claim 13 , wherein the operations further comprise:
generating at least a second communication graph for the network, the first communication graph and the second communication graph associated with a first time period and a second time period, respectively.
17. The non-transitory machine-readable storage medium of claim 13 , wherein the operations further comprise:
determining confidence levels associated with the classifiers of servers and clients in the network; and
propagating the confidence levels to one or more of the first node, the second node, or the one or more other nodes.