Zero trust policy recommendation system through entity and relationship similarity
One example method includes transforming a structured data file into a graph structure that represents a zero trust (ZT) environment, where entities in the ZT environment are represented as nodes in the graph structure, and connections between the entities are represented in the graph structure as edges, performing a community detection process on the graph structure to identify a community of entities, performing a community characterization process that comprises identifying the ZT policies that are most commonly applied to the entities in the community, and based on the ZT policies identified, generating a recommendation as to whether one of the ZT policies should be applied to one of the entities in the community and, if so, which ZT policy or ZT policies should be applied.
1 . A method, comprising:
transforming a structured data file into a graph structure that represents a zero trust (ZT) environment, wherein entities in the ZT environment are represented as nodes in the graph structure, and connections between the entities are represented in the graph structure as edges;
performing a community detection process on the graph structure to identify a community of entities, and the community detection process comprises partitioning the graph structure into sub-graphs that each define a respective community;
performing a community characterization process that comprises identifying ZT policies that are most relevant, or most commonly applied, to the entities in the community; and
based on the ZT policies identified, generating a recommendation that one of the ZT policies should be applied to one of the entities in the community and, identifying which ZT policy or ZT policies should be applied.
2 . The method as recited in claim 1 , wherein the community detection process comprises partitioning the graph structure into sub-graph portions that each represent a respective group of the entities in the ZT environment.
3 . The method as recited in claim 1 , wherein the recommendation comprises a recommendation that a particular one of the most relevant policies be applied to an entity to which that particular policy has not yet been applied, and the particular one of the most relevant policies is identified by application of specified criteria.
4 . The method as recited in claim 1 , wherein one of the entities comprises any one or more of a user, a device, a network, and an application.
5 . The method as recited in claim 1 , wherein entities within the community are more densely connected to each other than to other entities in a different community.
6 . The method as recited in claim 1 , wherein entities within the community have one or more relationships with each other that comprise one or more system connections, interactions, shared information, and service usage patterns.
7 . The method as recited in claim 1 , wherein a check is performed of the identified ZT policies to determine whether all of the identified ZT policies are in effect across the entities in the community.
8 . The method as recited in claim 1 , wherein the ZT environment represented by the graph structure comprises a network.
9 . The method as recited in claim 1 , wherein, in the structured data file, the nodes are declared before the edges.
10 . The method as recited in claim 1 , wherein the community characterization process comprises visiting the community and one or more other communities represented in the graph structure, and then applying a ranking function to identify the most relevant, or most commonly applied, ZT policies.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
transforming a structured data file into a graph structure that represents a zero trust (ZT) environment, wherein entities in the ZT environment are represented as nodes in the graph structure, and connections between the entities are represented in the graph structure as edges;
performing a community detection process on the graph structure to identify a community of entities, and the community detection process comprises partitioning the graph structure into sub-graphs that each define a respective community;
performing a community characterization process that comprises identifying ZT policies that are most relevant, or most commonly applied, to the entities in the community; and
based on the ZT policies identified, generating a recommendation that one of the ZT policies should be applied to one of the entities in the community and, identifying which ZT policy or ZT policies should be applied.
12 . The non-transitory storage medium as recited in claim 11 , wherein the community detection process comprises partitioning the graph structure into sub-graph portions that each represent a respective group of the entities in the ZT environment.
13 . The non-transitory storage medium as recited in claim 11 , wherein the recommendation comprises a recommendation that a particular one of the most relevant, or most commonly applied, policies be applied to an entity to which that particular policy has not yet been applied.
14 . The non-transitory storage medium as recited in claim 11 , wherein one of the entities comprises any one or more of a user, a device, a network, and an application.
15 . The non-transitory storage medium as recited in claim 11 , wherein entities within the community are more densely connected to each other than to other entities in a different community.
16 . The non-transitory storage medium as recited in claim 11 , wherein entities within the community have one or more relationships with each other that comprise one or more system connections, interactions, shared information, and service usage patterns.
17 . The non-transitory storage medium as recited in claim 11 , wherein a check is performed of the identified ZT policies to determine whether all of the identified ZT policies are in effect across the entities in the community.
18 . The non-transitory storage medium as recited in claim 11 , wherein the ZT environment represented by the graph structure comprises a network.
19 . The non-transitory storage medium as recited in claim 11 , wherein, in the structured data file, the nodes are declared before the edges.
20 . The non-transitory storage medium as recited in claim 11 , wherein the community characterization process comprises visiting the community and one or more other communities represented in the graph structure, and then applying a ranking function to identify the most relevant, or most commonly applied, ZT policies.