Analyzing and recommending rogue classification policies for a communication network
In certain embodiments, a method performed by a processing device includes obtaining, at multiple times, rogue classification information for electronic devices detected within a communication network. The rogue classification information for each time includes: timestamp information identifying the time; corresponding sets of attribute values for the electronic devices detected within the communication network at the time; and respective rogue classifications, as determined according to active rogue classification policies and the corresponding sets of attribute values, for the electronic devices. The method includes analyzing the rogue classification information for the multiple times to determine whether to modify the active rogue classification policies by analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values for the electronic devices for the multiple times. The method includes generating, in response to determining to modify the active rogue classification policies, a recommended rogue classification policy.
1 . A method comprising:
obtaining, at a plurality of times by a processing device, rogue classification information for electronic devices detected within a communication network, the rogue classification information for each time of the plurality of times comprising:
timestamp information identifying the time of the plurality of times;
corresponding sets of attribute values for the electronic devices detected within the communication network at the time; and
respective rogue classifications, as determined according to active rogue classification policies and the corresponding sets of attribute values, for the electronic devices detected within the communication network at the time;
analyzing, by the processing device, the rogue classification information for the plurality of times to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of times comprises analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values for the electronic devices for the plurality of times, and wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, the threat rating being separate from the respective roque classification for the particular electronic device and being determined according to at least a portion of the corresponding attribute values for the particular electronic device; and
generating, by the processing device in response to determining to modify the active rogue classification policies, a recommended rogue classification policy.
2 . The method of claim 1 , wherein the active rogue classification policies comprise rules for classifying the electronic devices detected within the communication network into a rogue classification of a plurality of rogue classifications, the plurality of rogue classifications defining varying levels of a threat determined to be posed by an electronic device detected within the communication network.
3 . The method of claim 1 , wherein the corresponding attribute values for the electronic devices detected within the communication network comprise values for device attributes and activity attributes associated with the electronic devices detected within the communication network.
4 . The method of claim 1 , further comprising executing, prior to analyzing the rogue classification information, a pre-analysis of the rogue classification information to attempt to identify anomalies in the corresponding attribute values and to validate the respective rogue classifications, as determined according to the active rogue classification policies, for the electronic devices detected within the communication network.
5 . The method of claim 1 , wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises:
applying a data correlation algorithm to the corresponding attribute values for the electronic devices; and
applying a data prediction algorithm to the corresponding attribute values for the electronic devices.
6 . The method of claim 1 , further comprising automatically deploying the recommended rogue classification policy on an electronic device to cause the electronic device to automatically incorporate the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.
7 . The method of claim 1 , further comprising transmitting, by the processing device, the recommended rogue classification policy to a network manager for evaluation prior to deployment of the recommended rogue classification policy for incorporating the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.
8 . The method of claim 7 , wherein the recommended rogue classification policy is a template rogue classification policy that includes one or more fields for configuration, the recommended rogue classification policy comprising recommended values for the one or more fields.
9 . The method of claim 1 , wherein the recommended rogue classification policy comprises a new rogue classification policy or an update to an active rogue classification policy.
10 . The method of claim 1 , wherein:
the communication network is a wireless local area network (WLAN); and
the electronic devices comprise one or more of:
a client device;
a wireless access point;
a WLAN controller; or
a network switch.
11 . The method of claim 1 , wherein the processing device comprises a network management system.
12 . A computer system, comprising:
one or more processors; and
one or more non-transitory computer-readable storage media storing programming for execution by the one or more processors, the programming comprising instructions to:
obtain, at a plurality of times, rogue classification information for electronic devices detected within a communication network, the rogue classification information for each time of the plurality of times comprising:
timestamp information identifying the time of the plurality of times;
corresponding sets of attribute values for the electronic devices detected within the communication network at the time; and
respective rogue classifications, as determined according to active rogue classification policies and the corresponding sets of attribute values, for the electronic devices detected within the communication network at the time;
analyze the rogue classification information for the plurality of times to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of times comprises analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values for the electronic devices for the plurality of times;
generate, in response to determining to modify the active rogue classification policies, a recommended rogue classification policy; and
transmit the recommended rogue classification policy to a network manager for evaluation prior to deployment of the recommended rogue classification policy for incorporating the recommended rogue classification policy as an active roque classification policy of the active rogue classification policies.
13 . The computer system of claim 12 , wherein the corresponding attribute values for the electronic devices detected within the communication network comprise values for device attributes and activity attributes associated with the electronic devices detected within the communication network.
14 . The computer system of claim 12 , wherein the programming further comprises instructions to execute, prior to analyzing the rogue classification information, a pre-analysis of the rogue classification information to attempt to identify anomalies in the corresponding attribute values and to validate the respective rogue classifications, as determined according to the active rogue classification policies, for the electronic devices detected within the communication network.
15 . The computer system of claim 12 , wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, the threat rating being separate from the respective rogue classification for the particular electronic device and being determined according to at least a portion of the corresponding attribute values for the particular electronic device.
16 . The computer system of claim 12 , wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises:
analyzing the corresponding attribute values for the electronic devices using a data correlation algorithm; and
analyzing the corresponding attribute values for the electronic devices using a data prediction algorithm.
17 . The computer system of claim 12 , wherein the programming further comprises instructions to automatically deploy the recommended rogue classification policy on an electronic device to cause the electronic device to automatically incorporate the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.
18 . One or more non-transitory computer-readable storage media storing programming for execution by one or more processors, the programming comprising instructions to:
obtain, at a plurality of times, rogue classification information for electronic devices detected within a communication network, the rogue classification information for each time of the plurality of times comprising:
timestamp information identifying the time of the plurality of times;
corresponding sets of attribute values for the electronic devices detected within the communication network at the time; and
respective rogue classifications, as determined according to active rogue classification policies and the corresponding sets of attribute values, for the electronic devices detected within the communication network at the time;
analyze the rogue classification information for the plurality of times to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of times comprises analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values for the electronic devices for the plurality of times; and
generate, in response to determining to modify the active rogue classification policies, a recommended rogue classification policy,
wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises:
analyzing the corresponding attribute values for the electronic devices using a data correlation algorithm; and
analyzing the corresponding attribute values for the electronic devices using a data prediction algorithm.
19 . The one or more non-transitory computer-readable storage media of claim 18 , wherein the programming further comprises instructions to assign a threat rating to a particular electronic device, the threat rating being separate from the respective rogue classification for the particular electronic device and being determined according to at least a portion of the corresponding attribute values for the particular electronic device.
20 . The one or more non-transitory computer-readable storage media of claim 18 , wherein the programming further comprises instructions to transmit the recommended rogue classification policy to a network manager for evaluation prior to deployment of the recommended rogue classification policy for incorporating the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.