Machine learning-enabled clustering of entities in a monitored deployment
Machine learning-enabled clustering of entities in a monitored deployment, including: receiving a graph structure describing activity within a cloud deployment; generating, for each node of a plurality of nodes of the graph structure, a corresponding vector embedding by providing each node to a trained model configured to generate the corresponding vector embedding; and generating a clustered embedding space by applying a clustering algorithm to the corresponding vector embedding for each node of the plurality of nodes.
1 . A method of machine learning-enabled clustering of entities in a monitored deployment, the method comprising:
receiving a graph structure describing activity within a cloud deployment;
generating, for each node of a plurality of nodes of the graph structure, a corresponding vector embedding by providing each node to a trained model configured to generate the corresponding vector embedding;
generating a clustered embedding space by applying a clustering algorithm to the corresponding vector embedding for each node of the plurality of nodes;
identifying anomalous behavior in the cloud deployment by identifying one or more outlier nodes in the clustered embedding space; and
generating an alert based on the one or more outlier nodes, wherein the corresponding vector embedding for a given node is based on one or more values for one or more features for the given node and the one or more features comprise:
one or more attributes of an entity represented by the given node; and
one or more graph structural features associated with the given node.
2 . The method of claim 1 , further comprising:
identifying, as a training data corpus candidate, an outlier node in the clustered embedding space; and
providing, to a user, an indication of the training data corpus candidate.
3 . The method of claim 1 , further comprising:
receiving a search query associated with a particular node of the graph structure; and
identifying, based on the clustered embedding space, a subset of nodes responsive to the search query.
4 . The method of claim 1 , further comprising training the model to identify the one or more features.
5 . The method of claim 4 , wherein the cloud deployment is associated with a particular customer and the training data for training the model comprises one or more training graph structures describing activity associated with the particular customer.
6 . The method of claim 4 , wherein the training data for training the model comprises one or more other training graph structures describing activity associated with one or more other customers different than the particular customer.
7 . A non-transitory computer readable storage medium storing instructions which, when executed, cause a processing device to:
receive a graph structure describing activity within a cloud deployment;
generate, for each node of a plurality of nodes of the graph structure, a corresponding vector embedding by providing each node to a trained model configured to generate the corresponding vector embedding;
generate a clustered embedding space by applying a clustering algorithm to the corresponding vector embedding for each node of the plurality of nodes;
identify anomalous behavior in the cloud deployment by identifying one or more outlier nodes in the clustered embedding space; and
generate an alert based on the one or more outlier nodes, wherein the corresponding vector embedding for a given node is based on one or more values for one or more features for the given node and the one or more features comprise:
one or more attributes of an entity represented by the given node; and
one or more graph structural features associated with the given node.
8 . The non-transitory computer readable storage medium of claim 7 further storing instructions which, when executed, cause a processing device to:
identify, as a training data corpus candidate, an outlier node in the clustered embedding space; and
provide, to a user, an indication of the training data corpus candidate.
9 . The non-transitory computer readable storage medium of claim 7 further storing instructions which, when executed, cause a processing device to:
receive a search query associated with a particular node of the graph structure; and
identify, based on the clustered embedding space, a subset of nodes responsive to the search query.
10 . The non-transitory computer readable storage medium of claim 7 further storing instructions which, when executed, cause a processing device to train the model to identify the one or more features.
11 . The non-transitory computer readable storage medium of claim 10 , wherein the cloud deployment is associated with a particular customer and the training data for training the model comprises one or more training graph structures describing activity associated with the particular customer.
12 . The non-transitory computer readable storage medium of claim 10 further storing instructions which, when executed, cause a processing device to generate a polygraph.