Scope discovery and policy generation in an enterprise network

1. A method comprising:

identifying one or more communities of devices in an enterprise network, each of the community of devices being defined by a group of the devices with at least a threshold number of communications among themselves, but less than the threshold number of communications with other devices;

defining, from the one or more communities of devices, policy scopes in the enterprise network, the policy scopes defining how network traffic is managed within the network;

generating a hierarchical representation of the policy scopes;

identifying, based on the hierarchical representation of the policy scopes, one or more policies governing traffic flow between devices associated with each of the policy scopes, comprising:

selecting a node in the hierarchical representation corresponding to a policy scope;

identifying the one or more policies as policies governing traffic flow involving descendent nodes of the selected node; and

managing application of the one or more policies at the devices corresponding to a sub-tree of the selected node and descendent nodes of the selected node;

wherein managing application of the one or more policies includes one or more of:

generating a minimal policy set for one or more of the policy scopes;

deleting a redundant policy of the one or more policies; and

generating a new policy for at least one of the policy scopes;

wherein generating the minimal policy set comprises:

identifying, from among the one or more policies, at least one policy implemented in a policy scope with an ancestor policy scope in the hierarchical representation of policy scopes; and

generating an updated policy for the ancestor policy scope, the minimal policy set including the updated policy.

2. The method of claim 1 , wherein identifying the one or more communities of devices comprises:

receiving traffic flow data between devices of the enterprise network;

generating a weighted graph based on the traffic flow data; and

performing a hierarchical community detection on the weighted graph to identify the one or more communities of devices.

3. The method of claim 2 , wherein each identified community of devices is associated with one policy scope from among the policy scopes.

4. A device comprising:

one or more memories including computer-readable instructions stored therein; and

one or more processors configured to execute the computer-readable instructions to:

identify one or more communities of devices in an enterprise network, each of the community of devices being defined by a group of the devices with at least a threshold number of communications among themselves, but less than the threshold number of communications with other devices;

define, from the one or more communities of devices, policy scopes in the enterprise network, the policy scopes defining how network traffic is managed within the network;

generate a hierarchical representation of the policy scopes;

identify, based on the hierarchical representation of the policy scopes, one or more policies governing traffic flow between devices associated with each of the policy scopes, comprising:

select a node in the hierarchical representation corresponding to a policy scope;

identify the one or more policies as policies governing traffic flow involving descendent nodes of the selected node; and

manage application of the one or more policies at the devices corresponding to a sub-tree of the selected node and descendent nodes of the selected node;

wherein managing application of the one or more policies includes one or more of:

generating a minimal policy set for one or more of the policy scopes;

deleting a redundant policy of the one or more policies; and

generating a new policy for at least one of the policy scopes;

wherein generating the minimal policy set comprises:

identifying, from among the one or more policies, at least one policy implemented in a policy scope with an ancestor policy scope in the hierarchical representation of policy scopes; and

generating an updated policy for the ancestor policy scope, the minimal policy set including the updated policy.

5. The device of claim 4 , wherein the one or more processors are configured to execute the computer-readable instructions to:

generate a minimal policy set for one or more of the policy scopes;

delete a redundant policy of the one or more policies; and

generate a new policy for at least one of the policy scopes.

6. The device of claim 5 , wherein the one or more processors are configured to execute the computer-readable instructions to:

identify, from among the one or more policies, at least one policy implemented in a policy scope with an ancestor policy scope in the hierarchical representation of policy scopes; and

generate an updated policy for the ancestor policy scope, the minimal policy set including the updated policy.

7. The device of claim 4 , wherein the device is an analytics engine of the enterprise network.

8. One or more non-transitory computer-readable storage media comprising computer-readable instructions stored thereon which, when executed by one or more processors, cause the one or more processors to:

identify one or more communities of devices in an enterprise network, each of the community of devices being defined by a group of the devices with at least a threshold number of communications among themselves, but less than the threshold number of communications with other devices;

define, from the one or more communities of devices, policy scopes in the enterprise network, the policy scopes defining how network traffic is managed within the network;

generate a hierarchical representation of the policy scopes;

identify, based on the hierarchical representation of the policy scopes, one or more policies governing traffic flow between devices associated with each of the policy scopes, comprising:

select a node in the hierarchical representation corresponding to a policy scope;

identify the one or more policies as policies governing traffic flow involving descendent nodes of the selected node; and

manage application of the one or more policies at the devices corresponding to a sub-tree of the selected node and descendent nodes of the selected node;

wherein managing application of the one or more policies includes one or more of:

generating a minimal policy set for one or more of the policy scopes;

deleting a redundant policy of the one or more policies; and

generating a new policy for at least one of the policy scopes;

wherein generating the minimal policy set comprises:

identifying, from among the one or more policies, at least one policy implemented in a policy scope with an ancestor policy scope in the hierarchical representation of policy scopes; and

generating an updated policy for the ancestor policy scope, the minimal policy set including the updated policy.

9. The non-transitory computer-readable storage media of claim 8 , wherein the execution of the computer-readable instructions by the one or more processors cause the one or more processors to:

receive traffic flow data between devices of the enterprise network;

generate a weighted graph based on the traffic flow data; and

perform a hierarchical community detection on the weighted graph to identify the one or more communities of devices.

10. The non-transitory computer-readable storage media of claim 9 , wherein each identified community of devices is associated with one policy scope from among the policy scopes.

11. The non-transitory computer-readable media of claim 8 , wherein the one or more processors reside in an analytics engine of the enterprise network.