Fingerprinting assisted by similarity-based semantic clustering
Systems, methods, and related technologies for classification are described. Entity attribute data associated with network entities is obtained. One or more entity attributes for classifying a set of entities is determined based on the entity attribute data. A set of entities coupled to a network are monitored. Values of the one or more entity attributes for the plurality of entities is identified. The set of entities are clustered into one or more entity clusters based on a similarity of the one or more entity attributes for the entities. An entity fingerprinting action is then performed based on the entity clusters.
1. A method comprising:
accessing entity attribute data associated with network entities;
determining one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitoring a plurality of entities coupled to a network;
identifying values for the one or more entity attributes for the plurality of entities;
determining a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determining a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function determined for each of the one or more entity attributes;
clustering, by a processing device, the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities; and
after clustering the plurality of entities, performing an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.
2. The method of claim 1 , wherein performing the entity fingerprinting action comprises:
providing the plurality of entity clusters for manual rule generation.
3. The method of claim 1 , wherein performing the entity fingerprinting action comprises:
determining one or more fingerprinting rule recommendations based on the plurality of entity clusters.
4. The method of claim 1 , wherein performing the entity fingerprinting action comprises:
automatically fingerprinting at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.
5. The method of claim 1 , wherein clustering the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes comprises:
determining a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identifying the plurality of entity clusters based on the similarity of each of the one or more entity attributes.
6. The method of claim 5 , wherein clustering the plurality of entities into the plurality of entity clusters comprises performing density-based clustering of the plurality of entities based on the one or more entity attributes associated with each entity of the plurality of entities.
7. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
obtain entity attribute data associated with network entities;
determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitor a plurality of entities coupled to a network;
identify values for the one or more entity attributes for the plurality of entities;
determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
cluster the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities; and
after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.
8. The system of claim 7 , wherein to perform the entity fingerprinting action, the processing device is to:
provide the plurality of entity clusters for manual rule generation.
9. The system of claim 7 , wherein to perform the entity fingerprinting action, the processing device is to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.
10. The system of claim 7 , wherein to perform the entity fingerprinting action, the processing device is to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.
11. The system of claim 7 , wherein to cluster the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes, the processing device is to:
determine a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identify the plurality of entity clusters based on the similarity of each of the one or more entity attributes.
12. The system of claim 11 , wherein to cluster the plurality of entities into the plurality of entity clusters, the processing device is to:
perform density-based clustering of the plurality of entities based on the one or more entity attributes associated with each entity of the plurality of entities.
13. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access entity attribute data associated with network entities;
determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitor a plurality of entities coupled to a network;
identify values for the one or more entity attributes for the plurality of entities;
determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
cluster, by the processing device, the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities;
identify at least one entity attribute of the one or more entity attributes of a first cluster of the plurality of entity clusters with a similarity of values that exceeds a threshold;
and
after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities based on at least one entity attribute of a first cluster of the plurality of entity clusters, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.
14. The non-transitory computer readable medium of claim 13 , wherein to perform the entity fingerprinting action, the processing device is to:
provide the plurality of entity clusters for manual rule generation.
15. The non-transitory computer readable medium of claim 13 , wherein to perform the entity fingerprinting action, the processing device is to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.
16. The non-transitory computer readable medium of claim 13 , wherein to perform the entity fingerprinting action, the processing device is to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.
17. The non-transitory computer readable medium of claim 13 , wherein to cluster the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes, the processing device is further to:
determine a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identify the plurality of entity clusters based on the similarity of each of the one or more entity attributes.