Clustering-based data object classification
Techniques for data classification using clustering. A method includes replacing a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings; clustering the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects; classifying a subset of the data objects in each cluster into at least one class; and aggregating classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.
1 . A method for data classification using clustering, comprising:
replacing a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings;
clustering the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects such that data objects among the plurality of data objects having the same replaced strings among the plurality of replaced strings are grouped into the same clusters among the plurality of clusters;
classifying a subset of the data objects in each cluster into at least one class; and
aggregating classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.
2 . The method of claim 1 , wherein the metadata for each data object includes a plurality of metadata parameters, wherein the plurality of data objects is clustered into the plurality of clusters based on the plurality of metadata parameters of each data object.
3 . The method of claim 2 , wherein the plurality of data objects is clustered over a plurality of iterations, wherein at least one iteration of the plurality of iterations includes comparing plurality of metadata parameters between clusters.
4 . The method of claim 3 , wherein the at least one iteration further includes replacing at least one metadata parameter of the plurality of metadata parameters for at least one of the plurality of data objects, wherein subsequent iterations of the plurality of iterations are performed based on replaced metadata parameters from prior iterations of the plurality of iterations.
5 . The method of claim 1 , wherein each of at least one first replaced portion of the replaced plurality of portions is a numerical value, wherein each of the at least one first replaced portion is replaced with a respective range including the numerical value.
6 . The method of claim 1 , wherein each of at least one second replaced portion of the replaced plurality of portions is a textual parameter, wherein each of the at least one second replaced portion demonstrates a pattern and is replaced with a set of predefined replacement characters that corresponds to the pattern.
7 . The method of claim 1 , wherein each of at least one third replaced portion of the replaced plurality of portions is a textual parameter, further comprising:
splitting each of the at least one third replaced portion into a plurality of substrings, wherein the plurality of data objects is clustered based further on each plurality of substrings.
8 . The method of claim 7 , further comprising:
filtering out at least one substring from the plurality of substrings in order to yield at least one filtered list of substrings, wherein the clustering is performed based further on the at least one filtered list of substrings.
9 . The method of claim 1 , clustering the plurality of data objects into a plurality of clusters further comprises:
optimizing the plurality of clusters based on at least one random sequence identified in the metadata of the plurality of data objects, wherein each random sequence is a string of characters having a length over a predetermined threshold which does not meet at least one replacement criterion.
10 . The method of claim 1 , further comprising:
sampling each of the plurality of clusters in order to obtain a plurality of samples, wherein each sample is one of the data objects in one of the plurality of clusters; and
determining the at least one cluster for which classes are to be aggregated based on the plurality of samples.
11 . The method of claim 1 , further comprising:
performing at least one action to secure a computing environment including the plurality of data objects based on the classes determined for the plurality of data objects.
12 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
replacing a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings;
clustering the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects such that data objects among the plurality of data objects having the same replaced strings among the plurality of replaced strings are grouped into the same clusters among the plurality of clusters;
classifying a subset of the data objects in each cluster into at least one class; and
aggregating classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.
13 . A system for classifying data in cloud computing environments, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
replace a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings;
cluster the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects such that data objects among the plurality of data objects having the same replaced strings among the plurality of replaced strings are grouped into the same clusters among the plurality of clusters;
classify a subset of the data objects in each cluster into at least one class; and
aggregate classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.
14 . The system of claim 13 , wherein the metadata for each data object includes a plurality of metadata parameters, wherein the plurality of data objects is clustered into the plurality of clusters based on the plurality of metadata parameters of each data object.
15 . The system of claim 14 , wherein the plurality of data objects is clustered over a plurality of iterations, wherein at least one iteration of the plurality of iterations includes comparing plurality of metadata parameters between clusters.
16 . The system of claim 15 , wherein the at least one iteration further includes replacing at least one metadata parameter of the plurality of metadata parameters for at least one of the plurality of data objects, wherein subsequent iterations of the plurality of iterations are performed based on replaced metadata parameters from prior iterations of the plurality of iterations.
17 . The system of claim 13 , wherein each of at least one first replaced portion of the replaced plurality of portions is a numerical value, wherein each of the at least one first replaced portion is replaced with a respective range including the numerical value.
18 . The system of claim 13 , wherein each of at least one second replaced portion of the replaced plurality of portions is a textual parameter, wherein each of the at least one second replaced portion demonstrates a pattern and is replaced with a set of predefined replacement characters that corresponds to the pattern.
19 . The system of claim 13 , wherein each of at least one third replaced portion of the replaced plurality of portions is a textual parameter, wherein the system is further configured to:
split each of the at least one third replaced portion into a plurality of substrings, wherein the plurality of data objects is clustered based further on each plurality of substrings.
20 . The system of claim 19 , wherein the system is further configured to:
filter out at least one substring from the plurality of substrings in order to yield at least one filtered list of substrings, wherein the clustering is performed based further on the at least one filtered list of substrings.
21 . The system of claim 13 , wherein the system is further configured to:
optimize the plurality of clusters based on at least one random sequence identified in the metadata of the plurality of data objects, wherein each random sequence is a string of characters having a length over a predetermined threshold which does not meet at least one replacement criterion.
22 . The system of claim 13 , wherein the system is further configured to:
sample each of the plurality of clusters in order to obtain a plurality of samples, wherein each sample is one of the data objects in one of the plurality of clusters; and
determine the at least one cluster for which classes are to be aggregated based on the plurality of samples.
23 . The system of claim 13 , wherein the system is further configured to:
perform at least one action to secure a computing environment including the plurality of data objects based on the classes determined for the plurality of data objects.