Identifying ephemeral computing assets using machine learning
Disclosed herein are methods, systems, processes, and machine learning models for identifying ephemeral or short lived computing assets in a network. Data indicative of potential ephemeralness associated with the computing assets in the network is received. The received data is processed and provided as input to a logistic machine learning model trainer for classification based on logistic regression. The logistic machine learning model trainer classifies each computing asset as ephemeral or non-ephemeral based on one or more ephemeralness feature characteristics of each of the computing assets that are part of input data. The logistic machine learning model trainer generates a trained logistic machine learning model for identifying new ephemeral computing assets in the network and excluding these new ephemeral computing assets from security operations. The logistic machine learning model is then stored for automatically determining whether a new computing asset in the network is ephemeral.
1. A computer-implemented method, comprising:
receiving data comprising an organizational unique identifier (OUI) of a Media Access Control (MAC) address associated with each of a plurality of computing assets in a network;
providing the data comprising the OUI of each of the plurality of computing assets hashed to a numeric representation as an input to a logistic machine learning model trainer;
wherein the data provided as the input to the logistic machine learning model trainer comprises only the organizational unique identifier (OUI) of the MAC address instead of the MAC address for each of the plurality of computing assets, and the OUI comprises first three octets of the MAC address;
training a logistic machine learning model to classify each of the plurality of computing assets as ephemeral or non-ephemeral based on one or more feature characteristics of each of the plurality of computing assets;
wherein the trained logistic machine learning model is configured to:
determine whether a new computing asset in the network that is not part of the plurality of computing assets is ephemeral;
generate an ephemeralness confidence score for the new computing asset;
wherein the one or more feature characteristics comprise at least a hostname, an Internet Protocol (IP) address, a Media Access Control (MAC) address, and location information of each of the plurality of computing assets; and
storing the trained logistic machine learning model.
2. The computer-implemented method of claim 1 , wherein
the plurality of computing assets comprise one or more physical computing assets and one or more virtual computing assets,
the plurality of computing assets execute in one or more networks, and
the data is collected by an agent executing on each of the plurality of computing assets.
3. The computer-implemented method of claim 2 , wherein
the new computing asset is excluded from one or more security operations by an agent manager that manages the agent executing on each of the plurality of computing assets, and
the one or more security operations comprise at least
a vulnerability assessment operation,
a vulnerability management operation,
a vulnerability validation operation, or
a penetration testing operation.
4. The computer-implemented method of claim 1 , wherein
the logistic machine learning model trainer utilizes logistic regression as a binary classification methodology for the training.
5. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
receive data comprising an organizational unique identifier (OUI) of a Media Access Control (MAC) address associated with each of a plurality of computing assets in a network;
provide the data comprising the OUI of each of the plurality of computing assets hashed to a numeric representation as an input to a logistic machine learning model trainer;
wherein the data provided as the input to the logistic machine learning model trainer comprises only the organizational unique identifier (OUI) of the MAC address instead of the MAC address for each of the plurality of computing assets, and the OUI comprises first three octets of the MAC address,
train a logistic machine learning model to classify each of the plurality of computing assets as ephemeral or non-ephemeral based on one or more feature characteristics of each of the plurality of computing assets;
wherein the trained logistic machine learning model is configured to:
determine whether a new computing asset in the network that is not part of the plurality of computing assets is ephemeral, and
generate an ephemeralness confidence score for the new computing asset,
wherein the one or more feature characteristics comprise at least a hostname, an Internet Protocol (IP) address, a Media Access Control (MAC) address, and location information of each of the plurality of computing assets; and
store the trained logistic machine learning model.
6. The system of claim 5 , wherein
the plurality of computing assets comprise one or more physical computing assets and one or more virtual computing assets,
the plurality of computing assets execute in one or more networks, and
the data is collected by an agent executing on each of the plurality of computing assets.
7. The system of claim 6 , wherein
the new computing asset is excluded from one or more security operations by an agent manager that manages the agent executing on each of the plurality of computing assets, and
the one or more security operations comprise at least a vulnerability assessment operation, a vulnerability management operation, a vulnerability validation operation, or a penetration testing operation.
8. The system of claim 5 , wherein
the logistic machine learning model trainer utilizes logistic regression as a binary classification methodology for the training.