Fingerprinting assisted by similarity-based semantic clustering
Systems, methods, and related technologies for entity classification are described. Entity attributes for entity classification are determined and entities coupled to a network are monitored. Values for each entity attribute for each entity coupled to the network are identified. A semantic similarity, between the plurality of entities, of the values for each entity attribute is determined. The entities are clustered into multiple entity clusters based on the semantic similarity of the values for each of the entity attributes for the entities.
1. A method comprising:
determining a plurality of entity attributes for entity classification;
monitoring a plurality of entities coupled to a network;
identifying values for each entity attribute of the plurality of entity attributes for the plurality of entities, wherein each value has a corresponding type such that at least two values have different types;
determining a semantic similarity, between the plurality of entities, of the values for each entity attribute based on a plurality of preconfigured similarity functions where each similarity function in the plurality of preconfigured similarity functions corresponds to a different type of a value in the values for each entity attribute;
clustering, by a processing device, the plurality of entities into a plurality of entity clusters based on the semantic similarity of the values for each of the plurality of entity attributes for the plurality of entities; and
identifying, based on the clustering, one or more features of at least the plurality of entity clusters that exceed a similarity threshold for generating a new fingerprinting rule.
2. The method of claim 1 , wherein the clustering is performed based on an aggregate of the semantic similarity of the values for each entity attribute between the plurality of entities.
3. The method of claim 1 , further comprising:
in response to the clustering the plurality of entities, performing an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the entity fingerprinting action is associated with classifying the one or more entities included in the first cluster.
4. The method of claim 3 , wherein performing the entity fingerprinting action comprises:
providing the plurality of entity clusters for manual rule generation.
5. The method of claim 3 , wherein performing the entity fingerprinting action comprises:
determining one or more fingerprinting rule recommendations based on the plurality of entity clusters.
6. The method of claim 3 , wherein performing the entity fingerprinting action comprises:
automatically fingerprinting at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.
7. The method of claim 1 , wherein clustering the plurality of entities into the plurality of entity clusters comprises performing density-based clustering of the plurality of entities based on one or more entity attributes associated with each entity of the plurality of entities.
8. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
determine a plurality of entity attributes for entity classification;
monitor a plurality of entities coupled to a network;
identify values for each entity attribute of the plurality of entity attributes for the plurality of entities, wherein each value has a corresponding type such that at least two values have different types;
determine a semantic similarity, between the plurality of entities, of the values for each entity attribute based on a plurality of preconfigured similarity functions where each similarity function in the plurality of preconfigured similarity functions corresponds to a different type of a value in the values for each entity attribute;
cluster the plurality of entities into a plurality of entity clusters based on the semantic similarity of the values for each of the plurality of entity attributes for the plurality of entities; and
identify, based on the clustering, one or more features of at least the plurality of entity clusters that exceed a similarity threshold for generating a new fingerprinting rule.
9. The system of claim 8 , wherein to perform the clustering, the processing device is to perform the clustering based on an aggregate of the semantic similarity of the values for each entity attribute between the plurality of entities.
10. The system of claim 8 , wherein the processing device is further to:
in response to the clustering the plurality of entities, perform an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the entity fingerprinting action is associated with classifying the one or more entities included in the first cluster.
11. The system of claim 10 , wherein to perform the entity fingerprinting action, the processing device is to:
provide the plurality of entity clusters for manual rule generation.
12. The system of claim 10 , wherein to perform the entity fingerprinting action, the processing device is to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.
13. The system of claim 10 , wherein to perform the entity fingerprinting action, the processing device is to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.
14. The system of claim 8 , wherein to cluster the plurality of entities into the plurality of entity clusters, the processing device is to perform density-based clustering of the plurality of entities based on one or more entity attributes associated with each entity of the plurality of entities.
15. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
determine a plurality of entity attributes for entity classification;
monitor a plurality of entities coupled to a network;
identify values for each entity attribute of the plurality of entity attributes for the plurality of entities, wherein each value has a corresponding type such that at least two values have different types;
determine a semantic similarity, between the plurality of entities, of the values for each entity attribute based on a plurality of preconfigured similarity functions where each similarity function in the plurality of preconfigured similarity functions corresponds to a different type of a value in the values for each entity attribute;
cluster, by the processing device, the plurality of entities into a plurality of entity clusters based on the semantic similarity of the values for each of the plurality of entity attributes for the plurality of entities; and
identify, based on the clustering, one or more features of at least the plurality of entity clusters that exceed a similarity threshold for generating a new fingerprinting rule.
16. The non-transitory computer readable medium of claim 15 , wherein to cluster the plurality of entities, the instructions, when executed by the processing device, cause the processing device to perform the clustering based on an aggregate of the semantic similarity of the values for each entity attribute between the plurality of entities.
17. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed by the processing device, cause the processing device further to:
in response to clustering the plurality of entities, perform an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the entity fingerprinting action is associated with classifying the one or more entities included in the first cluster.
18. The non-transitory computer readable medium of claim 17 , wherein to perform the entity fingerprinting action, the instructions, when executed by the processing device, cause the processing device to:
provide the plurality of entity clusters for manual rule generation.
19. The non-transitory computer readable medium of claim 17 , wherein to perform the entity fingerprinting action, the instructions, when executed by the processing device, cause the processing device to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.
20. The non-transitory computer readable medium of claim 17 , wherein to perform the entity fingerprinting action, the instructions, when executed by the processing device, cause the processing device to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.