System and method for creating access control policies for individual users, user groups, network host or network host groups through network traffic analysis
A method and system for automatically creating access control policies for a network, including: (a) automatically identifying and recording user or host entities that attach to the network; (b) monitoring allowed network communications from the user or host entities; (c) correlating network address information from the allowed network communications with names of the user or host entities; and (d) proposing a respective access control policy for each of the user or host entities based on information gleaned during a learning process.
1. A method for automatically creating access control policies for a network, comprising:
(a) automatically identifying and recording user or host entities that attach to the network, each of the user or host entities being assigned respective network addresses;
(b) monitoring allowed network communications from said user or host entities to extract the respective network addresses;
(c) removing any existing access control policies previously assigned to the network addresses;
(d) correlating the respective network addresses with corresponding existing access control policies of said user or host entities based on said allowed network communications;
(e) performing a learning process, on user or host entities for which no existing access control policies exist; and
(f) proposing a respective access control policy for each of said user or host entities based on information gleaned during the learning process.
2. The method of claim 1 , wherein said learning process includes at least one of:
(i) performing network traffic analysis on network traffic to and from said user or host entities;
(ii) performing behavior analysis on said user or host entities; and
(iii) performing machine learning on activities of said user or host entities.
3. The method of claim 1 , wherein said respective access control policy for each of said entities is reviewed by a human security administrator or automatically implemented.
4. The method of claim 1 , wherein said user or host entities are selected from groups including: users, user groups, network hosts or network host groups.