Analyzing and recommending malicious classification policies for communication networks

Abstract

Embodiments of the present disclosure relate to analyzing and recommending malicious classification policies for communication networks. In some embodiments, a method performed by a processing device includes obtaining malicious classification information of an electronic device detected within a communication network at a plurality of times. The malicious classification information of each time comprises timestamp information for identifying the time; a corresponding set of attribute values of the electronic device detected within the communication network at the time; and determining the corresponding malicious classification of the electronic equipment according to the active malicious classification strategy and the corresponding attribute value set. The method includes analyzing malicious classification information at a plurality of times to determine whether to modify an active malicious classification policy by analyzing respective malicious classifications and corresponding sets of attribute values of the electronic device at the plurality of times using a statistical machine learning algorithm. The method includes generating a recommended malicious classification policy in response to determining to modify the active malicious classification policy.

Description

Background Art

[0001] A communication network includes various electronic devices that can communicate with each other via one or more communication interfaces. For example, a wireless local area network (WLAN) is a wireless computer network that links two or more electronic devices using wireless distribution technology (e.g., radio signals or infrared signals). WLANs are typically implemented in a limited area, such as a home, university, school, or office complex. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0003] Figure 1 An example computing environment for analyzing and recommending rogue classification strategies in a communication network according to certain embodiments is shown;

[0004] Figure 2 Additional details of a network management system (NMS) and a malicious policy analysis engine for analyzing and recommending malicious classification policies in a communication network are shown in accordance with certain embodiments;

[0005] Figure 3 Additional details of an example computer system including an NMS and a malicious policy analysis engine for analyzing and recommending malicious classification policies in a communication network are shown according to certain embodiments;

[0006] Figure 4 An example method for analyzing and recommending a malicious classification policy for a communication network according to certain embodiments is shown;

[0007] Figure 5 An example method for analyzing a malicious classification policy for a communication network according to certain embodiments is shown;

[0008] Figure 6 An example method for analyzing and recommending a malicious classification policy for a communication network according to certain embodiments is shown; and

[0009] Figure 7 A block diagram of an example computing device is shown in accordance with some embodiments. DETAILED DESCRIPTION

[0010] A communication network, some or all of which may be a wireless network, may include many electronic devices, such as client devices, access points (APs), controllers, and switches. For example, a WLAN communication network may include many electronic devices, such as one or more client devices, one or more wireless APs (WAPs), one or more WLAN controllers, and one or more network switches.

[0011] A WLAN or other communication network may be monitored via one or more network management systems (NMS), which may be coupled to a WLAN switch and / or a WLAN controller. One or more NMSs may be used to maintain the network and ensure network security. For example, an NMS may manage electronic devices connected to a communication network. Among other operations, an NMS may detect and monitor electronic devices that are coupled to a communication network or that are otherwise detectable by other electronic devices in the communication network, whether for network security or for other purposes. Information (e.g., attribute information) associated with various electronic devices may be aggregated at various points within the communication network and reported to the NMS.

[0012] In a communication network, a malicious device includes a device that is potentially connected to a computer network for an extended period of time but does not have permission to access and operate on the network. In a wireless communication network, a malicious wireless device can be an access point, a Dynamic Host Configuration Protocol (DHCP) server, an end-user device (e.g., a malicious peer), or other electronic device.

[0013] Rogue APs can include WAPs that are installed in a network without authorization. These WAPs (e.g., routers) may be installed by employees for work purposes, by hackers for the purpose of collecting private records, or in other ways. In most cases, the use of such devices conflicts with network security policies, and rogue WAPs are not managed by network administrators who are responsible for managing the communication network. Rogue WAPs can allow other unauthorized end-user devices to connect to the network and consume network bandwidth or perform other unwanted or illegal operations.

[0014] Another example of a malicious WAP is a so-called "evil twin." In this example, a wireless device located a short distance outside an organization can receive a beacon transmitted by a legitimate WAP within the organization. The evil twin can then begin transmitting the same beacon, potentially with the intent of getting end users within the organization to connect to the evil twin instead of, or in addition to, the legitimate WAP. Once the end user is connected to the evil twin, the unscrupulous individual can use the evil twin to gain access to the organization's network.

[0015] Client device malicious threats, or malicious peers, include end-user computers or other electronic devices that connect to the network without permission. These devices may include laptops or other computers that can act as APs. Given that many client devices (e.g., laptops) have few security features, malicious peers may pose a greater risk than malicious APs. This may allow other unauthorized devices to connect to the device and the network.

[0016] For example, a malicious peer may refer to a client device with enabled wireless functionality and potential bridging functionality, such as an end-user laptop or desktop personal computer. Although a WAP (e.g., a router) can provide both WAP and bridging functionality, a WAP is typically configured with authentication protocols, such as Wired Equivalent Privacy (WEP) and Wi-Fi Protected Setup (WPS), and may even implement a firewall. Client devices that provide these two functions may pose a greater threat to the security of the network, because unlike most WAPs, client devices may have almost no security measures to reduce or prevent unauthorized access. In other words, a malicious peer may be similar to a vulnerability in a communication network, in which a malicious entity may access the communication network. Client devices are not considered to be part of the network infrastructure, which may imply that client devices are treated as malicious based on other attributes of the client device. That is, because a malicious peer may be a device that is not usually intended to act as an AP, the hidden dangers posed by a malicious peer to a communication network may be exacerbated relative to a malicious AP, because a malicious AP may have at least a built-in security feature that may be enabled by default.

[0017] Turning to DHCP servers, DHCP servers can be an essential component of a communication network, providing information for properly configuring the communication network. A malicious DHCP server may look and often behave like a legitimate DHCP server, but the malicious DHCP server is not managed by a network administrator or associated management tools. For example, a malicious DHCP server may appear when a user knowingly or unknowingly connects a router to a communication network. As another example, a malicious DHCP server may appear via a hacked Internet of Things (IoT) device (such as a mobile phone, printer, camera, tablet computer, smart watch) or via a hacked information technology (IT) application or resource. Although there are potential problems in many cases, a malicious DHCP server may be particularly frustrating when trying to deploy a series of servers using a pre-boot execution environment (PXE) because PXE typically relies on DHCP. A malicious DHCP server may be a security risk, and a communication network may begin to experience disruptions because a malicious DHCP server may provide incorrect network settings and routing.

[0018] Rogue wireless devices are one of the major security threats in wireless networks. If left connected, a rogue wireless device could pose a security threat to the network and the organization. For example, a rogue device could have the ability to access and / or disclose confidential system information that could potentially cause damage to the organization.

[0019] Applying strict network security policies can reduce or eliminate the threat of malicious wireless devices. APs, client devices, and other electronic devices are mapped in the network to facilitate detection of new devices in the network. Malicious wireless devices are usually detectable but difficult to eliminate. Wi-Fi network administrators use NMSs that implement network security policies to monitor malicious devices on Wi-Fi networks. Among other operations, the NMS identifies, configures, monitors, and updates network management devices, one or more network switches, one or more WLAN controllers, one or more APs (e.g., WAPs), and / or one or more client devices.

[0020] A network administrator may learn about intruder behavior (e.g., malicious behavior) and configure policies to blacklist devices that are not authorized to connect to the network. This process is repeated throughout the customer's network. Additionally, malicious device classification is manually configured to a northbound system (such as to an NMS) based on events generated by a network controller (e.g., a WLAN controller). Additionally, the NMS may employ a malicious classification policy that includes rules for classifying devices as valid devices, malicious devices, suspected malicious devices, interfering devices, or other types of devices (or other similar categories). These policies typically consider a complex combination of device attributes, network topology information, event information (e.g., attack vectors), or other information when determining a classification for a particular electronic device.

[0021] The complex combination of network and device attributes that lead to a particular device being classified as a malicious wireless device (or other class of device) prevents meaningful evaluation of the performance of proactive malicious classification policies currently applied by NMSs. As a result, network administrators are often left to choose from standard, pre-defined malicious classification policies (potentially with limited ability to configure certain policy attributes by a skilled network administrator), which may or may not perform well in classifying electronic devices detected on the network.

[0022] Embodiments of the present disclosure provide a malicious policy analysis engine that can be implemented as a malicious snapshot engine and a malicious rule automatic profiler engine to evaluate the performance of an active malicious classification policy implemented by a network element (such as an NMS) over time, and potentially provide a recommended malicious classification policy to add to the active malicious classification policy, or update an existing malicious classification policy. The malicious policy analysis engine can be implemented as part of the NMS, or can be implemented separately and communicate with the NMS.

[0023] In certain embodiments, on an ongoing basis, the NMS (or other suitable electronic device) applies an active malicious classification policy for classifying electronic devices detected within the communication network and stores the determined classifications.

[0024] The malicious snapshot engine periodically stores active malicious classification policies and malicious classification information, which includes classifications assigned to electronic devices detected in the network according to the active malicious classification policies and conditions surrounding those classifications (e.g., classification policies that trigger classifications, electronic device attributes (Internet Protocol (IP) address, Media Access Control (MAC) address, Service Set Identifier (SSID), Basic Service Set Identifier (BSSID), vendor, device type, etc.), event details (e.g., attack vectors and detection frequencies), and network topology information. The malicious snapshot engine can also perform some initial analysis of the collected classification information, such as attempting to verify the assigned classifications and identifying certain anomalies in the data.

[0025] The malicious rule automatic parser engine further analyzes the malicious classification information analyzed by the malicious snapshot engine and the active malicious classification strategy to evaluate the performance of the active malicious classification strategy and determine whether to recommend a modified malicious classification strategy or a new malicious classification strategy. For example, based on the received classification information, the automatic parser engine can assign a threat rating to the electronic device and analyze the classification information using various statistical machine learning algorithms (e.g., data correlation methods and / or probabilistic methods) to generate an assessment of the malicious classification for a specific device. If the automatic parser engine determines that a malicious classification strategy is recommended, the automatic parser engine generates a recommended malicious classification strategy, which can be automatically deployed or transmitted to a network administrator for further evaluation / configuration.

[0026] Certain embodiments improve techniques for identifying malicious devices in wireless networks by evaluating the performance of proactive malicious classification policies and generating recommended malicious classification policies where appropriate. Because the evaluation is performed on an ongoing basis and uses statistical machine learning algorithms, the evaluation evolves over time based on actual network events, and both the performance of the evaluation and the malicious classification performance can be improved. Certain embodiments improve the technical capabilities of computer systems to identify malicious devices in a more reliable and accurate manner, thereby enhancing the overall security of computer networks. Certain embodiments reduce or eliminate manual intervention by network administrators or others to implement and / or update malicious classification policies. The concepts described in the present disclosure can be applied to any type of network environment, not just a WLAN environment. For example, these concepts can be applied to wireless networks, wired networks, or networks that include a combination of wireless and wired devices.

[0027] Figure 1An example computing environment 100 for analyzing and recommending malicious classification policies in a communication network according to some embodiments is shown. In an example, the computing environment 100 may include a WLAN. As just one example, the WLAN may include an Institute of Electrical and Electronics Engineers (IEEE) 802.11 WLAN. IEEE 802.11 is a set of MAC and physical layer (PHY) specifications for implementing WLAN computer communications.

[0028] In the illustrated example, computing environment 100 includes WAPs 102a through 102e (collectively, WAPs 102), WLAN controller 104, network switch 106, client devices 108a through 108c (collectively, client devices 108), computer system 110, and administrator device 112. Figure 1 Computing environment 100 is shown with a particular number of WAPs 102, WLAN controllers 104, network switches 106, client devices 108, computer systems 110, and administrator devices 112, but the present disclosure contemplates other implementations that include more or less of each of these network elements, including omitting certain network elements, where appropriate.

[0029] The WAPs 102 may each include a device, such as a wireless router, that allows wireless devices (e.g., client devices 108) to connect to a WLAN implemented by some or all of the computing environment 100. The WAPs 102 may each act as a radio transmitter for a WLAN. The WAPs 102 may each convert network traffic into radio signals and transmit those signals to a wireless-enabled processing device. For example, the WAPs 102 may each act as a bridge to a wired local area network (LAN). In the example shown, the WAPs 102 may each be connected to a wired network via a WLAN controller 104, which in turn may be coupled to a cable to allow wireless-enabled computers (e.g., client devices 108) to access the wired network.

[0030] The WLAN controller 104 may be configured to manage traffic on the WLAN, including, for example, control and data traffic. The WLAN controller 104 may collect control plane data and provide instructions to the various WAPs 102. The WLAN controller 104 may be configured to manage various aspects associated with the WAPs 102, such as authentication, radio frequency, quality of service (QoS), location tracking, intrusion detection, facilitating user roaming between / among the WAPs 102, deployment of security profiles, access isolation, and / or any other suitable aspects. The WLAN controller 104 may allow the WAPs 102 to connect to a wired network via a network switch 106. The network switch 106 may include any suitable combination of layer 2 or layer 3 switches.

[0031] The client device 108 may represent any type of computing device capable of reading machine-executable instructions. Examples of computing devices may include a server, a desktop computer, a laptop computer, a tablet computer, a thin client, a mobile device, a personal digital assistant (PDA), a smart phone, or any other suitable type of computing device. In some embodiments, the client device 108 may include a wireless network interface (e.g., a wireless network interface card (NIC)) that allows the client device 108 to perform wireless communications with another device (such as, one or more WAPs 102).

[0032] Computer system 110 may include a computer and / or computer program that can process requests from other computers (e.g., clients) over a network. In some embodiments, computer system 110 is implemented as a server or other suitable type of processing device. Computer system 110 may facilitate monitoring and otherwise managing a communication network (e.g., a WLAN network) implemented by computing environment 100.

[0033] Administrator device 112 may be configured to communicate with computer system 110 to facilitate management of a communication network implemented by computing environment 100. Although shown separately, computer system 110 and administrator device 112 may be implemented using the same computer system, or may be implemented using separate processing devices that communicate via one or more links 114. As an example, a user of administrator device 112 may be one or more individuals responsible for managing a communication network (e.g., a WLAN network) implemented by computing environment 100, such as a network administrator or other IT professional.

[0034] The components of the computing environment 100 can communicate with each other using one or more links 114. The links 114 may include any suitable combination of wired communication links or wireless communication links, such as any suitable combination of Ethernet connections, Wi-Fi connections, cellular connections, satellite links, etc. In the illustrated example, links 114 illustrated as dashed lines are considered wireless connections, while links 114 illustrated as solid lines are considered wired connections. Although for purposes of this example, particular links 114 are illustrated as either wired or wireless, the present disclosure contemplates that any of the links 114 are wired and / or wireless, as may be appropriate for a given implementation.

[0035] Computer system 110 may include NMS 116 and malicious policy analysis engine 118, each of which will be described in more detail below.

[0036] The NMS 116 may be any suitable system, such as a cloud-based system, that includes one or more computing devices configured to manage a network and electronic devices such as network switches, routers, access points, gateways, client devices, etc. For example, the NMS 116 may be configured to manage the WAPs 102, the controllers 104, the network switches 106, and the client devices 108. The NMS 116 may be connected to such electronic devices via a wide area network (WAN) (e.g., the Internet) via a wired connection or a wireless connection, such as may be implemented via one or more links 114.

[0037] The NMS 116 may be configured to manage the communication network of an entity such as an organization, enterprise, company, department, etc. In some embodiments, because the entity uses the NMS 116 to manage its communication network, the entity is a customer of the NMS 116 and accordingly may have a customer account associated with the entity at the NMS 116. The entity may register its electronic device with the NMS 116 so that the NMS 116 may identify the electronic device and / or the entity to which the electronic device belongs. By identifying the entity to which the electronic device belongs, the NMS 116 may be able to manage the electronic device according to any rules associated with the entity.

[0038] The NMS 116 may apply network management policies to manage the communication network and the devices detected within the communication network. For various reasons, including the security of the communication network implemented by the computing environment 100, the NMS 116 may attempt to identify, classify, and track devices connected to or otherwise detected within the communication network implemented by the computing environment 100. For example, over time, devices (e.g., network switches 106, controllers 104, client devices 108, or other devices) may connect to and disconnect from the communication network implemented by the computing environment 100. Some of these devices may be known to the NMS 116, while other devices may be unknown. Therefore, the NMS 116 may detect, identify, classify, and monitor devices connected to or otherwise detectable within the network over time.

[0039] To this end, the network management policies applied by the NMS 116 may include malicious classification policies. The NMS 116 may apply these malicious classification policies to classify devices detected within the computing environment 100. The malicious classification policies may define a set of rules for determining the appropriate category of a detected device.

[0040] In order to determine the appropriate category of a device, these malicious classification strategies can consider one or more attributes. These attributes can include one or more of device attributes (e.g., physical device attributes and / or virtual device attributes), activity attributes (e.g., related to the behavior of the detected device), network topology information, timestamp information, and / or any other suitable information. As a specific example, one or more device attributes can include the IP address of the device, the MAC address of the device, the SSID of the device, the BSSID of the device, the vendor of the device, the device type, or any other suitable attribute. Activity attributes can include time, entry point, etc. For example, the entry point can include the device of the computing environment 100 to which the detected device is connected or attempted to connect. In the case where the detected device is a malicious device, the entry point can be referred to as an attack vector.

[0041] The specific classifications applied by a given NMS 116 may vary, and the present disclosure contemplates the use of any suitable malicious classifications and associated malicious classification strategies for determining appropriate malicious classifications for devices detected within a network (such as a communication network implemented by the computing environment 100). Thus, the specific classifications may vary with different implementations. Furthermore, the specific malicious classification strategies that result in different classifications may vary with different implementations. Table 1 below provides only one example of potential malicious classifications and associated descriptions. These specific malicious classifications and associated descriptions are provided only as examples.

[0042] Table 1

[0043]

[0044]

[0045]

[0046] Attributes that may be relevant to a given malicious classification policy being applied by the NMS 116 may vary by device type. In other words, for any given malicious classification policy, one or more attributes evaluated for the malicious classification policy may (or may not) vary based on the type of device being detected / tracked and being evaluated according to the malicious classification policy. Additionally or alternatively, acceptable attribute values ​​(which may be specific values, ranges, or other types of values) for the attributes of the malicious classification policy may be defined for the malicious classification policy, and if appropriate, the acceptable attribute values ​​may also vary by device type.

[0047] For example, a particular malicious classification policy configured for a switch (e.g., network switch 106) may not apply and / or may be configured differently for client device 108. As another example, a particular malicious classification policy configured for a wireless device (e.g., for radio attributes) may not apply and / or may be configured differently for a wired device. As another example, a particular malicious classification policy configured for a device that communicates using a particular communication standard (e.g., 802.11ax, or Wi-Fi 6) may not apply and / or may be configured differently for a device that does not support the particular communication standard.

[0048] Although described as being applied at the NMS 116, additionally or alternatively, one or more other devices in the computing environment 100 may apply the malicious classification policy and may report those determinations to the NMS 116. For example, the WAP 102, the controller 104, the network switch 106, and / or the client device 108 may apply the malicious detection policy, if appropriate.

[0049] Figure 1 An example of some electronic devices that have been classified according to the above classifications is shown. In some embodiments, NMS 116 classifies electronic devices according to the above malicious classifications based on one or more active malicious classification strategies and one or more attributes associated with the electronic device and / or the communication network implemented by computing environment 100.

[0050] For example, WAPs 102a, 102b, and 102d; controller 104; network switch 106; and client device 108a may be considered valid devices. For example, these valid devices may be known to NMS 116 and considered approved to connect to the communication network implemented by computing environment 100.

[0051] As another example, both WAP 102c and client device 108b are classified as malicious devices, as indicated by the diagonal shading around the borders of these devices. In some embodiments, client device 108b is connected to computing environment 100 via one or more WAPs in WAP 102 and / or WAP 102d. In an example scenario, client device 108b is connected to computing environment 100 via WAP 102c, and NMS 116 classifies WAP 102c as a malicious device. In this scenario, because client device 108b is connected to computing environment 100 via WAP 102c (e.g., classified as a malicious device), NMS 116 may also classify client device 108b as a malicious device. Additionally or alternatively, NMS 116 may classify client device 108b as a malicious device for reasons unrelated to whether client device 108b is connected to computing environment 100 via WAP 102c.

[0052] As another example, Figure 1 An interfering device 120 is shown. In the example shown, the interfering device 120 includes a WAP 102e and a client device 108c connected to the WAP 102e. The interfering device 120 may be detectable by the NMS 116 or another suitable component of the computing environment 100 (eg, the WAP 102, the controller 104, or the network switch 106).

[0053] The computer system 110 may also include a malicious policy analysis engine 118. In some embodiments, the malicious policy analysis engine 118 is configured to evaluate the active malicious classification policy applied by the NMS 116 and potentially recommend changes to the active malicious classification policy. The malicious policy analysis engine 118 may periodically store snapshots of the active malicious classification policy and malicious classification information and store the collected information as time series data.

[0054] The active malicious classification policy may include a current active malicious classification policy applied by the NMS 116 to determine a classification of a detected device. Malicious classification information may include information associated with a network and / or electronic device to which the NMS 116 has applied an active malicious classification policy. For example, the malicious classification information may include device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., an identification of a classification assigned to a detected device), activity attributes (e.g., relating to the behavior of the detected device), an identification of which one or more malicious classification policies resulted in a particular classification of a device, network topology information, timestamp information, and / or any other suitable information.

[0055] Malicious policy analysis engine 118 may poll NMS 116 for active malicious classification policies and / or malicious classification information at regular or irregular time intervals. Additionally or alternatively, NMS 116 may automatically transmit active malicious classification policies and / or malicious classification information to malicious policy analysis engine 118 at regular or irregular time intervals.

[0056] The malicious policy analysis engine 118 can analyze the malicious classification information to determine whether to recommend changes to the active malicious classification policy. For example, the malicious policy analysis engine 118 can use one or more machine learning algorithms to evaluate the active malicious classification policy. Because the collected information is collected over time and stored as time series data, the active malicious classification policy can be evaluated using algorithms that facilitate trend analysis, anomaly analysis, and other types of time-based analysis.

[0057] Based on the analysis of the active malicious classification policies, the malicious policy analysis engine 118 may determine whether to generate one or more malicious classification policy recommendations. For example, based on the analysis, the malicious policy analysis engine 118 may determine that one or more active malicious classification policies are not performing optimally, that certain detected devices are incorrectly classified, or that there are (or are predicted to be) other deficiencies in using the active malicious classification policies to classify devices detected within the communication network implemented by the computing environment 100.

[0058] If, based on the analysis, the malicious policy analysis engine 118 determines that one or more recommendations should be made, the malicious policy analysis engine 118 can generate one or more recommended malicious classification policies. The recommended malicious classification policies can include, for example, new malicious classification policies or updates to active malicious classification policies. In some embodiments, one or more of the recommended malicious classification policies are template malicious classification policies that include one or more fields for configuration, such as by a network administrator (e.g., a user of the administrator device 112).

[0059] In some embodiments, the malicious policy analysis engine 118, possibly in cooperation with the NMS 116, automatically deploys one or more of the recommended malicious classification policies so that those recommended malicious classification policies automatically become part of the active malicious classification policy for future evaluations of devices in the computing environment 100. For example, the malicious policy analysis engine 118 can automatically deploy one or more of the recommended malicious classification policies on one or more electronic devices so that the electronic devices automatically merge the recommended malicious classification policies into the active malicious classification policy. The electronic devices to which the recommended malicious classification policies are deployed can be one or more of the NMS 116, the WAP 102, the controller 104, the network switch 106, or any other suitable electronic device.

[0060] In certain embodiments, the malicious policy analysis engine 118, possibly in cooperation with the NMS 116, submits one or more of the recommended malicious classification policies for review by an appropriate individual such as a network administrator (e.g., a user of the administrator device 112). For example, the malicious policy analysis engine 118 may transmit the recommended malicious classification policies to the NMS 116 and / or associated administrator device 112 (e.g., a network administrator) for evaluation prior to deploying the recommended malicious classification policies for incorporation into active malicious classification policies.

[0061] The malicious policy analysis engine 118 may repeat this process of evaluating the malicious classification policies applied by the NMS 116 and potentially recommending changes to those malicious classification policies over time to continually improve the accuracy of the proactive malicious classification policies applied by the NMS 116. In addition, embodiments of the present disclosure apply sophisticated machine learning algorithms that benefit from time series data and analysis performed over time to analyze malicious classification policies and make associated recommendations, reducing or eliminating reliance on individuals (e.g., network administrators) to evaluate and adjust proactive malicious classification policies.

[0062] NMS116 and malicious policy analysis engine 118 may be implemented using any suitable combination of hardware, firmware, and software. For example, NMS116 and malicious policy analysis engine 118 may include any combination of hardware and programming to implement the described operations. The programming may be processor-executable instructions stored on at least one non-transitory machine-readable storage medium, and the hardware may include at least one processing resource for executing those instructions. In some examples, the hardware may also include other electronic circuitry to at least partially implement NMS116 and malicious policy analysis engine 118. In some examples, at least one machine-readable storage medium may store instructions that, when executed by one or more processors, at least partially implement NMS116 and malicious policy analysis engine 118. In such an example, the computer system 110 may include one or more computer-readable storage media storing instructions and one or more processors executing instructions.

[0063] Although shown separately, the present disclosure contemplates that the NMS 116 and the malicious policy analysis engine 118 are separate or combined. As just one example, the malicious policy analysis engine 118 may be part of the NMS 116. Although shown as being implemented using the computer system 110, the NMS 116 and the malicious policy analysis engine 118 may be implemented on the same or different computer systems. In addition, the present disclosure contemplates that the computing environment 100 (or another computing environment) includes any suitable number of NMSs 116 and / or malicious policy analysis engines 118 implemented on any suitable number of computer systems. As just one example, the computing environment may include multiple NMSs 116 implemented on different computer systems, each NMS being associated with a corresponding malicious policy analysis engine 118, or all NMSs sharing the same malicious policy analysis engine 118.

[0064] Figure 2 Additional details of the NMS 116 and the malicious policy analysis engine 118 for analyzing and recommending malicious classification policies in a communication network are shown according to certain embodiments. Although shown as separate blocks, the NMS 116 and the malicious policy analysis engine 118 can be separate or combined. For example, the malicious policy analysis engine 118 can be implemented as part of the NMS 116, or can be implemented separately and communicate with the NMS 116.

[0065] The NMS 116 may be coupled to or otherwise associated with a storage device 200a, which may store information to be used by or generated by the NMS 116. In some embodiments, the storage device 200a may be considered part of the NMS 116. The storage device 200a may store active malicious detection policies 202, malicious classification information 204, and recommended malicious classification policies 206, each of which is described in more detail below.

[0066] As described above, NMS116 can detect devices within a communication network implemented by computing environment 100, and analyze the detected devices at regular or irregular intervals according to one or more active malicious classification strategies. These active malicious classification strategies can be stored in storage device 200a as active malicious classification strategies 202. Active malicious classification strategies 202 may include a set of rules for classifying devices detected within the communication network into one or more of various malicious classifications. Malicious classifications define different levels of threats determined to be posed by electronic devices detected within the communication network implemented by computing environment 100. For example, active malicious classification strategies 202 may include a set of rules that NMS116 evaluates when determining the malicious classification to be assigned to the detected device. As just one example, the malicious classifications may be those described above with reference to Table 1.

[0067] The active malicious classification policies 202 may initially be installed and configured by an appropriate user (e.g., a network administrator via the administrator device 112) with a configuration deemed appropriate for managing the communication network of the computing environment 100. Over time, the active malicious classification policies 202 may be modified, such as by reconfiguring certain active malicious classification policies 202, adding new malicious classification policies to the active malicious classification policies 202, and / or deleting certain active malicious classification policies 202. These changes to the active malicious classification policies 202 may be attributable, at least in part, to the operation of the malicious policy analysis engine 118.

[0068] Malicious classification information 204 may include various information associated with a communication network implemented by computing environment 100 and with electronic devices detected while connected to or otherwise associated with the communication network. In certain embodiments, malicious classification information 204 may include one or more of device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identification of a classification assigned to a detected device), activity attributes (e.g., relating to the behavior of a detected device), identification of which one or more malicious classification policies resulted in a particular classification of a device, network topology information, timestamp information, and / or any other suitable information. Although malicious classification information 204 is described as including particular attributes or other information, malicious classification information 204 may include any suitable attributes or other information.

[0069] Device attributes may include physical device attributes and / or virtual device attributes of devices that are connected to or otherwise associated with a communication network implemented by computing environment 100. For example, for each detected device, the physical device attributes may include one or more of the device's IP address, the device's MAC address, the device's SSID, the device's BSSID, the device's vendor, the device's type, the communication protocol used by the device, the device's RF configuration, the device's role-based access control (RBAC) (to the extent applicable), the device's operating system, or any other suitable attributes. As another example, for each detected device, the virtual device attributes may include one or more of the device's virtual local area network (VLAN) tag, the device's port mapping, the device's virtual network topology, security attributes (e.g., certificates, passwords, etc.), or any other suitable attributes.

[0070] Activity attributes may include time, entry point, detected network device count, client count detected on a communication network (e.g., LAN), encryption password, encryption authentication, network type (e.g., WLAN), signal strength, channel, etc. For example, the entry point may include a device of the computing environment 100 to which the detected device is connected or attempted to connect (e.g., detected on a WLAN). In the case where the detected device is a malicious device or a suspected malicious device, the entry point may be referred to as an attack vector. The detected network device count may include the number of electronic devices that have detected the detected device as being problematic. For example, in the case of a client device 108, the detected network device count may include the number of WAPs 102 that have detected the client device 108.

[0071] The network topology information may include information about a communication network implemented as part of the computing environment 100. For example, for each detected device and to the extent applicable, the network topology information may include identification of one or more neighboring devices. Gathering such information for devices detected within the network of the computing environment 100 may allow the NMS 116 to construct a topology of the communication network.

[0072] The timestamp information may include an identification of a time or time period when the malicious classification information 204 was obtained.

[0073] Although the active malicious classification strategy 202 and malicious classification information 204 are illustrated and described, the present disclosure contemplates that the NMS 116 stores historical malicious classification strategies and historical malicious classification information, if appropriate. For example, the NMS 116 may also store historical active malicious classification strategies and malicious classification information, rather than simply storing the most recent active malicious classification strategy 202 and malicious classification information 204.

[0074] The recommended malicious classification policy 206 , described in greater detail below with reference to the malicious rules auto-profiler engine 210 , may include receiving a recommendation from the malicious policy analysis engine 118 to update or otherwise modify the proactive malicious classification policy 202 .

[0075] Turning to the malicious policy analysis engine 118, in certain embodiments, the malicious policy analysis engine 118 includes a malicious snapshot engine 208 and a malicious rule auto-parser engine 210 to implement some or all of the operations of the malicious policy analysis engine 118. Although shown separately, the present disclosure contemplates that the malicious snapshot engine 208 and the malicious rule auto-parser engine 210 are separate or combined. As just one example, the malicious snapshot engine 208 and the malicious rule auto-parser engine 210 can be implemented on the same or different computer systems.

[0076] Typically, malicious snapshot engine 208 periodically obtains active malicious classification policy 202 and malicious classification information 204 and stores the information as time series data in storage device 200b. In some embodiments, malicious snapshot engine 208 performs some initial analysis of the information malicious snapshot engine 208 collects.

[0077] Malicious snapshot engine 208 may be coupled to or otherwise associated with storage device 200b, which may store information to be used by or generated by malicious snapshot engine 208. Storage device 200b may store active malicious detection policies 202, malicious classification information 204, and pre-analyzed malicious classification information 212, each of which is described in more detail below.

[0078] The malicious snapshot engine 208 may periodically obtain and store snapshots of certain malicious information from the NMS 116, which may be provided to the malicious snapshot engine 208 as malicious information 214. The malicious snapshot engine 208 may periodically poll the NMS 116 for malicious information 214. For example, the malicious snapshot engine 208 may periodically poll the NMS 116 (and / or any other suitable electronic device) for attributes defined by a configuration mode of the malicious snapshot engine 208. Such a configuration mode may identify attributes for which the malicious snapshot engine 208 may attempt to obtain attribute values. In part, the configuration mode may identify some or all of the attributes or other information included in the malicious classification information 204, and the malicious information 214 may include current values ​​of those attributes or other information. Additionally or alternatively, the NMS 116 may be configured to periodically provide the malicious information 214 to the malicious snapshot engine 208 on its own.

[0079] Malicious information 214 may include active malicious classification policies 202 and malicious classification information 204. For example, malicious information 214 may include some or all of the active malicious classification policies 202, and some or all of the information in malicious classification information 204. Malicious snapshot engine 208 may store active malicious classification policies 202 and malicious classification information 204 in a manner that timestamps the information. As just one example, malicious snapshot engine 208 may store active malicious classification policies 202 and malicious classification information 204 as time series data in storage device 200b. The present disclosure contemplates that malicious snapshot engine 208 stores active malicious classification policies 202 and malicious classification information 204 in any suitable format.

[0080] In certain embodiments, obtaining malicious classification information 204 over time (e.g., as time series data) can provide a better understanding of the behavior of detected electronic devices to the malicious snapshot engine 208 (and later the malicious rule auto-profiler engine 210). For example, while the values ​​of attributes of detected electronic devices may provide an overview of the electronic devices in a particular situation, over time, the values ​​of the attributes may provide an overview of how the electronic devices behave, including, for example, how those electronic devices move throughout a communication network or change in ways that may be unexpected and / or indicative of a potential threat.

[0081] As described above, the active malicious classification policy 202 may include a set of rules that the NMS 116 evaluates when determining a malicious classification to assign to a detected device. Additionally, as described above, the malicious classification information 204 may include various information associated with a communication network implemented by the computing environment 100 and with electronic devices detected while connected to or otherwise associated with the communication network. In certain embodiments, the malicious classification information 204 may include one or more of device attributes, device classification information (e.g., identification of a classification assigned to a detected device), activity attributes (e.g., relating to the behavior of a detected device), identification of which one or more malicious classification policies resulted in a particular classification of a device, network topology information, timestamp information, and / or any other suitable information.

[0082] Thus, the malicious snapshot engine 208 may periodically store the corresponding current malicious classifications of devices detected by the NMS 116 in the computing environment 100, as well as the active malicious classification policies 202 used to analyze and determine the malicious classifications of those detected devices. Because the active malicious classification policies 202 applied by the NMS 116 may change over time, the malicious snapshot engine 208 may periodically obtain new active malicious classification policies 202, potentially each time the malicious snapshot engine 208 obtains new malicious classification information 204, and / or any time the active malicious classification policies 202 are updated at the NMS 116. Obtaining the current active malicious classification policies 202 may help ensure that the analysis performed by the malicious snapshot engine 208 (e.g., the pre-analysis described below) and the analysis performed by the malicious rule auto-analyzer engine 210 evaluate the latest version of the active malicious classification policies 202 used to determine the malicious classifications that are part of the malicious classification information 204 being analyzed.

[0083] In some embodiments, the malicious snapshot engine 208 can perform a pre-analysis of the malicious classification information 204 to attempt to identify anomalies in the attribute values ​​and verify the malicious classification of the electronic device detected within the communication network of the computing environment 100, as determined by the NMS 116 according to the active malicious classification policy 202. For example, before transmitting the malicious information 216 to the malicious rule auto-analyzer engine 210, the malicious snapshot engine 208 can pre-analyze the active malicious classification policy 202 and / or the malicious classification information 204 to generate pre-analyzed malicious classification information 212. The malicious snapshot engine 208 can perform such pre-analysis in response to receiving the malicious information 214 and / or at any other suitable interval.

[0084] In some embodiments, the pre-analysis performed by the malicious snapshot engine 208 includes attempting to identify anomalies in the malicious classification information 204. For example, the pre-analysis performed by the malicious snapshot engine 208 includes attempting to identify anomalies in the attribute values ​​of the malicious classification information 204 and verifying the corresponding malicious classifications determined by the NMS 116 according to the active malicious classification policy 202 for devices detected within the communication network of the computing environment 100.

[0085] In some embodiments, to perform pre-analysis, malicious snapshot engine 208 uses one or more statistical anomaly algorithms, such as Z-score algorithm, K nearest neighbor algorithm, support vector machine, density-based clustering technology. These algorithms or other algorithms can be used in any suitable combination.

[0086] The Z-score algorithm generally refers to a statistical technique that measures how far a particular data point (e.g., the value of an attribute) is from the rest of a data set. For example, the Z-score can measure how many standard deviations a particular data point is from the mean of a data set.

[0087] K-nearest neighbor algorithm is a machine learning classification algorithm that helps to categorize things based on their similarity to other nearby data points. In other words, K-nearest neighbor algorithm uses the proximity of data points to other data points to classify data points. K-nearest neighbor algorithm can also be used for regression analysis.

[0088] A support vector machine is a supervised learning model with an associated learning algorithm that analyzes data for classification and / or prediction. Like the K-nearest neighbor algorithm, support vector machines can also be used for regression analysis.

[0089] Density-based clustering techniques are unsupervised machine learning techniques that identify different clusters in a dataset based on the concept that related data points will be densely packed and separated from other related data points of other clusters by areas of sparse data.

[0090] Using one or more of these statistical anomaly algorithms or other statistical anomaly algorithms, the malicious snapshot engine 208 can identify deviations in the values ​​of the malicious classification information 204 (e.g., attribute values ​​or other information of the malicious classification information 204) over time, providing multiple predictability values ​​for a particular attribute from an acceptable range of values.

[0091] Considering a particular attribute "A", the malicious snapshot engine 208 may have stored time series data of attribute values ​​of attribute A corresponding to a particular electronic device over time. The malicious snapshot engine 208 may apply one or more statistical machine learning algorithms to a time window of attribute values ​​of the attribute corresponding to the particular device (which may be all or less than all of the time series data in the attribute values ​​of attribute A corresponding to the particular device). Such analysis of multiple attribute values ​​of attribute A corresponding to the particular device over time may provide one or more predictability values ​​of attribute A and may help identify anomalies and / or identify multiple predictability values ​​of attribute A. The multiple predictabilities of attribute A may be the same or different than the actual attribute values ​​of attribute A for the particular device stored in the time series data of the storage device 200b.

[0092] These multiple predictability values ​​(or other values ​​generated according to the statistical machine learning algorithm used by malicious snapshot engine 208 to analyze malicious classification information 204) can be stored by malicious snapshot engine 208 as part of pre-analyzed malicious classification information 212. That is, in some embodiments, malicious snapshot engine 208 can store the actual values ​​(e.g., included in malicious classification information 204) and the results of the statistical anomaly algorithm (e.g., multiple predictability values) in an array or other suitable storage format that can provide a set of sample outputs of device attributes. This information can form pre-analyzed malicious classification information 212.

[0093] In addition, based on the results of analyzing the malicious classification information 204 of the electronic device, the malicious snapshot engine 208 can determine a threat rating for the electronic device. The threat rating can be considered as a corresponding risk-based score for the detected device. The corresponding threat rating can reflect the relative ranking of the electronic device according to the potential threat posed by the electronic device. The corresponding threat rating can be separated from the corresponding malicious classification of the electronic device. In some embodiments, using different statistical machine learning algorithms, the malicious snapshot engine 208 can determine a variety of one or more threat ratings for a given electronic device, which can be the same or different from each other. These one or more threat ratings can be included in the pre-analyzed malicious classification information 212.

[0094] This process of pre-analyzing malicious classification information 204 and generating one or more predictability values ​​and / or one or more threat ratings may be repeated for each electronic device.

[0095] As a specific example application, statistical anomaly analysis of current (and historical) malicious classification information 204 may reveal that the certificate attributes of a particular device (e.g., a particular client device 108) are frequently modified over a period of time. Based on such analysis, the malicious snapshot engine 208 may mark the threat rating of the particular device as the highest threat rating, even if the threat rating indicates a malicious classification different from the malicious classification assigned to the particular device by the NMS 116 (as reflected in the malicious classification information 204). Likewise, such threat ratings assigned by the malicious snapshot engine 208 may be stored as part of the pre-analyzed malicious classification information 212. As another specific example, frequently changing values ​​of a given attribute (e.g., topology / location associated with the device, SSID, etc.) of a particular device (or group of devices) may result in an increase in the predicted threat level determined by the malicious snapshot engine 208 based on the applied statistical anomaly algorithm.

[0096] Malice snapshot engine 208 may store pre-analyzed malicious classification information 212 as time series data or in another suitable format.

[0097] In some embodiments, the malicious snapshot engine 208 is configured to transmit the malicious information 216 to the malicious rule auto-parser engine 210 for further analysis. The malicious information 216 may include the active malicious classification strategy 202 and / or the malicious classification information 204. In embodiments where the malicious snapshot engine 208 pre-analyzes the malicious classification information 204, the malicious information 216 may include the pre-analyzed malicious classification information 212. In some embodiments, the malicious snapshot engine 208 provides the pre-analyzed malicious classification information 212 to the malicious rule auto-parser engine 210 in a specific template that is understandable to the malicious rule auto-parser engine 210 after calculation and in an understandable format (e.g., a time series database) that can be consumed (and only consumed by the malicious rule auto-parser engine 210).

[0098] Turning to the malicious rule auto-analyzer engine 210, typically, the malicious rule auto-analyzer engine 210 is configured to periodically perform additional analysis of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 in view of the active malicious classification strategy 202, and depending on the results of any given instance of the analysis, potentially recommend one or more changes to the active malicious classification strategy 202.

[0099] The malicious rules auto-profiler engine 210 may be coupled to or otherwise associated with a storage device 200c, which may store information to be used by or generated by the malicious rules auto-profiler engine 210. The storage device 200c may store active malicious detection strategies 202, malicious classification information 204, pre-analyzed malicious classification information 212, machine learning algorithms 218, malicious classifications 220, and recommended malicious classification strategies, each of which is described in more detail below.

[0100] The malicious rule auto-analyzer engine 210 may periodically obtain the malicious information 216 from the malicious snapshot engine 208. The malicious rule auto-analyzer engine 210 may periodically poll the malicious snapshot engine 208 for the malicious information 216. Additionally or alternatively, the malicious snapshot engine 208 may be configured to periodically provide the malicious information 216 to the malicious rule auto-analyzer engine 210 on its own. In some embodiments, the malicious rule auto-analyzer engine 210 may obtain the active malicious classification strategy 202 from the NMS 116.

[0101] Malicious information 216 may include active malicious classification strategy 202, malicious classification information 204, and / or pre-analyzed malicious classification information 212. For example, malicious information 216 may include some or all of the information in active malicious classification strategy 202, some or all of the information in malicious classification information 204, and some or all of the information in pre-analyzed malicious classification information 212. In some embodiments, malicious classification information 204 and pre-analyzed malicious classification information 212 may be combined in a suitable manner.

[0102] The malicious rule automatic parser engine 210 can store the malicious information 216 in the storage device 200c in a manner that timestamps the information. As just one example, the malicious rule automatic parser engine 210 can store the active malicious classification strategy 202, the malicious classification information 204, and / or the pre-analyzed malicious classification information 212 as time series data in the storage device 200c. The present disclosure contemplates that the malicious rule automatic parser engine 210 stores the active malicious classification strategy 202, the malicious classification information 204, and / or the pre-analyzed malicious classification information 212 in any suitable format.

[0103] Malicious rules auto-profiler engine 210 is configured to periodically analyze malicious classification information 204 and / or pre-analyzed malicious classification information 212 in light of proactive malicious classification policy 202 and, depending on the results of any given instance of the analysis, potentially recommend one or more changes to proactive malicious classification policy 202 .

[0104] In some embodiments, the malicious rule automatic parser engine 210 is configured to analyze the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 using one or more statistical machine learning algorithms 218, examples of which are described below. The malicious rule automatic parser engine 210 can use any of a variety of machine learning algorithms or other artificial intelligence algorithms to analyze the active malicious classification strategy 202 and the malicious classification information 204 (and / or the pre-analyzed malicious classification information 212, if appropriate). One or more statistical machine learning algorithms 218 can be used in combination to analyze the malicious classification information 204 and / or the pre-analyzed malicious classification information 212.

[0105] For example, malicious rule auto-analyzer engine 210 may analyze malicious classification information 204 and / or pre-analyzed malicious classification information 212 using a data correlation method, such as by applying a data correlation algorithm to corresponding attribute values ​​of the electronic device.

[0106] As another example, the malicious rule auto-analyzer engine 210 can analyze the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 using a data probability approach, such as by applying a data probability algorithm to corresponding attribute values ​​of the electronic device.

[0107] In some embodiments, the one or more statistical machine learning algorithms include one or more of a Z-score algorithm, a K-nearest neighbor algorithm, a support vector machine, and a density-based clustering technique. These algorithms or other algorithms may be used in any suitable combination.

[0108] In some embodiments, analyzing the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 includes assigning a corresponding threat rating to the electronic device. The corresponding threat rating can be considered as a corresponding risk-based score for the detected device. The corresponding threat rating can reflect the relative ranking of the electronic device according to the potential threat posed by the electronic device. The corresponding threat rating can be separated from the corresponding malicious classification of the electronic device. In some embodiments, the corresponding threat rating is determined based on at least a portion of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212. For example, the threat rating of a specific electronic device can be determined based on at least a portion of the corresponding attribute value of the electronic device. As another example, to the extent that the malicious snapshot engine 208 generates the pre-analyzed malicious classification information 212 and the malicious classification information includes one or more threat ratings determined for one or more attributes of a specific electronic device (or a group of electronic devices), the threat rating determined by the malicious rule automatic analyzer engine 210 can further take into account the threat rating determined by the malicious snapshot engine 208.

[0109] The threat rating may be based on any suitable number of factors, in any suitable combination. As a specific example of one potential factor in determining a threat rating, an electronic device that attempts to connect to a communication network at a higher frequency than another electronic device may be considered a higher threat risk. As a specific example of another potential factor in determining a threat rating, an electronic device with a higher entry point (e.g., attack vector) into the network may be considered a greater threat than an electronic device with a lower entry point into the network. That is, in some embodiments, network switch 106 may be considered a greater threat than controller 104, controller 104 may be considered a greater threat than WAP 102, and WAP 102 may be considered a greater threat than client device 108.

[0110] In some embodiments, for a particular device (or group of devices), the malicious rule auto-profiler engine 210 may use one or more data probabilistic methods to determine a threat rating to assign to a given attribute. The probabilistic method may include a delayed attribute value of the attribute and one or more threat ratings for the attribute determined by the malicious snapshot engine 208. Based on such analysis using the data probabilistic method, the malicious rule auto-profiler engine 210 may determine a specific threat rating to assign to the attribute of the particular device (or group of devices).

[0111] The malicious rule automatic parser engine 210 can determine the corresponding threat rating of the electronic device before performing at least part of the analysis of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 using one or more statistical machine learning algorithms 218, and the determined threat rating can be part of the statistical analysis. For example, one or more data correlation methods can then be applied, taking into account the determined threat rating, device type, location in the network, neighboring devices (and / or other topological characteristics), and any other suitable information. For example, the malicious rule automatic parser engine 210 can then use the data correlation algorithm to perform a threat risk analysis. In some embodiments, the threat risk analysis can be based on malicious information 216, such as the type of a particular device (e.g., a client device, a WAP, a controller, a network switch, etc.), the location of a particular device in a communication network (e.g., an attack vector), neighboring devices of a particular device, and / or any other suitable information. Such a threat risk analysis can help determine the overall threat rating of a particular device.

[0112] Malicious rules auto-analyzer engine 210 may repeat this process for one or more of the devices (or groups of devices) whose information is included in malicious information 216 to determine a corresponding threat rating for the electronic device.

[0113] Based on the analysis of malicious classification information 204 and / or pre-analyzed malicious classification information 212, malicious rule auto-profiler engine 210 may determine a corresponding malicious classification 220 for the detected device. For a given device, the malicious classification 220 of the device may or may not be different from the malicious classification determined by NMS 116 and / or any malicious classification determined as part of the pre-analysis performed by malicious snapshot engine 208. The corresponding malicious classification 220 may benefit from the use of machine learning algorithm 218 and delayed data of malicious classification information 204 and / or pre-analyzed malicious classification information 212.

[0114] Analysis of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 may result in an evaluation of the active malicious classification policies 202. The evaluation may include a determination of whether to provide one or more recommended malicious classification policies 206 to update the active malicious classification policies 202. For example, based on the analysis, the malicious rule auto-profiler engine 210 may determine that one or more active malicious classification policies 202 are not performing optimally, that certain detected devices are not assigned an optimal malicious classification, or that other deficiencies exist (or are predicted) with respect to classifying detected devices using the active malicious classification policies 202.

[0115] In some embodiments, the analysis of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 may include separately performing a statistical analysis of the corresponding attribute values ​​of the detected attributes of the electronic device, and comparing the analysis results with the active malicious classification strategy 202. For example, the statistical analysis of the corresponding attribute values ​​of the detected attributes of the electronic device may identify anomalies present and / or predicted in the classification results generated according to the active malicious classification strategy 202. The anomaly may be an anomaly in the attribute definitions, attribute values, and / or any other suitable aspects of the active malicious classification strategy 202 and / or the malicious classification information 204 and / or the pre-analyzed malicious classification information 212. If the analysis performed by the malicious rule automatic parser engine 210 detects such an anomaly, the malicious rule automatic parser engine 210 may determine to recommend one or more recommended malicious classification strategies 206. If appropriate, one or more thresholds may be defined to control when the detected statistical anomaly is significant enough for the malicious rule automatic parser engine 210 to determine to recommend one or more recommended malicious classification strategies 206.

[0116] If, based on the analysis, the malicious rule auto-profiler engine 210 determines that one or more recommendations should be made, the malicious rule auto-profiler engine 210 may generate one or more recommended malicious classification policies 206. The recommended malicious classification policies 206 may include, for example, new malicious classification policies or updates to the active malicious classification policies 202. In some embodiments, one or more of the recommended malicious classification policies 206 are template malicious classification policies that include one or more fields for configuration, such as by a network administrator (e.g., a user of the administrator device 112).

[0117] For example, the malicious rule automatic analyzer engine 210 has stored the active malicious classification strategy 202 (e.g., stored in the storage device 200c), which may include a policy template and associated values ​​of one or more attributes. If appropriate, a new policy template with associated recommended values ​​can be mapped and used as one of the policies in the recommended malicious classification strategy 206.

[0118] In some embodiments, the attributes that can be used for the recommended malicious classification policy 206 are optional attributes that are known to the malicious rule auto-profiler engine 210 (as well as the NMS 116 and the malicious snapshot engine 208) through the active malicious classification policy 202. The recommended malicious classification policy 206, which is an updated and ready-to-deploy active malicious classification policy 202, may or may not be activated. In some embodiments, if the attribute has already been configured as part of the active malicious classification policy 202, the recommended malicious classification policy 206 may include a recommendation for a new value for the attribute for a particular active malicious classification policy 202 in order to modify the particular active malicious classification policy 202. In some embodiments, if the attribute has not yet been configured as part of the active malicious classification policy 202, the recommended malicious classification policy 206 may include a recommendation for a newly defined attribute with an associated value assignment to be added to the active malicious classification policy 202. The value defined by the recommended malicious classification policy 206 may be a specific value or may be a range of values.

[0119] In some embodiments, the malicious rule auto-profiler engine 210, possibly in cooperation with the NMS 116, automatically deploys one or more of the recommended malicious classification policies 206 such that those recommended malicious classification policies 206 automatically become part of the active malicious classification policies 202 for future evaluations of devices of the computing environment 100. For example, the malicious rule auto-profiler engine 210 may automatically deploy one or more of the recommended malicious classification policies 206 on one or more electronic devices such that the electronic devices automatically incorporate the recommended malicious classification policies 206 into the active malicious classification policies 202. The electronic devices to which the recommended malicious classification policies 206 are deployed may be one or more of the NMS 116, the WAP 102, the controller 104, the network switch 106, or any other suitable electronic device.

[0120] In certain embodiments, the malicious rule auto-profiler engine 210, possibly in cooperation with the NMS 116, submits one or more of the recommended malicious classification policies 206 for review by an appropriate individual such as a network administrator (e.g., a user of the administrator device 112). For example, the malicious rule auto-profiler engine 210 can transmit the recommended malicious classification policies 206 to the NMS 116 and / or an associated administrator device 112 (e.g., a network administrator) for evaluation prior to deploying the recommended malicious classification policies 206 for incorporation into the active malicious classification policies 202.

[0121] The malicious rule auto-profiler engine 210 can repeat this process of evaluating the proactive malicious classification policies 202 applied by the NMS 116 and potentially recommending changes to those proactive malicious classification policies 202 over time to continually improve the accuracy of the proactive malicious classification policies 202 applied by the NMS 116. In addition, embodiments of the present disclosure apply sophisticated machine learning algorithms that benefit from historical data and analysis performed over time to analyze the proactive malicious classification policies 202 and make associated recommendations, reducing or eliminating reliance on individuals (e.g., network administrators) to evaluate and adjust the proactive malicious classification policies 202.

[0122] Although primarily described with respect to individual electronic devices (e.g., WAP 102, controller 104, network switch 106, and client device 108), NMS 116 and / or malicious policy analysis engine 118, including malicious snapshot engine 208 and / or malicious rule auto-analyzer engine 210, may evaluate electronic devices individually or as a group or groups of electronic devices.

[0123] Storage devices 200a, 200b, and 200c (collectively referred to as storage devices 200) can each adopt the form of volatile memory or non-volatile memory, including but not limited to magnetic media, optical media, RAM, ROM, removable media, or any other suitable memory components. In certain embodiments, a portion of all storage devices 200 may include a database, such as one or more structured query language (SQL) servers, time series databases, and / or relational databases. Additionally or alternatively, in certain embodiments, part or all of the storage devices 200 may include non-relational storage devices. Although storage devices 200a, 200b, and 200c are shown separately, one or more storage devices in storage devices 200a, 200b, and 200c may be combined or further separated in any suitable manner.

[0124] Figure 3 Additional details of an example computer system 110 are shown, including an NMS 116 and a malicious policy analysis engine 118 for analyzing and recommending malicious classification policies in a communication network, according to some embodiments. Although a particular implementation of computer system 110 is illustrated and described, this disclosure contemplates any suitable implementation of computer system 100.

[0125] Computer system 110 may be implemented using any suitable combination of hardware, firmware, and software. Computer system 110 includes processor 300, memory 302, and network interface 304. Although described in the singular for ease of description, computer system 110 may include one or more processors 300, one or more memories 302, and one or more network interfaces 304.

[0126] Processor 300 may include one or more microprocessors, controllers, or any other suitable computing device or resource. Processor 300 may work alone or in conjunction with other components of computing environment 100 (see Figure 1 ) to provide some or all of the functionality of its associated computer system 110 described herein.

[0127] Memory 302 may take the form of volatile or non-volatile memory including, but not limited to, magnetic media, optical media, RAM, ROM, removable media, or any other suitable memory component.

[0128] Memory 302 stores NMS 116 and malicious policy analysis engine 118. In an example where malicious policy analysis engine 118 is implemented using malicious snapshot engine 208 and malicious rule auto-analyzer engine 210, memory 302 may store malicious snapshot engine 208 and malicious rule auto-analyzer engine 210.

[0129] Memory 302 may include storage device 200. Figure 3 For the sake of overcrowding, the contents of storage device 200 are not shown. Although storage device 200 is shown as part of memory 302, storage device 200 may be part of memory 302 or separate from memory 302. In addition, one or more of storage devices 200 may be separate from and potentially remote from one or more processing devices on which NMS 116, malicious snapshot engine 208, and / or malicious rule auto-profiler engine 210 operate.

[0130] Interface 304 represents any suitable computer element that can receive information from a communication network, transmit information through a communication network, perform appropriate processing of information, communicate with other components (e.g., of computing environment 100), or any combination of the foregoing. Interface 304 represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate over a LAN, WAN, or other communication system that allows information to be exchanged with devices of computing environment 100. Interface 304 can facilitate wireless communications and / or wired communications.

[0131] Figures 4 to 6 An example method for analyzing a malicious classification policy (e.g., an active malicious classification policy 202) for a communication network is shown in accordance with some embodiments. Figures 4 to 6 The described methods may be applied to any suitable type of communication network including any suitable type of electronic device, but in some embodiments, the communication network is a WLAN and the electronic device includes one or more of a client device (e.g., client device 108), a WAP (e.g., WAP 102), a WLAN controller (e.g., WLAN controller 104), or a network switch (e.g., network switch 106). Each of these figures is described below.

[0132] Figure 4 An example method 400 for analyzing and recommending a malicious classification policy for a communication network according to some embodiments is shown. In some embodiments, some or all of the operations associated with method 400 are performed by a computer system 110, which may also be referred to as a processing device. For example, some or all of the operations associated with method 600 may be performed by a malicious policy analysis engine 118. In some embodiments, computer system 110 includes NMS 116.

[0133] At step 402, the malicious policy analysis engine 118 obtains malicious classification information 204 of electronic devices detected within a communication network (e.g., a communication network associated with the computing environment 100) at multiple times. The malicious classification information 204 at each of the times may include: timestamp information identifying the time; a corresponding attribute value set of the electronic device detected within the communication network at the time (e.g., as part of the malicious classification information 204); and a corresponding malicious classification of the electronic device detected within the communication network at the time determined according to the active malicious classification policy 202 and the corresponding attribute value set (e.g., as part of the malicious classification information 204).

[0134] As described above, in some embodiments, the proactive malicious classification policy 202 includes rules for classifying electronic devices detected within a communication network (e.g., associated with the computing environment 100) into a malicious classification in a plurality of possible malicious classifications. The plurality of possible malicious classifications define different levels of threats determined to be posed by the electronic devices detected within the communication network.

[0135] In some embodiments, the corresponding malicious classification of the electronic device detected in the communication network determined according to the active malicious classification strategy 202 can be determined according to the corresponding attribute value of the electronic device detected in the communication network. The corresponding attribute value can be used for attributes including device attributes and activity attributes associated with the corresponding electronic device.

[0136] At step 404, the malicious policy analysis engine 118 may analyze the malicious classification information 204 at multiple times to determine whether to modify the active malicious classification policy 202. Analyzing the malicious classification information 204 at multiple times may include analyzing the corresponding malicious classifications (e.g., of the malicious classification information 204) and corresponding attribute value sets (e.g., of the malicious classification information 204) of the electronic device at multiple times using a statistical machine learning algorithm.

[0137] In some embodiments, analyzing the malicious classification information 204 using a statistical machine learning algorithm includes analyzing corresponding attribute values ​​of the electronic device (e.g., of the malicious classification information 204) using one or more data correlation algorithms. In some embodiments, analyzing the malicious classification information 204 using a statistical machine learning algorithm includes analyzing corresponding attribute values ​​of the electronic device (e.g., of the malicious classification information 204) using one or more data prediction algorithms.

[0138] In some embodiments, before analyzing the malicious classification information 204, the malicious policy analysis engine 118 may perform a preliminary analysis 204 of the malicious classification information to attempt to identify anomalies in corresponding attribute values ​​(e.g., of the malicious classification information 204) and verify the corresponding malicious classification (e.g., of the malicious classification information 204) of electronic devices detected within the communication network determined according to the active malicious classification policy 202.

[0139] In some embodiments, analyzing malicious classification information 204 includes assigning a threat rating to a particular electronic device. The threat rating can be separate from the corresponding malicious classification of the particular electronic device and can be determined based on at least a portion of a corresponding attribute value of the particular electronic device.

[0140] At step 406 , the malicious policy analysis engine 118 determines whether to modify the proactive malicious classification policy 202 based on the analysis of the malicious classification information 204 at multiple times.

[0141] If the malicious policy analysis engine 118 determines not to modify the proactive malicious classification policy 202 at step 406 , the method 400 may proceed to step 412 .

[0142] If the malicious policy analysis engine 118 determines to modify the proactive malicious classification policy 202 at step 406 , then at step 408 , the malicious policy analysis engine 118 may generate one or more recommended malicious classification policies 206 in response to determining to modify the proactive malicious classification policy 202 .

[0143] In some embodiments, the recommended malicious classification strategy 206 may be a new malicious classification strategy or an update to the active malicious classification strategy 202. In some embodiments, the recommended malicious classification strategy 206 may be a template malicious classification strategy that includes one or more fields for configuration, and the recommended malicious classification strategy 206 may include recommended values ​​for the one or more fields. For example, the one or more fields may correspond to one or more attributes.

[0144] At step 410, the malicious policy analysis engine 118 transmits one or more recommended malicious classification policies 206 generated at step 408 for consideration and / or deployment. For example, the recommended malicious classification policies 206 may be transmitted to a network administrator (e.g., associated with the administrator device 112) for evaluation before deploying the recommended malicious classification policies 206 for incorporating the recommended malicious classification policies 206 into active malicious classification policies in the active malicious classification policies 202. As another example, the recommended malicious classification policies 206 may be automatically deployed on an electronic device (e.g., NMS 116) so that the electronic device automatically incorporates the recommended malicious classification policies 206 into active malicious classification policies in the active malicious classification policies 202.

[0145] The one or more recommended malicious classification strategies 206 generated in step 408 can all be transmitted in the same manner or in various manners. For example, before the recommended malicious classification strategies 206 are deployed, some or all of the one or more recommended malicious classification strategies 206 can be transmitted to a network administrator (e.g., associated with the administrator device 112) for evaluation. As another example, some or all of the one or more recommended malicious classification strategies 206 can be automatically deployed on an electronic device (e.g., NMS 116) so that the electronic device automatically merges the recommended malicious classification strategies 206 into active malicious classification strategies in the active malicious classification strategies 202.

[0146] Figure 5 An example method 500 for analyzing a malicious classification policy for a communication network is shown in accordance with some embodiments. In some embodiments, some or all of the operations associated with the method 500 are performed by the computer system 110. For example, some or all of the operations associated with the method 600 may be performed by the malicious policy analysis engine 118, such as by the malicious snapshot engine 208. For purposes of this example, the present disclosure describes the malicious snapshot engine 208 as performing the operations of the method 500. As described below, the method 500 may be an iterative process.

[0147] At step 502, malicious snapshot engine 208 obtains malicious information 214 from NMS 116. In some embodiments, malicious snapshot engine 208 periodically requests malicious information 214 from NMS 116, and NMS 116 transmits malicious information 214 to malicious snapshot engine 208 in response to the request. Additionally or alternatively, in some embodiments, NMS 116 may periodically send malicious information 214 to malicious snapshot engine 208 on its own.

[0148] The malicious information 214 may include the active malicious classification policy 202 and the current malicious classification information 204. Although the malicious information 214 is described as including the active malicious classification policy 202, in some embodiments, the active malicious classification policy 202 may be omitted from the malicious information 214. Although the active malicious classification policy 202 may be omitted from the malicious information 214 for any suitable reason, in some embodiments, in addition to the initial communication of the active malicious classification policy 202, the NMS 116 transmits the active malicious classification policy 202 to the malicious snapshot engine 208 when the active malicious classification rules 202 change, which may reduce the amount of data transmitted to the malicious snapshot engine 208 via at least some transmissions of the malicious information 214.

[0149] At step 504, the malicious snapshot engine 208 stores the malicious information 214 as time series data. For example, the malicious snapshot engine 208 may store the malicious information 214 as time series data in the storage device 200b. As a specific example, the malicious snapshot engine 208 may store the current malicious classification information 204 as time series data in the storage device 200b. As described above, the malicious classification information 204 may include one or more of device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identification of a classification assigned to a detected device), activity attributes (e.g., related to the behavior of the detected device), identification of which one or more malicious classification policies lead to a particular classification of the device, network topology information, timestamp information, and / or any other suitable information. Although the malicious classification information 204 is described as including specific attributes or other information, the malicious classification information 204 may include any suitable attributes or other information. Therefore, in some embodiments, the malicious snapshot engine 208 stores the attribute values ​​at a specific time as time series data in the storage device 202b. Over time (eg, over multiple passes through method 500), malicious classification information 204 stored in storage device 202b may form a snapshot of data (eg, attribute values) captured at a particular time.

[0150] The active malicious classification policy 202 may or may not be stored as part of the time series data. For example, the malicious snapshot engine 208 may simply store the latest copy of the active malicious classification policy 202. Additionally or alternatively, the malicious snapshot engine 208 may store time-stamped copies of two or more unique versions of the active malicious classification policy 202 obtained over time.

[0151] At step 506, the malicious snapshot engine 208 performs a pre-analysis of the malicious classification information 204 to generate pre-analyzed malicious classification information 212. The malicious snapshot engine 208 may perform a pre-analysis of the malicious classification information 204 to attempt to identify anomalies in the attribute values ​​and verify the malicious classification of the electronic device detected within the communication network of the computing environment 100 as determined by the NMS 116 according to the active malicious classification policy 202. For example, before transmitting the malicious information 216 to the malicious rule auto-profiler engine 210 (at step 508, described below), the malicious snapshot engine 208 may pre-analyze the active malicious classification policy 202 and the malicious classification information 204 to generate the pre-analyzed malicious classification information 212. The malicious snapshot engine 208 may perform such pre-analysis in response to receiving the malicious information 214 and / or at any other suitable interval.

[0152] In some embodiments, the pre-analysis performed by the malicious snapshot engine 208 includes attempting to identify anomalies in the malicious classification information 204. For example, the pre-analysis performed by the malicious snapshot engine 208 includes attempting to identify anomalies in attribute values ​​and verifying corresponding malicious classifications determined by the NMS 116 according to the active malicious classification policy 202 for devices detected within the communication network of the computing environment 100.

[0153] In some embodiments, to perform pre-analysis, malicious snapshot engine 208 uses one or more statistical anomaly algorithms, such as Z-score algorithm, K nearest neighbor algorithm, support vector machine, density-based clustering technology. These algorithms or other algorithms can be used in any suitable combination.

[0154] Using one or more of these statistical anomaly algorithms or other statistical anomaly algorithms, malicious snapshot engine 208 can identify deviations in the values ​​of malicious classification information 204 (e.g., attribute values ​​or other information of malicious classification information 204) over time, providing multiple predictability values ​​for a particular attribute from a range of acceptable values. In some embodiments, malicious snapshot engine 208 can store the actual values ​​(e.g., included in malicious classification information 204) and the results of the statistical anomaly algorithms (e.g., multiple predictability values) in an array or other suitable storage format that can provide a set of sample outputs of device attributes. This information can form pre-analyzed malicious classification information 212.

[0155] The malicious snapshot engine 208 may store the pre-analyzed malicious classification information 212 as time series data or in another suitable format. Over time (e.g., over multiple passes through the method 500), the pre-analyzed malicious classification information 212 stored in the storage device 202b may form a snapshot of the data (e.g., analyzed attribute values) of the analysis performed at a particular time.

[0156] At step 508, the malicious snapshot engine 208 transmits the malicious information 216 to the malicious rule automatic parser engine 210 for further analysis. The malicious information 216 may include one or more of the malicious classification information 204, the pre-analyzed malicious classification information 212, or any other suitable information. For example, the malicious snapshot engine 208 may transmit a current snapshot of the malicious classification information 204 to the malicious rule automatic parser engine 210 for further analysis. Additionally or alternatively, the malicious snapshot engine 208 may transmit the latest pre-analyzed malicious classification information 212 to the malicious rule automatic parser engine 210 for further analysis. The malicious snapshot engine 208 may generate the latest pre-analyzed malicious classification information 212 based at least in part on the latest malicious classification information 204. Thus, over time (e.g., through repeated execution of the method 500), the malicious snapshot engine 208 may transmit the latest snapshots of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 to the malicious rule automatic parser engine 210.

[0157] At step 510, the malicious snapshot engine 208 determines whether a time interval has passed to determine whether to obtain additional malicious information 214 from the NMS 116. In other words, the malicious snapshot engine 208 determines whether it is time to obtain the next snapshot of the malicious information 214 from the NMS 116. As described above, the malicious snapshot engine 208 can periodically obtain the malicious information 214 from the NMS 116. The time interval can define the frequency with which the malicious snapshot engine 208 obtains the malicious information 214 (e.g., a snapshot of the malicious information 214) from the NMS 116. In addition, the time interval can be any suitable time. The time interval can be the same, or it can vary with different passes through the method 500.

[0158] If the malicious snapshot engine 208 determines at step 510 that the time interval has not passed, the malicious snapshot engine 208 may continue to wait before obtaining additional malicious information 214 from the NMS 116. If the malicious snapshot engine 208 determines at step 510 that the time interval has passed, the malicious snapshot engine 208 may return to step 502 to obtain additional malicious information 214 from the NMS 116.

[0159] The determination at step 510 may or may not be an explicit determination made by malicious snapshot engine 208. Malicious snapshot engine 208 may determine or otherwise be triggered in any suitable manner to obtain additional malicious information 214. As described above, additionally or alternatively, in some embodiments, NMS 116 may periodically send additional malicious information 214 to malicious snapshot engine 208 without malicious snapshot engine 208 requesting the additional malicious information 214.

[0160] Figure 6 An example method 600 for analyzing and recommending a malicious classification policy for a communication network according to some embodiments is shown. In some embodiments, some or all of the operations associated with the method 600 are performed by the computer system 110. For example, some or all of the operations associated with the method 600 may be performed by a malicious policy analysis engine 118, such as by a malicious rule auto-analyzer engine 210.

[0161] At step 602, the malicious rule automatic parser engine 210 obtains the malicious information 216 from the malicious snapshot engine 208. The malicious rule automatic parser engine 210 may periodically request the malicious information 216 from the malicious snapshot engine 208, and / or the malicious snapshot engine 208 may periodically transmit the malicious information 216 to the malicious rule automatic parser engine 210 on its own. In some embodiments, the malicious rule automatic parser engine 210 periodically requests the malicious information 216 from the malicious snapshot engine 208, and the malicious snapshot engine 208 transmits the malicious information 216 to the malicious rule automatic parser engine 210 in response to the request. Additionally or alternatively, in some embodiments, the malicious snapshot engine 208 may periodically send the malicious information 216 to the malicious rule automatic parser engine 210 on its own.

[0162] As described above, the malicious information 216 may include one or more of the malicious classification information 204, the pre-analyzed malicious classification information 212, or any other suitable information. For example, the malicious snapshot engine 208 may transmit a current snapshot of the malicious classification information 204 to the malicious rule automatic parser engine 210 for further analysis. Additionally or alternatively, the malicious snapshot engine 208 may transmit the latest pre-analyzed malicious classification information 212 to the malicious rule automatic parser engine 210 for further analysis. The malicious snapshot engine 208 may generate the latest pre-analyzed malicious classification information 212 based at least in part on the latest malicious classification information 204. Thus, over time (e.g., through repeated execution of the method 500), the malicious snapshot engine 208 may transmit the latest snapshots of the malicious classification information 204 and / or the pre-analyzed malicious classification information 212 to the malicious rule automatic parser engine 210.

[0163] Malicious classification information 216 may include: timestamp information identifying a time; a corresponding attribute value set of the electronic device detected in the communication network at that time (e.g., as part of malicious classification information 204 and / or pre-analyzed malicious classification information); and a corresponding malicious classification of the electronic device detected in the communication network at that time determined according to active malicious classification strategy 202 and the corresponding attribute value set (e.g., as part of malicious classification information 204 and / or pre-analyzed malicious classification information). In some embodiments, malicious information 216 includes active malicious classification strategy 202.

[0164] At step 604, the malicious rule automatic parser engine 210 stores the malicious information 216 as time series data. For example, the malicious rule automatic parser engine 210 may store the malicious information 216 as time series data in the storage device 200c. As a specific example, the malicious rule automatic parser engine 210 may store the current malicious classification information 204 as time series data in the storage device 200c. As described above, the malicious classification information 204 may include one or more of device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identification of a classification assigned to a detected device), activity attributes (e.g., related to the behavior of the detected device), identification of which one or more malicious classification policies lead to a particular classification of the device, network topology information, timestamp information, and / or any other suitable information. Although the malicious classification information 204 is described as including specific attributes or other information, the malicious classification information 204 may include any suitable attributes or other information. Therefore, in some embodiments, the malicious rule automatic parser engine 210 stores the attribute values ​​at a specific time as time series data in the storage device 202c. Over time (eg, over multiple passes through method 600 ), malicious classification information 204 stored in storage device 202 c may form historical data (eg, attribute values) that may be used as part of analyzing newly received malicious information 216 to evaluate proactive malicious classification strategy 202 .

[0165] The active malicious classification policy 202 may or may not be stored as part of the time series data. For example, the malicious rule auto-analyzer engine 210 may simply store the latest copy of the active malicious classification policy 202. Additionally or alternatively, the malicious rule auto-analyzer engine 210 may store time-stamped copies of two or more unique versions of the active malicious classification policy 202 obtained over time.

[0166] At step 606, the malicious rule automatic parser engine 210 can analyze the malicious classification information 204 at multiple times to determine whether to modify the active malicious classification strategy 202. Analyzing the malicious classification information 204 at multiple times can include analyzing the corresponding malicious classifications (e.g., of the malicious classification information 204) and corresponding attribute value sets (e.g., of the malicious classification information 204) of the electronic device at multiple times using a statistical machine learning algorithm.

[0167] In some embodiments, analyzing the malicious classification information 204 using a statistical machine learning algorithm includes analyzing corresponding attribute values ​​of the electronic device (e.g., of the malicious classification information 204) using one or more data correlation algorithms. In some embodiments, analyzing the malicious classification information 204 using a statistical machine learning algorithm includes analyzing corresponding attribute values ​​of the electronic device (e.g., of the malicious classification information 204) using one or more data prediction algorithms.

[0168] In some embodiments, analyzing malicious classification information 204 includes analyzing pre-analyzed malicious classification information 212 .

[0169] In some embodiments, analyzing malicious classification information 204 includes assigning a threat rating to a particular electronic device. The threat rating can be separate from the corresponding malicious classification of the particular electronic device and can be determined based on at least a portion of a corresponding attribute value of the particular electronic device.

[0170] At step 608 , the malicious rule automatic profiler engine 210 determines whether to modify the proactive malicious classification policy 202 based on the analysis of the malicious classification information 204 .

[0171] If the malicious rules auto-profiler engine 210 determines not to modify the proactive malicious classification policy 202 at step 608 , the method 600 may proceed to step 614 .

[0172] If the malicious policy analysis engine 118 determines to modify the proactive malicious classification policy 202 at step 608 , then at step 610 , the malicious policy analysis engine 118 may generate one or more recommended malicious classification policies 206 in response to determining to modify the proactive malicious classification policy 202 .

[0173] In some embodiments, the recommended malicious classification strategy 206 may be a new malicious classification strategy or an update to the active malicious classification strategy 202. In some embodiments, the recommended malicious classification strategy 206 may be a template malicious classification strategy that includes one or more fields for configuration, and the recommended malicious classification strategy 206 may include recommended values ​​for the one or more fields. For example, the one or more fields may correspond to one or more attributes.

[0174] At step 612, the malicious policy analysis engine 118 transmits one or more recommended malicious classification policies 206 generated at step 610 for consideration and / or deployment. For example, the recommended malicious classification policies 206 may be transmitted to a network administrator (e.g., associated with the administrator device 112) for evaluation before deploying the recommended malicious classification policies 206 for incorporating the recommended malicious classification policies 206 into active malicious classification policies in the active malicious classification policies 202. As another example, the recommended malicious classification policies 206 may be automatically deployed on an electronic device (e.g., NMS 116) so that the electronic device automatically incorporates the recommended malicious classification policies 206 into active malicious classification policies in the active malicious classification policies 202.

[0175] The one or more recommended malicious classification policies 206 generated at step 610 can all be transmitted in the same manner or in various manners. For example, before deploying the recommended malicious classification policies 206, some or all of the one or more recommended malicious classification policies 206 can be transmitted to a network administrator (e.g., associated with the administrator device 112) for evaluation. As another example, some or all of the one or more recommended malicious classification policies 206 can be automatically deployed on an electronic device (e.g., NMS 116) so that the electronic device automatically merges the recommended malicious classification policies 206 into active malicious classification policies in the active malicious classification policies 202.

[0176] Figure 7 700 according to some embodiments. As discussed above, the embodiments described herein may be implemented using a computing device. For example, the embodiments described herein may be implemented, at least in part, using one or more computing devices. Figures 1 to 3 200 (e.g., NMS 116 and malicious policy analysis engine 118 (including malicious snapshot engine 208 and malicious rule automatic analyzer engine 210, if appropriate) and their associated storage devices 200). As another example, the system may be implemented at least in part using one or more computing devices. Figures 4 to 6 All or any part of the method shown in .

[0177] The computing device 700 may include one or more computer processors 702, non-persistent storage 704 (e.g., volatile memory such as random access memory (RAM), cache memory, etc.), permanent storage 706 (e.g., a hard disk, an optical drive such as a compact disk (CD) drive or a digital versatile disk (DVD) drive, flash memory, etc.), a communication interface 712 (e.g., a Bluetooth interface, an infrared interface, a network interface, an optical interface, etc.), an input device 710, an output device 708, and many other elements and functions. Each of these components is described below.

[0178] In some embodiments, the computer processor(s) 702 may be an integrated circuit for processing instructions. For example, the computer processor(s) may be one or more cores or micro-cores of a processor. The processor 702 may be a general-purpose processor configured to execute program code included in software executed on the computing device 700. The processor 702 may be a special-purpose processor in which certain instructions are incorporated into the processor design. Although Figure 7 Only one processor 702 is shown, but computing device 700 may include any number of processors.

[0179] The computing device 700 may also include one or more input devices 710, such as a touch screen, keyboard, mouse, microphone, touch pad, electronic pen, motion sensor, or any other type of input device. The input device 710 may allow a user to interact with the computing device 700. In some embodiments, the computing device 700 may include one or more output devices 708, such as a screen (e.g., a liquid crystal display (LCD), a plasma display, a touch screen, a cathode ray tube (CRT) monitor, a projector, or other display device), a printer, an external storage device, or any other output device. One or more of the output devices may be the same or different from the input device. The input device and the output device may be locally or remotely connected to the computer processor 702, the non-permanent storage device 704, and the permanent storage device 706. There are many different types of computing devices, and the aforementioned input device and output device may take other forms. In some cases, a multimodal system may allow a user to provide multiple types of input / output to communicate with the computing device 700.

[0180] In addition, the communication interface 712 can facilitate connecting the computing device 700 to a network (e.g., a LAN, a WAN, such as the Internet, a mobile network, or any other type of network) and / or to another device, such as another computing device. The communication interface 712 can perform or facilitate the reception and / or transmission of wired or wireless communications using a wired transceiver and / or a wireless transceiver, including those utilizing the following: an audio jack / plug, a microphone jack / plug, a universal serial bus (USB) port / plug, Ports / plugs, Ethernet ports / plugs, Fiber optic ports / plugs, Proprietary wired ports / plugs, Wireless signal transmission, BLE wireless signal transmission, Wireless signal transmission, RFID wireless signal transmission, near field communication (NFC) wireless signal transmission, dedicated short range communication (DSRC) wireless signal transmission, 802.11 Wi-Fi wireless signal transmission, WLAN signal transmission, visible light communication (VLC), Worldwide Interoperability for Microwave Access (WiMAX), IR communication wireless signal transmission, public switched telephone network (PSTN) signal transmission, integrated services digital network (ISDN) signal transmission, 3G / 4G / 5G / LTE cellular data network wireless signal transmission, ad hoc network signal transmission, radio wave signal transmission, microwave signal transmission, infrared signal transmission, visible light signal transmission, ultraviolet light signal transmission, wireless signal transmission along the electromagnetic spectrum, or some combination thereof. The communication interface 712 may also include one or more global navigation satellite system (GNSS) receivers or transceivers, which are used to determine the location of the computing device 700 based on one or more signals received from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the US-based GPS, the Russian-based Global Navigation Satellite System (GLONASS), the Chinese-based BeiDou Navigation Satellite System (BDS), and the European-based Galileo GNSS. There is no restriction to operate on any particular hardware arrangement, so the basic features here can be easily replaced by improved hardware or firmware arrangements as developed.

[0181] The term computer-readable medium includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media that can store, contain, or carry instructions and / or data. Computer-readable media may include non-temporary media in which data can be stored and do not include carrier waves and / or transient electronic signals that are propagated wirelessly or by wired connections. Examples of non-temporary media may include, but are not limited to, disks or tapes, optical storage media such as CDs or DVDs, flash memory, memory, or memory devices. Code and / or machine executable instructions may be stored on computer-readable media, and these instructions may represent any combination of programs, functions, subroutines, programs, routines, subroutines, modules, software packages, classes, or instructions, data structures, or program statements. Code segments may be coupled to another code segment or hardware circuit by transmitting and / or receiving information, data, independent variables, parameters, or memory contents. Information, independent variables, parameters, data, etc. may be transmitted, forwarded, or transmitted via any suitable means (including memory sharing, message passing, token passing, network transmission, etc.).

[0182] All or any portion of the components of computing device 700 may be implemented as circuitry. For example, the components may include and / or may be implemented using electronic circuits or other electronic hardware, which may include one or more programmable electronic circuits (e.g., microprocessors, GPUs, DSPs, CPUs, and / or other suitable electronic circuits), and / or may include and / or be implemented using computer software, firmware, or any combination thereof to perform the various operations described herein. In some aspects, computer-readable storage devices, media, and memories may include cable signals or wireless signals containing bitstreams, etc. However, when referred to, non-transitory computer-readable storage media explicitly exclude media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0183] Certain embodiments may include none, some, or all of the following technical advantages.

[0184] Certain embodiments may use periodic snapshots of malicious classification information and evaluate active malicious classification strategies, such as those used by NMS to classify detected electronic devices, on an ongoing basis through analysis performed using various statistical machine learning algorithms. These snapshots and statistical machine learning algorithms may consider complex combinations of attribute values ​​of attributes of devices detected in the network to evaluate whether the malicious classification assigned to an electronic device is the best malicious classification device assigned to that electronic device. Such evaluation may reveal less than optimal assignments of malicious classifications, thereby revealing potential problems with the active malicious classification strategy.

[0185] Certain embodiments may improve the accuracy of malicious classification strategies employed by the NMS. For example, based on an evaluation of an active malicious classification strategy, certain embodiments provide the ability to automatically and on an ongoing basis generate a recommended malicious classification strategy that is designed to improve malicious classification based on an ongoing analysis of malicious classifications performed using an active malicious classification strategy. Certain embodiments may provide some or all of the recommended malicious classification strategies to a network administrator or other user for review, configuration (if appropriate), and potential deployment. Additionally or alternatively, certain embodiments provide the ability to automatically deploy some or all of the recommended malicious classification strategies for use as part of a future active malicious classification strategy with little to no intervention by a user such as a network administrator. Certain embodiments provide the ability to automatically deploy some or all of the recommended malicious classification strategies for use as part of a future active malicious classification strategy with little to no intervention by a network administrator or other user, thereby automatically improving the malicious classification capabilities of a communication network.

[0186] Given all the data considered and using the algorithms used to analyze the data, problems with the active malicious classification policy can be detected that are difficult or impossible for a human user, such as a network administrator, to detect. Even if a well-trained network administrator can identify some problems with the active malicious classification policy, it requires a lot of training and time to understand and analyze the data, and even to some extent it is possible to do so. In addition, network management tools typically provide network administrators with limited ways to resolve the problem, such as selecting from pre-defined policies or making certain limited changes to the rules associated with the pre-defined policies.

[0187] Certain embodiments establish malicious classification strategies that more quickly achieve more accurate malicious classifications of electronic devices. For example, although it may be appropriate to classify a particular electronic device as malicious or suspected malicious when the particular electronic device is initially detected, over time it may become clear that the particular device is not actually a malicious device. The improved malicious classification strategy of the present disclosure may reduce or eliminate the time it takes to correctly classify a particular electronic device in a more benign malicious classification category. As another example, although a particular electronic device may be a malicious device, the particular electronic device may initially be incorrectly classified in a benign malicious classification category; however, over time, the behavior or other characteristics of the particular electronic device may make it clear that the particular device is actually a malicious device. The improved malicious classification strategy of the present disclosure may reduce or eliminate the time it takes to correctly classify a particular electronic device as a malicious device.

[0188] Improving the malicious classification capabilities of electronic devices can improve the overall security of communication networks and can reduce the processing burden of electronic devices. For example, more accurately classifying malicious devices in a communication network can improve network security by identifying malicious devices that may be misclassified in a more benign malicious classification under an active malicious classification strategy, by reducing or eliminating the misclassification of devices that pose little or no threat as malicious (thereby freeing up resources, whether human or computing resources, to address actual malicious devices), and / or by providing other benefits. As another example, more accurately classifying malicious devices in a communication network (or at least reaching a more accurate malicious classification more quickly) can reduce the processing burden of electronic devices by allowing those processing resources to be directed to electronic devices that are more likely to become threats than electronic devices that pose little threat. Network administrators may also be able to focus on actual threats, thereby also potentially reducing their burden.

[0189] Example embodiments of the present disclosure are summarized here. Other embodiments may also be understood from the entirety of the specification and the claims filed herein.

[0190] Example 1. In certain embodiments, a method includes obtaining, by a processing device, malicious classification information of electronic devices detected within a communication network at multiple times. The malicious classification information for each of the multiple times may include: timestamp information identifying the time among the multiple times; a corresponding attribute value set of the electronic device detected within the communication network at the time; and a corresponding malicious classification of the electronic device detected within the communication network at the time determined according to an active malicious classification strategy and a corresponding attribute value set. The method includes analyzing, by a processing device, the malicious classification information at multiple times to determine whether to modify the active malicious classification strategy. Analyzing the malicious classification information at multiple times includes analyzing the corresponding malicious classifications and corresponding attribute value sets of the electronic devices at multiple times using a statistical machine learning algorithm. The method includes generating, by a processing device, a recommended malicious classification strategy in response to determining to modify the active malicious classification strategy.

[0191] Example 2. A method according to Example 1, wherein the active malicious classification strategy includes rules for classifying electronic devices detected within a communication network into malicious classifications among multiple malicious classifications, wherein the multiple malicious classifications define different levels of threats determined to be posed by the electronic devices detected within the communication network.

[0192] Example 3. A method according to any one of Examples 1-2, wherein the corresponding attribute values ​​of the electronic device detected within the communication network include values ​​of device attributes and activity attributes associated with the electronic device detected within the communication network.

[0193] Example 4. The method according to any one of Examples 1-3 further includes, before analyzing the malicious classification information, performing a preliminary analysis of the malicious classification information to attempt to identify anomalies in corresponding attribute values ​​and verify the corresponding malicious classification of electronic devices detected within the communication network determined according to an active malicious classification strategy.

[0194] Example 5. A method according to any one of Examples 1-4, wherein analyzing malicious classification information includes assigning a threat rating to a specific electronic device, wherein the threat rating is separated from the corresponding malicious classification of the specific electronic device and is determined based on at least a portion of the corresponding attribute value of the specific electronic device.

[0195] Example 6. A method according to any one of Examples 1-5, wherein analyzing malicious classification information using a statistical machine learning algorithm includes: applying a data correlation algorithm to corresponding attribute values ​​of the electronic device; and applying a data prediction algorithm to the corresponding attribute values ​​of the electronic device.

[0196] Example 7. The method according to any one of Examples 1 to 6 also includes automatically deploying a recommended malicious classification strategy on an electronic device so that the electronic device automatically merges the recommended malicious classification strategy into an active malicious classification strategy in the active malicious classification strategy.

[0197] Example 8. The method according to any one of Examples 1-6 also includes transmitting the recommended malicious classification strategy to a network administrator for evaluation by a processing device before deploying the recommended malicious classification strategy to merge the recommended malicious classification strategy into an active malicious classification strategy in the active malicious classification strategy.

[0198] Example 9. A method according to Example 8, wherein the recommended malicious classification strategy is a template malicious classification strategy including one or more fields for configuration, and the recommended malicious classification strategy includes recommended values ​​for the one or more fields.

[0199] Example 10. A method according to any one of Examples 1 to 9, wherein the recommended malicious classification strategy includes a new malicious classification strategy or an update to an active malicious classification strategy.

[0200] Example 11. A method according to any one of Examples 1-10, wherein: the communication network is a WLAN; and the electronic device includes one or more of the following: a client device; a wireless access point; a WLAN controller; or a network switch.

[0201] Example 12. The method of Example 1, wherein the processing device comprises a network management system.

[0202] Example 13. In certain embodiments, a computer system includes one or more processors and one or more non-transitory computer-readable storage media storing programming for execution by the one or more processors. The programming includes instructions for obtaining malicious classification information of electronic devices detected in a communication network at multiple times. The malicious classification information of each of the multiple times may include: timestamp information identifying the time in the multiple times; a corresponding attribute value set of the electronic device detected in the communication network at the time; and a corresponding malicious classification of the electronic device detected in the communication network at the time determined according to an active malicious classification strategy and a corresponding attribute value set. The programming also includes instructions for analyzing the malicious classification information at multiple times to determine whether to modify the active malicious classification strategy. Analyzing the malicious classification information at multiple times includes analyzing the corresponding malicious classifications and corresponding attribute value sets of the electronic devices at multiple times using a statistical machine learning algorithm. The programming also includes instructions for generating a recommended malicious classification strategy in response to determining to modify the active malicious classification strategy.

[0203] Example 14. A computer system according to Example 13, wherein the corresponding attribute values ​​of the electronic device detected within the communication network include values ​​of device attributes and activity attributes associated with the electronic device detected within the communication network.

[0204] Example 15. A computer system according to any one of Examples 13-14, wherein the programming also includes instructions for performing a preliminary analysis of malicious classification information to attempt to identify anomalies in corresponding attribute values ​​and verify corresponding malicious classifications of electronic devices detected within a communication network determined according to an active malicious classification strategy before analyzing the malicious classification information.

[0205] Example 16. A computer system according to any of Examples 13-15, wherein analyzing malicious classification information includes assigning a threat rating to a specific electronic device, wherein the threat rating is separate from the corresponding malicious classification of the specific electronic device and is determined based on at least a portion of a corresponding attribute value of the specific electronic device.

[0206] Example 17. A computer system according to any one of Examples 13-16, wherein analyzing malicious classification information using a statistical machine learning algorithm includes: analyzing corresponding attribute values ​​of electronic devices using a data correlation algorithm; and analyzing corresponding attribute values ​​of electronic devices using a data prediction algorithm.

[0207] Example 18. A computer system according to any one of Examples 13-17, wherein the programming also includes instructions for automatically deploying the recommended malicious classification strategy on an electronic device so that the electronic device automatically merges the recommended malicious classification strategy into an active malicious classification strategy in the active malicious classification strategy.

[0208] Example 19. A computer system according to any one of Examples 13-17, wherein the programming also includes instructions for transmitting the recommended malicious classification policy to a network administrator for evaluation before deploying the recommended malicious classification policy for merging the recommended malicious classification policy into an active malicious classification policy.

[0209] Example 20. In certain embodiments, one or more non-transitory computer-readable storage media store programming for execution by one or more processors. The programming includes instructions for obtaining malicious classification information of electronic devices detected within a communication network at multiple times. The malicious classification information for each of the multiple times may include: timestamp information identifying the time of the multiple times; a corresponding attribute value set of the electronic device detected within the communication network at the time; and a corresponding malicious classification of the electronic device detected within the communication network at the time determined according to an active malicious classification strategy and a corresponding attribute value set. The programming also includes instructions for analyzing the malicious classification information at multiple times to determine whether to modify the active malicious classification strategy. Analyzing the malicious classification information at multiple times includes analyzing the corresponding malicious classifications and corresponding attribute value sets of electronic devices at multiple times using a statistical machine learning algorithm. The programming also includes instructions for generating a recommended malicious classification strategy in response to determining to modify the active malicious classification strategy.

[0210] Although the present disclosure has been described with reference to the exemplary embodiments, this specification is not intended to be interpreted in a limiting sense. Various modifications and combinations of the exemplary embodiments and other embodiments of the present disclosure will be clear to those skilled in the art when referring to the specification. Therefore, the appended claims are intended to cover any such modifications or embodiments.

Claims

1. A method comprising: The processing device obtains malicious classification information of electronic devices detected in the communication network at multiple times, and the malicious classification information for each of the multiple times includes: Timestamp information, identifying the time among the multiple times; a corresponding set of attribute values ​​for the electronic device detected within the communication network at the time; and a corresponding malicious classification of the electronic device detected within the communication network at the time, determined according to an active malicious classification strategy and the corresponding attribute value set; The processing device analyzes the malicious classification information for the multiple times to determine whether to modify the active malicious classification strategy, wherein analyzing the malicious classification information for the multiple times includes: using a statistical machine learning algorithm to analyze the corresponding malicious classifications and the corresponding attribute value sets of the electronic devices for the multiple times; and A recommended malicious classification strategy is generated by the processing device in response to determining to modify the proactive malicious classification strategy.

2. A method according to claim 1, wherein the active malicious classification strategy includes rules for classifying the electronic device detected within the communication network into malicious classifications among multiple malicious classifications, and the multiple malicious classifications define different levels of threats determined to be posed by the electronic device detected within the communication network. 3 . The method of claim 1 , wherein the corresponding attribute values ​​of the electronic device detected within the communication network include values ​​of device attributes and activity attributes associated with the electronic device detected within the communication network.

4. The method according to claim 1, further comprising: Prior to analyzing the malicious classification information, a pre-analysis of the malicious classification information is performed to attempt to identify anomalies in the corresponding attribute values ​​and verify the corresponding malicious classification of the electronic device detected within the communication network, determined according to the active malicious classification strategy.

5. The method according to claim 1, wherein analyzing the malicious classification information comprises: A threat rating is assigned to a particular electronic device, the threat rating being separate from the corresponding malicious classification for the particular electronic device and determined based at least in part on the corresponding attribute value for the particular electronic device.

6. The method of claim 1, wherein using the statistical machine learning algorithm to analyze the malicious classification information comprises: applying a data correlation algorithm to the corresponding attribute values ​​for the electronic device; as well as A data prediction algorithm is applied to the corresponding attribute value for the electronic device.

7. The method according to claim 1, further comprising: The recommended malicious classification strategy is automatically deployed on the electronic device, so that the electronic device automatically merges the recommended malicious classification strategy into the active malicious classification strategy in the active malicious classification strategy.

8. The method according to claim 1, further comprising: Prior to deploying the recommended malicious classification policy for incorporating the recommended malicious classification policy into the active malicious classification policy in the active malicious classification policy, the processing device transmits the recommended malicious classification policy to a network administrator for evaluation.

9. The method according to claim 8, wherein the recommended malicious classification strategy is a template malicious classification strategy including one or more fields for configuration, and the recommended malicious classification strategy includes recommended values ​​for the one or more fields.

10. The method according to claim 1, wherein the recommended malicious classification strategy comprises a new malicious classification strategy or an update to an active malicious classification strategy.

11. The method according to claim 1, wherein: The communication network is a wireless local area network WLAN; and The electronic device includes one or more of the following: Client devices; Wireless access points; WLAN controller; or Network switch.

12. The method of claim 1, wherein the processing device comprises a network management system.

13. A computer system comprising: one or more processors; as well as one or more non-transitory computer-readable storage media storing programming for execution by the one or more processors, the programming comprising instructions for: Obtain malicious classification information of electronic devices detected in a communication network at multiple times, wherein the malicious classification information for each of the multiple times includes: Timestamp information, identifying the time among the multiple times; a corresponding set of attribute values ​​for the electronic device detected within the communication network at the time; and a corresponding malicious classification of the electronic device detected within the communication network at the time, determined according to an active malicious classification strategy and the corresponding attribute value set; Analyzing the malicious classification information for the multiple times to determine whether to modify the active malicious classification strategy, wherein analyzing the malicious classification information for the multiple times comprises: using a statistical machine learning algorithm to analyze the corresponding malicious classifications and the corresponding attribute value sets of the electronic devices for the multiple times; and A recommended malicious classification strategy is generated in response to determining to modify the proactive malicious classification strategy.

14. The computer system of claim 13, wherein the corresponding attribute values ​​of the electronic device detected within the communication network include values ​​of device attributes and activity attributes associated with the electronic device detected within the communication network.

15. A computer system according to claim 13, wherein the programming also includes instructions for performing a preliminary analysis of the malicious classification information before analyzing the malicious classification information to attempt to identify anomalies in the corresponding attribute values ​​and verify the corresponding malicious classification of the electronic device detected within the communication network, determined according to the active malicious classification strategy.

16. The computer system of claim 13, wherein analyzing the malicious classification information comprises: A threat rating is assigned to a particular electronic device, the threat rating being separate from the corresponding malicious classification for the particular electronic device and determined based at least in part on the corresponding attribute value for the particular electronic device.

17. The computer system of claim 13, wherein analyzing the malicious classification information using the statistical machine learning algorithm comprises: analyzing the corresponding attribute values ​​for the electronic device using a data correlation algorithm; as well as The corresponding attribute value for the electronic device is analyzed using a data prediction algorithm.

18. A computer system according to claim 13, wherein the programming also includes instructions for automatically deploying the recommended malicious classification strategy on an electronic device so that the electronic device automatically merges the recommended malicious classification strategy into an active malicious classification strategy in the active malicious classification strategy.

19. A computer system according to claim 13, wherein the programming also includes instructions for transmitting the recommended malicious classification policy to a network administrator for evaluation before deploying the recommended malicious classification policy for merging the recommended malicious classification policy into an active malicious classification policy in the active malicious classification policy.

20. One or more non-transitory computer-readable storage media storing programming for execution by one or more processors, the programming comprising instructions for: Obtain malicious classification information of electronic devices detected in a communication network at multiple times, wherein the malicious classification information at each of the multiple times includes: Timestamp information, identifying the time among the multiple times; a corresponding set of attribute values ​​of the electronic device detected within the communication network at the time; as well as a corresponding malicious classification of the electronic device detected within the communication network at the time, determined according to an active malicious classification strategy and the corresponding attribute value set; Analyzing the malicious classification information for the multiple times to determine whether to modify the active malicious classification strategy, wherein analyzing the malicious classification information for the multiple times comprises: analyzing the corresponding malicious classifications and the corresponding attribute value sets of the electronic devices for the multiple times using a statistical machine learning algorithm; as well as A recommended malicious classification strategy is generated in response to determining to modify the proactive malicious classification strategy.

Images