Enterprise server behavior profiling
Generation of behavior profiling reports is provided for enterprise server devices in a network of enterprise server devices, as well as generation and association of severity scores for behavior profiling reports generated for enterprise server devices included in the network of enterprise server devices. A method can comprise receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device, and, as a function of the historical security event data and the owner data, an anomalous contact established between the first device and the second device can be identified. Further, in response to identifying the existence of the anomalous contact, the second device can be depicted on a connected graph of anomalous contacts established by the first device.
1. A system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
generating a severity score for a contacting device based on a weighted average value and a value representative of a number of connections made by the contacting device to a port associated with a receiving device within a defined time period, wherein the weighted average value is determined in response to identifying an anomalous contact being established by the contacting device to the receiving device and a group of anomalous contacts that have been observed to have occurred between the contacting device and the receiving device within the defined time period; and
based on the identifying and the severity score, representing, on a display device, the contacting device on a connected graph representative of anomalous contacts that have been attempted by the contacting device.
2. The system of claim 1 , wherein the operations further comprise: identifying an existence of the anomalous contact based on historical security event data representing historical security events associated with the receiving device and owner data representative of a owner identity associated with the receiving device.
3. The system of claim 2 , wherein the historical security event data is received from an intrusion detection device of a grouping of intrusion detection devices maintained by a enterprise identity.
4. The system of claim 2 , wherein the owner data is received from a database device of a grouping of database devices maintained by a regional internet registry device.
5. The system of claim 2 , wherein the owner data and the historical security event data are correlated based on internet protocol address data.
6. The system of claim 1 , wherein the defined time period is a first defined time period, and wherein the operations further comprise determining an existence of the anomalous contact as a function of the contacting device being determined to have failed to establish a contact with the receiving device within a second defined time period.
7. The system of claim 1 , wherein the operations further comprise connecting a representation of the contacting device and a representation of the receiving device depicted on the connected graph with an edge that represents a connection between the contacting device and the receiving device.
8. The system of claim 1 , wherein the receiving device and the contacting device are associated with a group of geographically distributed network of devices.
9. The system of claim 1 , wherein the operations further comprise: using a white-list of devices that have been accorded a defined privilege.
10. A method, comprising:
in response to identifying an errant contact attempt made by a connecting device to a receiving device, determining, by a device comprising a processor, a weighted average value based on the errant contact attempt and a grouping of errant contact attempts that have been observed to have been attempted by the connecting device to the receiving device within a determined time period;
determining, by the device, a value representing a number of attempted contacts made by the connecting device to a port associated with the receiving device within the determined time period;
determining, by the device, a severity score for a connecting device based on the weighted average value and the value; and
in response to the identifying and the severity score, displaying, by the device, on a display device a representation of the connecting device on a representation of a connected graph representing errant contact attempts that have been attempted by the connecting device.
11. The method of claim 10 , further comprising identifying the errant contact attempt using historical event data representing security events associated with the receiving device and identity data representative of a owner identity associated with the receiving device.
12. The method of claim 11 , wherein the historical event data is obtained from a grouping of devices comprising at least a firewall device.
13. The method of claim 11 , wherein the identity data is obtained from a regional internet registry device of a grouping of regional internet registry devices.
14. The method of claim 11 , further comprising correlating, by the device, the identity data with the historical event data based on internet protocol address data.
15. The method of claim 10 , wherein the determined time period is a first time period, and further comprising determining, by the device, the errant contact attempt based on the connecting device having failed to communicate with the receiving device within a second time period.
16. The method of claim 10 , further comprising connecting, by the device, the representation of the connecting device to a representation of the receiving device with an edge representation representative of a connection between the connecting device and the receiving device.
17. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
in response to identifying a contact attempt made by a connecting device to a receiving device, determining, by a device comprising a processor, a weighted average value based on the contact attempt and a grouping of contact attempts that have been observed to have been attempted by the connecting device to the receiving device within a determined time period;
determining a value representing a number of attempted contacts made by the connecting device to a port associated with the receiving device within the determined time period;
determining a severity score for a connecting device based on the weighted average value and the value; and
in response to the identifying and the severity score, displaying on a display device a representation of the connecting device on a representation of a connected graph representing contact attempts that have been attempted by the connecting device.
18. The non-transitory machine-readable storage medium of claim 17 , wherein the operations further comprise identifying the contact attempt using historical event data representing security events associated with the receiving device and identity data representative of a owner identity associated with the receiving device.
19. The non-transitory machine-readable storage medium of claim 17 , wherein the determined time period is a first defined time period, and further comprising determining the contact attempt based on a failure of the connecting device to communicate with the receiving device within a second defined time period.
20. The non-transitory machine-readable storage medium of claim 17 , further comprising extending an edge representation between the representation of the connecting device and a representation of the receiving device, wherein the edge representation represents a connection between the connecting device and the receiving device.