ANALYSIS AND RECOMMENDATION OF GUIDELINES FOR THE CLASSIFICATION OF VILLAINS FOR A COMMUNICATION NETWORK

Abstract

In certain embodiments, a process performed by a processing device includes obtaining rogue classification information for electronic devices detected in a communications network at multiple time points. The rogue classification information for each time point includes: timestamp information identifying the time; corresponding sets of attribute values ​​for the electronic devices detected within the communications network at that time; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices.The procedure involves analyzing rogue classification information at multiple time points to determine whether the active rogue classification policies need to be modified. This is achieved by using a statistical machine learning algorithm to analyze the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices at those multiple time points. The procedure also includes generating a recommended rogue classification policy in response to the determination to modify the active rogue classification policies.

Description

BACKGROUND

[0001] A communications network comprises various electronic devices that can communicate with each other via one or more communication interfaces. A wireless local area network (WLAN), for example, is a wireless computer network that connects two or more electronic devices using a wireless distribution technology (e.g., radio or infrared signals). A WLAN is typically deployed in a limited area such as a home, college, school, or office complex. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] For a better understanding of the present disclosure and its advantages, reference is now made to the following descriptions taken in conjunction with the accompanying drawings in which: Fig.illustrates an example computing environment for analyzing and recommending policies for classifying rogues in a communications network, according to certain embodiments; Fig. illustrates additional details of a network management system (NMS) and a rogue policy analysis module for analyzing and recommending rogue classification policies in a communications network, according to certain embodiments; Fig. illustrates additional details of an example computer system including an NMS and a rogue policy analysis engine for analyzing and recommending rogue classification policies in a communications network, according to certain embodiments; Fig. illustrates an example method for analyzing and recommending rogue classification policies for a communications network, according to certain embodiments; Fig. illustrates an example method for analyzing rogue classification policies for a communications network, according to certain embodiments; Fig. shows an example of a method for analyzing and recommending rogue classification policies for a communications network, according to certain embodiments; and Fig. shows a block diagram of an example computer according to certain embodiments DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

[0003] A communications network, which may be entirely or partially wireless, may include numerous electronic devices such as client devices, access points (APs), controllers, and switches. For example, a WLAN communications network may include numerous electronic devices such as one or more client devices, one or more wireless access points (WAPs), one or more WLAN controllers, and one or more network switches.

[0004] A WLAN or other communications network can be monitored by one or more Network Management Systems (NMS), which can be coupled with WLAN switches and / or WLAN controllers. The one or more NMSs can be used to maintain and secure a network. For example, an NMS can manage electronic devices connected to the communications network. Among other operations, whether for network security or other purposes, the NMS can discover and monitor electronic devices connected to the communications network or otherwise discoverable by other electronic devices in the communications network. The information (e.g., attribute information) related to different electronic devices can be aggregated at different points within the communications network and reported to the NMS.

[0005] In communications networks, a rogue device is a device that connects to a computer network—possibly for an extended period of time—but does not have permission to access and operate within the network. In a wireless communications network, rogue wireless devices can be access points, Dynamic Host Configuration Protocol (DHCP) servers, end-user devices (e.g., rogue peers), or other electronic devices.

[0006] Rogue APs can include WAPs installed on a network without authorization. These WAPs (e.g., routers) can be installed by an employee for work purposes, by a hacker to collect private data, or by other means. In most cases, the use of such devices conflicts with the network's security policies, and rogue WAPs are not managed by the network administrator responsible for managing the communications network. Rogue WAPs can allow other unauthorized end-user devices to connect to the network and consume network bandwidth or perform other unwanted or nefarious operations.

[0007] Another example of a rogue WAP is a so-called "evil twin." In this example, a wireless device located outside an organization can receive beacons sent by legitimate WAPs within the organization. The malicious twin can then begin sending identical beacons, possibly with the intention of getting end users within the organization to connect to the malicious twin instead of a legitimate WAP, or in addition to a legitimate WAP. Once an end user connects to the malicious twin, the malicious twin can be used by malicious individuals to gain access to the organization's network.

[0008] Malicious threats from client devices (rogue peers) include end-user computers or other electronic devices that connect to a network without authorization. These devices can include laptops or other computers that can serve as access points. Rogue peers can pose a greater risk than rogue access points because many client devices (e.g., laptops) have little or no security features. This can allow other unauthorized devices to connect to the device and the network.

[0009] A rogue peer, for example, can be a client device, such as an end-user laptop or desktop computer, that has both wireless and potential bridging capabilities enabled. While a WAP (e.g., a router) can provide both WAP and bridging capabilities, WAPs are typically configured with authentication protocols such as Wired Equivalent Privacy (WEP) and Wi-Fi Protected Setup (WPS) and may even implement firewalls. A client device that provides both capabilities can pose a greater threat to a network's security because, unlike most WAPs, the client device likely has virtually no security measures in place to mitigate or prevent unauthorized access. In other words, rogue peers can be likened to holes in a communications network through which malicious entities could gain access to the communications network.Client devices are not considered part of the network infrastructure, which suggests treating client devices as rogues depending on other attributes of the client devices. Since a rogue peer may be a device that is not generally intended to serve as an AP, the vulnerability a rogue peer poses to the communications network may be increased compared to a rogue AP, as rogue APs are likely to have at least built-in security features, which may have been enabled by default.

[0010] DHCP servers can be a fundamental component of a communications network, providing information for its proper configuration. Rogue DHCP servers can emerge and generally behave similarly to legitimate DHCP servers, but rogue DHCP servers are not managed by the network administrator or associated management tools. For example, a malicious DHCP server can emerge when a user knowingly or unknowingly connects a router to the communications network. Another example is a malicious DHCP server that emerges via a compromised Internet of Things (IoT) device such as a mobile phone, printer, camera, tablet, smartwatch, or via a compromised IT application or resource.While potentially problematic in numerous scenarios, malicious DHCP servers can be particularly frustrating when attempting to deploy a fleet of servers using a Preboot eXecution Environment (PXE), as PXE typically relies on DHCP. A rogue DHCP server can pose a security risk and cause outages in a communications network, as the rogue DHCP server can provide incorrect network settings and routes.

[0011] A malicious wireless device is one of the greatest security threats in wireless networks. If left connected, a malicious wireless device can pose a security threat to networks and businesses. For example, a malicious device could access and / or expose confidential system information, potentially damaging an organization.

[0012] Applying strict network security policies can reduce or eliminate the threat of unauthorized wireless devices. Access points, client devices, and other electronic devices are mapped across the network, making it easier to detect devices new to the network. Rogue wireless devices are often detectable but difficult to eliminate. Wi-Fi network administrators monitor Wi-Fi networks for rogue devices using NMSs that enforce network security policies. An NMS identifies, configures, monitors, and updates, among other things, network management devices, one or more network switches, one or more WLAN controllers, one or more access points (e.g., WAPs), and / or one or more client devices.

[0013] Network administrators may learn the behavior of intruders (e.g., rogue behavior) and configure policies to blacklist devices that are not allowed to connect to the network. This process is repeated throughout a customer's network. In addition, the classification of malicious devices is manually configured based on events delivered from a network controller (e.g., a WLAN controller) to systems upstream, such as an NMS. In addition, NMSs may use malicious device classification policies that contain rules for classifying devices as valid devices, malicious devices, suspected malicious devices, disruptive devices, or other device types (or other analogous categories). These policies often consider complex combinations of device attributes, network topology information, event information (e.g.,attack vector) or other information in determining a classification for a particular electronic device.

[0014] The complex combinations of network and device attributes that lead to a particular device being classified as a malicious wireless device (or other device category) prevent meaningful evaluation of the performance of active malicious device classification policies applied by the NMS. Therefore, network administrators must often choose from predefined, default malicious device classification policies (possibly with limited ability for a skilled network administrator to configure specific policy attributes), which can perform well or poorly in classifying detected electronic devices on a network.

[0015] Embodiments of this disclosure provide a rogue policy analysis engine that can be implemented as a rogue snapshot engine and a rogue rule auto-profiler engine to evaluate, over time, the performance of active rogue classification policies enforced by a network element, such as an NMS, and potentially provide a recommended rogue classification policy to be added to the active rogue classification policies or to update an existing rogue classification policy. The rogue classification rule analyzer can be implemented as part of an NMS or can be implemented separately and communicate with the NMS.

[0016] In certain embodiments, an NMS (or other suitable electronic device) continuously applies active policies for classifying electronic devices detected in a communications network and stores the determined classifications.

[0017] The Rogue Snapshot Engine periodically saves the active rogue classification policies, as well as rogue classification information, which includes the classifications assigned to electronic devices detected on the network according to the active rogue classification policies, the conditions for that classification (e.g., classification policy(ies) that triggered the classifications, electronic device attributes (Internet Protocol (IP) address, Media Access Control (MAC) address, Service Set Identifier (SSID), Basic Service Set Identifier (BSSID), manufacturer, device type, etc.), event details (e.g., attack vector and detection frequency), and network topology information. The Rogue Snapshot Engine can also perform initial analysis of the collected classification information, for example, to verify the assigned classifications and identify specific anomalies in the data.

[0018] A rogue rule auto-profiler engine further analyzes the rogue classification information analyzed by the rogue snapshot engine and the active rogue classification policies to evaluate the performance of the active rogue classification policies and determine whether to recommend a modified or new rogue classification policy. For example, the auto-profiler module can assign a threat rating to an electronic device based on the received classification information and analyze the classification information using various statistical machine learning algorithms (e.g., data correlation techniques and / or probabilistic techniques) to create a rogue classification score for the respective device.If the Auto-Profiler engine determines that a rogue classification policy is recommended, the Auto-Profiler engine generates a recommended rogue classification policy that can be automatically deployed or submitted to the network administrator for further evaluation / configuration.

[0019] Certain embodiments improve techniques for identifying rogue devices in a wireless network by evaluating the performance of active rogue classification policies and, where appropriate, generating recommended rogue classification policies. Because the assessment is performed continuously and uses statistical machine learning algorithms, the assessment evolves over time according to actual network events and can improve both the performance of the assessment and the performance of the rogue classification. Certain embodiments improve the technical ability of a computer system to more reliably and accurately identify rogue devices, thereby increasing the overall security of the computer network.Certain embodiments reduce or eliminate manual intervention by network administrators or others to implement and / or update policies for classifying rogue devices. The concepts described in this disclosure can be applied to any type of network environment, not just a wireless network. For example, the concepts can be applied to a wireless network, a wired network, or a network with a combination of wireless and wired devices.

[0020] Fig.shows an exemplary computing environment 100 for analyzing and recommending policies for classifying rogues in a communications network, according to certain embodiments. In one example, the computing environment 100 may include a WLAN. As just one example, the WLAN may include an IEEE 802.11 (Institute of Electrical and Electronics Engineers) WLAN. IEEE 802.11 is a set of MAC and physical layer (PHY) specifications for implementing WLAN computer communications.

[0021] In the example shown, the computing environment 100 includes WAPs 102a-102e (collectively referred to as WAPs 102), a WLAN controller 104, a network switch 106, client devices 108a-108c (collectively referred to as client devices 108), a computer system 110, and an administrator device 112. Although in Fig.While the computing environment 100 is illustrated as including a particular number of WAPs 102, WLAN controllers 104, network switches 106, client devices 108, computer systems 110, and administrator devices 112, other implementations including more or fewer of each of these network elements are contemplated within the scope of this disclosure, including the omission of certain network elements where appropriate.

[0022] WAPs 102 may each include a device, such as a wireless router, that enables wireless devices (e.g., client devices 108) to connect to the WLAN implemented by part or all of the computing environment 100. The WAPs 102 may each act as a radio transmitter for a WLAN. WAPs 102 may convert network traffic into radio signals and transmit those signals to wireless processing devices. For example, the WAPs 102 may act as a bridge to a wired local area network (LAN). In the example shown, the WAPs 102 may each be connected to a wired network via the WLAN controller 104, which in turn may be coupled with a cable to enable wireless computers (e.g., client devices 108) to access a wired network.

[0023] The WLAN controller 104 may be configured to manage traffic within the WLAN, such as control and data traffic. The WLAN controller 104 may collect control plane data and issue instructions to individual WAPs 102. The WLAN controller 104 may be configured to manage various aspects related to the WAPs 102, such as authentication, radio frequency, quality of service (QoS), location tracking, intrusion detection, facilitating user roaming between / among the WAPs 102, deployment of security profiles, access segregation, and / or other suitable aspects. The WLAN controller 104 may enable WAPs 102 to connect to a wired network via a network switch 106. The network switches 106 may be any suitable combination of Layer 2 or Layer 3 switches.

[0024] Client devices 108 may be any type of computing device capable of reading machine-executable instructions. Examples of a computing device may include a server, a desktop computer, a notebook computer, a tablet computer, a thin client, a mobile device, a personal digital assistant (PDA), a smartphone, or any other suitable type of computing device. In certain embodiments, client device 108 may include a wireless network interface (e.g., a wireless network interface card (NIC)) that enables client device 108 to perform wireless communication with another device, such as one or more wireless access points 102.

[0025] Computer system 110 may include a computer and / or a computer program that can process requests from other computers (e.g., clients) over a network. In certain embodiments, computer system 110 is implemented as a server or other suitable type of processing device. Computer system 110 may facilitate monitoring and otherwise managing the communications network (e.g., the Wi-Fi network) implemented by computing environment 100.

[0026] An administrator device 112 may be configured to communicate with the computer system 110 to facilitate the management of the communications network implemented by the computing environment 100. Although shown separately, the computer system 110 and the administrator device 112 may be implemented using the same computer system or using separate processing devices that communicate via one or more connections 114. A user of the administrator device 112 may, for example, be one or more people responsible for managing the communications network (e.g., Wi-Fi network) implemented by the computing environment 100, such as a network administrator or other IT professional.

[0027] The components of the computing environment 100 may communicate with each other via one or more connections 114. The connections 114 may be any combination of wired or wireless communication connections, such as any combination of an Ethernet connection, a Wi-Fi connection, a cellular connection, a satellite connection, or the like. In the example shown, the connections 114 depicted as dashed lines are to be considered wireless connections, and the connections 114 depicted as solid lines are to be considered wired connections. Although certain connections 114 are depicted as wired or wireless for the purposes of this example, within the scope of this disclosure, each of the connections 114 may be wired and / or wireless, as appropriate for a particular implementation.

[0028] The computer system 110 may include an NMS 116 and a Rogue Policy Analysis Engine 118, which are described in more detail below.

[0029] NMS 116 may be any suitable system, e.g., a cloud-based system, including one or more computing devices configured to manage networks and electronic devices such as network switches, routers, access points, gateways, client devices, and the like. For example, NMS 116 may be configured to manage WAPs 102, controllers 104, network switch 106, and client devices 108. NMS 116 may be connected to such electronic devices over a wide area network (WAN) (e.g., the Internet) via wired or wireless connections, such as may be implemented by one or more connections 114.

[0030] The NMS 116 may be configured to manage the communications network of an entity, e.g., an organization, business, company, department, etc. In certain embodiments, the entity is a customer of NMS 116 because it uses NMS 116 to manage its communications network, and accordingly may have a customer account with NMS 116 associated with the entity. An entity may register its electronic devices with NMS 116 so that NMS 116 can identify the electronic devices and / or the entity to which an electronic device belongs. By identifying the entity to which an electronic device belongs, the NMS 116 can manage the electronic device according to the rules associated with the entity.

[0031] NMS 116 may apply network management policies to manage the communications network and the devices discovered within the communications network. For various reasons, including the security of the communications network implemented by computing environment 100, NMS 116 may attempt to identify, classify, and track devices connected to or otherwise discovered within the communications network implemented by computing environment 100. For example, over time, devices (e.g., network switches 106, controllers 104, client devices 108, or other devices) may connect to and disconnect from the communications network implemented by computing environment 100. Some of these devices may be known to NMS 116, while others may be unknown.Therefore, the NMS 116 can detect, identify, categorize and monitor over time devices that connect to the network or can otherwise be detected on the network.

[0032] For this purpose, the network management policies applied by the NMS 116 may include rogue classification policies. The NMS 116 may apply these rogue classification policies to classify the devices detected in the computing environment 100. The rogue classification policies may define a set of rules used to determine an appropriate category for a detected device.

[0033] To determine an appropriate category for a device, these rogue classification guidelines may consider one or more attributes. These attributes may include one or more device attributes (e.g., physical device attributes and / or virtual device attributes), activity attributes (e.g., related to the behavior of the detected devices), network topology information, timestamp information, and / or other appropriate information. As specific examples, the one or more device attributes may include an IP address of the device, a MAC address of the device, an SSID of the device, a BSSID of the device, a manufacturer of the device, a device type, or any other appropriate attribute. The activity attributes may include a time, an entry point, or the like. The entry point may, for example, be the device of the computing environment 100 to which the detected device connects or attempts to connect.If the detected device is malicious, the entry point can be referred to as an attack vector.

[0034] The specific classifications applied by a particular NMS 116 may vary, and this disclosure contemplates the use of appropriate rogue classifications and associated rogue classification policies to determine applicable rogue classifications for devices detected on a network, such as the communications network implemented by computing environment 100. Therefore, the individual classifications may vary among different implementations. Furthermore, the individual rogue classification policies that result in different classifications may vary among different implementations. Table 1 below provides only one example of potential rogue classifications and associated descriptions. These particular disallowed classifications and associated descriptions are provided only as examples. Table 1 Classification Description Valid Based on one or more attributes, it is determined that this device is authorized to connect to the communications network implemented by computing environment 100. For example, the device may be a WAP and belong to the same entity as the network element that detected this WAP. Valid devices are accepted as non-threatening and considered part of the same network infrastructure (e.g., WLAN) for the entity connected to the network. villain A rogue device may be an electronic device that connects to and remains connected to the communications network implemented by computing environment 100, but that does not have permission to access and / or operate within the communications network. The rogue device may or may not be detectable within the communications network. For example, a rogue device may be an electronic device within the communications network implemented by computing environment 100 that can be heard over the air (e.g., detecting wireless traffic for a particular BSSID) and detectable over a wired connection (e.g., by either correlating the MAC address of the wired connection with the wireless BSSID or by using heuristics to determine that client devices associated with that BSSID are communicating with entities over a wired connection). Rogue devices are considered a security risk. In the case of an access point (AP), rogue APs can pose a security threat because they can act as a "man-in-the-middle," snooping on traffic between wireless client devices and the wired network. A malicious AP could give an attacker access to data that they could use for nefarious purposes. Of course, any device detected within the communications network implemented by the computing environment 100 (not just APs) can be considered a rogue device. Suspicious Villain / Suspicious Villain These types of electronic devices are considered a potential security threat. Due to characteristics associated with the electronic device, the device (e.g., a client device, a WAP, etc.) may be considered suspicious. For example, the signal strength may be very high, indicating that the device may be located inside a building, or unusual traffic may have been detected to or from the device. Another example is that the wired MAC address may not have been correlated with a wireless BSSID, leading to uncertainty about whether the device is a rogue device. troublemaker These types of electronic devices are not yet considered a security threat. Interfering devices may be associated with a BSSID, and the BSSID may be just another BSSID that can be heard over the air, but over which the network administrator (or associated management tools) has no control. Rogue detection algorithms may still be applied to this device to reduce or eliminate the likelihood of the device becoming a security threat. neighbor These types of electronic devices are not considered a security threat. For example, a device (e.g., a WAP) may have a known BSSID that is considered harmless. An example would be a WAP for the Wi-Fi in a nearby coffee shop. The BSSID is always present and is known to pose no threat to the communications network. In certain embodiments, a "neighbor" classification is determined via a manual process, so that the network administrator has the authority to mark an AP or other device as a "neighbor" (e.g., as non-threatening). In certain embodiments, the identity-aware proxy (IAP) / common alert protocol (CAP) is not authorized to automatically classify a discovered AP or other device as a "neighbor." Of course, other implementations are possible.

[0035] The attributes that may be relevant to a particular rogue classification policy applied by NMS 116 may vary from device type to device type. In other words, for a particular rogue classification policy, the one or more attributes evaluated for that rogue classification policy may (or may not) vary depending on the type of device being detected / tracked and evaluated according to that rogue classification policy. Additionally or alternatively, the allowable attribute values ​​(which may be specific values, ranges, or other types of values) for the attributes of a rogue device classification policy may be defined for the rogue device classification policies and may also vary from device type to device type.

[0036] For example, a particular rogue classification policy configured for a switch (e.g., network switch 106) may not apply and / or be configured differently for a client device 108. Another example is that a particular rogue classification policy configured for wireless devices (e.g., for radio attributes) may not apply and / or be configured differently for wired devices. Another example is that a particular rogue classification policy configured for a device communicating using a particular communications standard (e.g., 802.11ax or Wi-Fi 6) may not apply and / or be configured differently for a device that does not support that particular communications standard.

[0037] Although described as being applied to the NMS 116, additionally or alternatively, one or more other devices in the computing environment 100 may apply rogue classification policies and report these determinations to the NMS 116. For example, WAPs 102, controllers 104, network switches 106, and / or client devices 108 may apply rogue detection policies, as appropriate.

[0038] Fig. shows examples of certain electronic devices classified according to the above classifications. In certain embodiments, the NMS 116 classifies electronic devices according to the above rogue classifications based on one or more active rogue classification policies and one or more attributes associated with the electronic devices and / or the communications network implemented by the computing environment 100.

[0039] For example, WAPs 102a, 102b, and 102d, controller 104, network switch 106, and client device 108a may be considered valid devices. These valid devices may, for example, be known to NMS 116 and considered approved for connection to the communications network implemented by computing environment 100.

[0040] As another example, both WAP 102c and client device 108b are classified as rogue devices, represented by the diagonal shading around the edge of these devices. In certain embodiments, client device 108b is connected to computing environment 100 via one or more WAPs 102 and / or WAPs 102d. In an example scenario, client device 108b is connected to computing environment 100 via WAP 102c, and NMS 116 classifies WAP 102c as a rogue device. Since, in this scenario, client device 108b is connected to computing environment 100 via WAP 102c (e.g., classified as a rogue device), NMS 116 may also classify client device 108b as a rogue device. Additionally or alternatively, NMS 116 may classify client device 108b as a rogue device for reasons independent of whether client device 108b is connected to computing environment 100 via WAP 102c or not.

[0041] In Fig.As a further example, interfering devices 120 are shown. In the illustrated example, interfering devices 120 include the WAP 102e and the client device 108c connected to the WAP 102e. Interfering devices 120 may be detected by NMS 116 or another suitable component of the computing environment 100 (e.g., a WAP 102, a controller 104, or a network switch 106).

[0042] Computer system 110 may also include a rogue policy analysis engine 118. In certain embodiments, rogue policy analysis engine 118 is configured to evaluate the active rogue classification policies applied by NMS 116 and potentially recommend changes to the active rogue classification policies. Rogue policy analysis engine 118 may periodically save a snapshot of the active rogue classification policies and rogue classification information and store the collected information as time-series data.

[0043] The active rogue classification policies may include the current active rogue classification policies applied by the NMS 116 to determine a classification for a detected device. The rogue classification information may include information associated with the network and / or electronic devices to which the active rogue classification policies have been applied by the NMS 116. For example, the rogue classification information may include device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identification of classifications assigned to detected devices), activity attributes (e.g.,regarding the behavior of detected devices), identification of the one or more rogue classification policies that resulted in a particular classification for a device, network topology information, timestamp information, and / or any other appropriate information.

[0044] The Rogue Policy Analysis Engine 118 may query the NMS 116 at regular or irregular intervals for the active rogue classification policies and / or the rogue classification information. Additionally or alternatively, the NMS 116 may automatically transmit the active rogue classification policies and / or the rogue classification information to the Rogue Policy Analysis Engine 118 at regular or irregular intervals.

[0045] The Rogue Policy Analysis Engine 118 may analyze the rogue classification information to determine whether to recommend changes to the active rogue classification policies. For example, the Rogue Policy Analysis Engine 118 may use one or more machine learning algorithms to evaluate the active rogue classification policies. Because the collected information has been collected over time and stored as time-series data, algorithms that facilitate trend analysis, anomaly analysis, and other types of time-based analysis may be used to evaluate the active rogue classification policies.

[0046] Based on the analysis of the active rogue classification policies, the Rogue Policy Analysis Engine 118 may determine whether to create one or more rogue classification policy recommendations. For example, based on the analysis, the Rogue Policy Analysis Engine 118 may determine that one or more active rogue classification policies are not functioning optimally, that certain detected devices are being misclassified, or that other deficiencies exist (or are predicted) in the use of active rogue classification policies to classify devices detected in the communications network implemented by the computing environment 100.

[0047] If the Rogue Policy Analysis Engine 118 determines, based on the analysis, that one or more recommendations should be made, the Rogue Policy Analysis Engine 118 may create one or more recommended rogue classification policies. A recommended rogue classification policy may include, for example, a new rogue classification policy or an update to an active rogue classification policy. In certain embodiments, one or more of the recommended rogue classification policies is a rogue classification policy template that includes one or more fields for configuration, for example, by a network administrator (e.g., a user of the administrator device 112).

[0048] In certain embodiments, the Rogue Policy Analysis Engine 118, possibly in cooperation with the NMS 116, automatically deploys one or more of the recommended rogue classification policies so that these recommended rogue classification policies are automatically made part of the active rogue classification policies for the future evaluation of devices of the computing environment 100. For example, the Rogue Policy Analysis Engine 118 may automatically deploy one or more of the recommended rogue classification policies on one or more electronic devices to cause the electronic devices to automatically adopt the recommended rogue classification policies as active rogue classification policies.The electronic devices on which the recommended rogue classification guidelines are deployed may be one or more of the following: NMS 116, WAPs 102, Controller 104, Network Switch 106, or any other suitable electronic device.

[0049] In certain embodiments, the Rogue Policy Analysis Engine 118, possibly in cooperation with the NMS 116, transmits one or more of the recommended rogue classification policies for review by an appropriate individual, such as a network administrator (e.g., a user of the administrator device 112). For example, the Rogue Policy Analysis Engine 118 may transmit the recommended rogue classification policy to the NMS 116 and / or an associated administrator device 112 (e.g., a network manager) for evaluation prior to deploying the recommended rogue classification policy to incorporate the recommended rogue classification policy as the active rogue classification policy.

[0050] The Rogue Policy Analysis Engine 118 may repeat this process of evaluating the rogue classification policies applied by the NMS 116 and may recommend changes to those rogue classification policies over time to continuously improve the accuracy of the active rogue classification policies applied by the NMS 116. Furthermore, embodiments of this disclosure apply complex machine learning algorithms that benefit from time-series data and analytics performed over time to analyze the rogue classification policies and make associated recommendations, thereby reducing or eliminating the dependence on individuals (e.g., a network administrator) to evaluate and adjust active rogue classification policies.

[0051] The NMS 116 and the rogue policy analysis engine 118 may be implemented using any suitable combination of hardware, firmware, and software. For example, the NMS 116 and the rogue policy analysis engine 118 may include any combination of hardware and programming to implement the described operations. The programming may be processor-executable instructions stored on at least one non-transitory, machine-readable storage medium, and the hardware may include at least one processing resource to execute those instructions. In some examples, the hardware may also include other electronic circuitry to at least partially implement the NMS 116 and the rogue policy analysis engine 118.In some examples, the at least one machine-readable storage medium may store instructions that, when executed by one or more processors, at least partially implement NMS 116 and Rogue Policy Analysis Engine 118. In such examples, computer system 110 may include one or more computer-readable storage media storing the instructions and one or more processors for executing the instructions.

[0052] Although shown separately, the NMS 116 and the rogue policy analysis engine 118 may be separate or combined. As one example, the rogue policy analysis engine 118 could be a part of the NMS 116. Although shown implemented with the computer system 110, the NMS 116 and the rogue policy analysis engine 118 may be implemented on the same or different computer systems. Furthermore, this disclosure contemplates a computer environment 100 (or other computer environment) including any number of NMS 116 and / or rogue policy analysis engines 118 implemented on any number of computer systems. For example, a computer environment could include multiple NMS 116 implemented on different computer systems, each connected to a corresponding rogue policy analysis engine 118, or all sharing a rogue policy analysis engine 118.

[0053] Fig. illustrates additional details of the NMS 116 and the Rogue Policy Analysis Engine 118 for analyzing and recommending rogue classification policies in a communications network, according to certain embodiments. Although depicted as separate blocks, the NMS 116 and the Rogue Policy Analysis Engine 118 may be separate or combined. For example, the Rogue Policy Analysis Engine 118 may be implemented as part of the NMS 116, or it may be implemented separately and communicate with the NMS 116.

[0054] The NMS 116 may be coupled or otherwise connected to the storage device 200a, which may store information used or generated by the NMS 116. In certain embodiments, the storage device 200a may be considered part of the NMS 116. The storage device 200a may store active rogue detection policies (202), rogue classification information (204), and recommended rogue classification policies (206), which are described in more detail below.

[0055] As described above, the NMS 116 may detect devices within the communications network implemented by the computing environment 100 and analyze detected devices at regular or irregular intervals according to one or more active rogue classification policies. These active rogue classification policies may be stored in the storage device 200a as active rogue classification policies 202. Active rogue classification policies 202 may include a set of rules for classifying devices detected in the communications network into one or more different rogue classifications. The rogue classifications define different levels of threat posed by an electronic device detected in the communications network implemented by the computing environment 100.For example, active rogue classification policies 202 may contain a set of rules that the NMS 116 evaluates when determining the rogue classification to assign to a detected device. An example of this is the rogue classifications described above with reference to Table 1.

[0056] Active rogue classification policies 202 may initially be installed and configured by an appropriate user (e.g., a network administrator via administrator device 112) with configurations deemed appropriate for managing the communications network of computing environment 100. Over time, active rogue classification policies 202 may be modified, e.g., by reconfiguring certain active rogue classification policies 202, adding new rogue classification policies to active rogue classification policies 202, and / or deleting certain active rogue classification policies 202. These changes to active rogue classification policies 202 may be due, at least in part, to the operation of Rogue Policy Analysis Engine 118.

[0057] Rogue classification information 204 may include various information associated with the communications network implemented by computing environment 100 and with electronic devices connected to the communications network or otherwise detected in connection with the communications network. In certain embodiments, rogue classification information 204 may include one or more device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identification of classifications assigned to detected devices), activity attributes (e.g., related to the behavior of detected devices), identification of which one or more rogue classification policies result in a particular classification for a device, network topology information, timestamp information, and / or other suitable information.Although the rogue classification information 204 is described as including certain attributes or other information, the rogue classification information 204 may include any suitable attributes or other information.

[0058] Device attributes may include physical device attributes and / or virtual device attributes of devices connected to or otherwise discovered in connection with the communications network implemented by computing environment 100. For example, for each discovered device, the physical device attributes may include one or more of the device's IP addresses, a device's MAC address, a device's SSID, a device's BSSID, a device's manufacturer, the device type, the communication protocol used by the device, the device's RF configurations, the role-based access control (RBAC) for the device (if applicable), the device's operating system, or any other suitable attribute.As another example, the virtual device attributes for each discovered device may include one or more of the following attributes: virtual local area network (VLAN) tagging for the device, port mapping for the device, virtual network topology for the device, security attributes (e.g., certificate(s), ciphers, etc.), or any other suitable attribute.

[0059] The activity attributes may include a time, an entry point, the number of detected network devices, the number of detected clients on the communications network (e.g., LAN), the encryption key, the encryption authentication, the network type (e.g., WLAN), the signal strength, the channel, or the like. The entry point may, for example, be the device of the computing environment 100 to which the detected device connects or attempts to connect (e.g., detected via WLAN). If the detected device is a rogue device or a suspected rogue device, the entry point may be referred to as an attack vector. The number of detected network devices may include the number of electronic devices that have detected the detected device in question. In the case of a client device 108, the number of detected network devices may, for example, include the number of WAPs 102 that have detected the client device 108.

[0060] The network topology information may include information about the communications network implemented as part of the computing environment 100. For example, the network topology information may include information for each detected device and, where applicable, the identification of one or more neighboring devices. Collecting this information for devices detected within the network of the computing environment 100 may create a communications network topology for the NMS 116.

[0061] The timestamp information may include an identification of a time or period at which the rogue classification information 204 is obtained.

[0062] Although active rogue classification policies (202) and rogue classification information (204) are illustrated and described, this disclosure contemplates that NMS 116 may also store historical rogue classification policies and historical rogue classification information, as appropriate. For example, NMS 116 may store not only the most recent active rogue classification policies 202 and rogue classification information 204, but also historical active rogue classification policies and rogue classification information.

[0063] Recommended rogue classification policies 206, described further below with reference to the rogue rules auto-profiler engine 210, may include recommendations received from the rogue policy analysis engine 118 to update or otherwise modify active rogue classification policies 202.

[0064] In certain embodiments, the rogue policy analysis engine 118 includes a rogue snapshot engine 208 and a rogue rule auto-profiler engine 210 to implement some or all of the operations of the rogue policy analysis engine 118. Although depicted separately, it is envisioned that the rogue snapshot engine 208 and the rogue rule auto-profiler engine 210 may be separate or combined. As an example, the rogue snapshot engine 208 and the rogue rule auto-profiler engine 210 may be implemented on the same or different computer systems.

[0065] Generally, the rogue snapshot engine 208 periodically receives active rogue classification policies 202 and rogue classification information 204 and stores this information in the storage device 200b as time series data. In certain embodiments, the rogue snapshot engine 208 performs an initial analysis of the information collected by the rogue snapshot engine 208.

[0066] The rogue snapshot engine 208 may be coupled or otherwise connected to the storage device 200b, which may store information used or generated by the rogue snapshot engine 208. The storage device 200b may store active rogue detection policies (202), rogue classification information (204), and pre-analyzed rogue classification information (212), which are described in more detail below.

[0067] The rogue snapshot engine 208 may periodically obtain and store a snapshot of certain rogue information from the NMS 116, which may be provided to the rogue snapshot engine 208 as rogue information 214. The rogue snapshot engine 208 may periodically query the NMS 116 for rogue information 214. For example, the rogue snapshot engine 208 may periodically query the NMS 116 (and / or other suitable electronic devices) for attributes defined by a configuration schema of the rogue snapshot engine 208. This configuration schema may identify the attributes for which the rogue snapshot engine 208 may attempt to obtain attribute values.In part, the configuration schema may identify some or all of the attributes or other information included in the rogue classification information 204, and the rogue information 214 may include current values ​​for those attributes or other information. Additionally or alternatively, the NMS 116 may be configured to voluntarily provide rogue information 214 to the rogue snapshot engine 208 at regular intervals.

[0068] The malicious information 214 may include active malicious classification policies 202 and malicious classification information 204. For example, the rogue information 214 may include some or all of the active rogue classification policies 202 and some or all of the rogue classification information 204. The rogue snapshot engine 208 may store the active rogue classification policies 202 and the rogue classification information 204 such that the information is timestamped. For example, the rogue snapshot engine 208 may store the active rogue classification policies 202 and the rogue classification information 204 as time-series data in the storage device 200b. This disclosure contemplates the rogue snapshot engine 208 storing active rogue classification policies 202 and rogue classification information 204 in any suitable format.

[0069] In certain embodiments, obtaining rogue classification information 204 over time (e.g., as time-series data) may provide the rogue snapshot engine 208 (and later the rogue rule auto-profiler engine 210) with a better understanding of the behavior of the detected electronic devices. For example, while the values ​​for the attributes of a detected electronic device may provide an overview of the electronic device at a specific point in time, the values ​​for the attributes over time may provide insight into how the electronic devices behave, e.g., how these electronic devices move through the communications network or change in a way that might be unexpected and / or indicate a potential threat.

[0070] As described above, active rogue classification policies 202 may include a set of rules that NMS 116 evaluates in determining the rogue classification to be assigned to a detected device. Furthermore, as described above, rogue classification information 204 may include various information associated with the communications network implemented by computing environment 100 and with electronic devices connected to or otherwise detected in connection with the communications network. In certain embodiments, rogue classification information 204 may include one or more of the following: device attributes, device classification information (e.g., identifying the classifications assigned to the detected devices), activity attributes (e.g.,regarding the behavior of the detected devices), identification of the one or more rogue classification policies that result in a particular classification for a device, network topology information, timestamp information, and / or other appropriate information.

[0071] Thus, the snapshot engine 208 may periodically store the respective current rogue classifications of devices detected by the NMS 116 in the computing environment 100, along with the active rogue classification policies 202 used to analyze and determine a rogue classification for those detected devices. Since the active rogue classification policies 202 applied by the NMS 116 may change over time, the rogue snapshot engine 208 may periodically retrieve new active rogue classification policies 202, possibly each time the rogue snapshot engine 208 receives new rogue classification information 204 and / or each time active rogue classification policies 202 are updated at the NMS 116.Retrieving current active rogue classification policies 202 can help ensure that the analysis performed by the rogue snapshot engine 208 (e.g., the pre-analysis described below) and the analysis performed by the rogue rule autoprofiler engine 210 evaluates the most current version of the active rogue classification policies 202 that were used to determine rogue classifications that are part of the analyzed rogue classification information 204.

[0072] In certain embodiments, the rogue snapshot engine 208 may perform a pre-analysis of the rogue classification information 204 to attempt to identify anomalies in the attribute values ​​and validate the rogue classifications determined by the NMS 116 according to the active rogue classification policies 202 for the electronic devices detected in the communication network of the computing environment 100. For example, before transmitting rogue information 216 to the rogue rule auto-profiler engine 210, the rogue snapshot engine 208 may pre-analyze active rogue classification policies 202 and / or rogue classification information 204 to generate pre-analyzed rogue classification information 212. The Rogue Snapshot Engine 208 may perform this pre-analysis in response to receiving rogue information 214 and / or at any other suitable interval.

[0073] In certain embodiments, the pre-analysis performed by the rogue snapshot engine 208 includes attempting to identify anomalies in the rogue classification information 204. For example, the pre-analysis performed by the rogue snapshot engine 208 includes attempting to identify anomalies in the attribute values ​​of the rogue classification information 204 and validating the respective rogue classifications determined by the NMS 116 according to the active rogue classification policies 202 for the devices detected in the communication network of the computing environment 100.

[0074] In certain embodiments, the rogue snapshot engine 208 uses one or more statistical anomaly algorithms, such as the Z-score algorithm, the K-nearest neighbor algorithm, support vector machines, or density-based clustering techniques, to perform the pre-analysis. These or other algorithms may be used in any suitable combination.

[0075] The Z-score algorithm generally refers to a statistical technique that measures how far a particular data point (e.g., a value for an attribute) is from the rest of a dataset. For example, the Z-score can measure how many standard deviations a particular data point deviates from the dataset mean.

[0076] The k-nearest neighbors algorithm is a machine learning classification algorithm that helps categorize something based on its similarities to other nearby data points. In other words, the k-nearest neighbors algorithm uses the proximity of a data point to other data points to classify it. The k-nearest neighbors algorithm can also be used for regression analysis.

[0077] Support vector machines are supervised learning models with associated learning algorithms that analyze data for classification and / or prediction. Like the k-nearest neighbors algorithm, support vector machines can also be used for regression analysis.

[0078] Density-based clustering techniques are unsupervised machine learning techniques that identify salient clusters in a dataset based on the notion that related data points are dense and separated from other related data points in other clusters by sparse data regions.

[0079] Using one or more of these or other statistical anomaly algorithms, the Rogue Snapshot Engine 208 may identify deviations in the Rogue Classification Information 204 (e.g., in the values ​​for attributes or other information of the Rogue Classification Information 204) over time for their values ​​and offer multiple predicted values ​​for a particular attribute from the range of acceptable values.

[0080] Considering a particular attribute "A" over time, the rogue snapshot engine 208 may have stored time series data of attribute values ​​for attribute A corresponding to a particular electronic device. The rogue snapshot engine 208 may apply one or more statistical machine learning algorithms to a time window (which may be all or less than all of the time series data of attribute values ​​for attribute A corresponding to the particular device) of attribute values ​​for the attribute corresponding to the particular device. This analysis of multiple attribute values ​​over time for attribute A corresponding to the particular device may provide one or more predicted values ​​for attribute A and may help detect anomalies and / or identify multiple predicted values ​​for attribute A.The multiple prediction for attribute A may match or differ from the actual attribute values ​​for attribute A for the particular device as stored in the time series data of storage device 200b.

[0081] These multiple prediction values ​​(or other values ​​generated according to the statistical machine learning algorithms used by the rogue snapshot engine 208 to analyze the rogue classification information 204) may be stored by the rogue snapshot engine 208 as part of the pre-analyzed rogue classification information 212. That is, in certain embodiments, the rogue snapshot engine 208 may store the actual values ​​(e.g., as included in the rogue classification information 204) and the results of the statistical anomaly algorithms (e.g., multiple prediction values) in an array or other suitable storage format that may provide a set of example outputs for device attributes. This information may form pre-analyzed rogue classification information 212.

[0082] Furthermore, based on the results of analyzing the rogue classification information 204 for an electronic device, the rogue snapshot engine 208 may determine a threat score for the electronic device. The threat scores may be considered respective risk-based scores for the detected devices. The respective threat scores may reflect a relative ranking of the electronic devices according to the potential threat posed by the electronic devices. The respective threat scores may be separate from the respective classifications of the electronic devices as malicious. In certain embodiments, the rogue snapshot engine 208 may determine multiple threat scores for a given electronic device, which may be the same or different from one another, using various statistical machine learning algorithms.These one or more threat ratings may be included in the pre-analyzed rogue classification information 212.

[0083] This process of pre-analyzing information to classify rogues 204 and creating one or more predictors and / or one or more threat scores can be repeated for each electronic device.

[0084] As a particular use case, a statistical anomaly analysis of current (and historical) rogue classification information 204 may show that the certificate attribute for a particular device (e.g., for a particular client device 108) has changed frequently over a particular period of time. Based on this analysis, the rogue snapshot engine 208 may flag the threat score for that particular device as the highest threat score, even if that threat score suggests a different rogue score than the rogue score assigned to the particular device by the NMS 116 (as indicated in the rogue score information 204). This threat score assigned by the rogue snapshot engine 208 may also be stored as part of the pre-analyzed rogue classification information 212. Other particular examples include frequently changing values ​​for certain attributes (e.g.,Topology / positioning related to the device, SSID, etc.) of a particular device (or group of devices) that may lead to an increased predicted threat level determined by the Rogue Snapshot Engine 208 according to the applied statistical anomaly algorithms.

[0085] The Rogue Snapshot Engine 208 may store pre-analyzed rogue classification information 212 as time series data or in another suitable format.

[0086] In certain embodiments, the rogue snapshot engine 208 is configured to transmit rogue information 216 to the rogue rule autoprofiler engine 210 for further analysis. The rogue information 216 may include active rogue classification policies 202 and / or rogue classification information 204. In embodiments where the rogue snapshot engine 208 pre-analyzes the rogue classification information 204, the rogue information 216 may include pre-analyzed rogue classification information 212. In certain embodiments, the rogue snapshot engine 208 provides the pre-analyzed rogue classification information 212 to the rogue rule auto-profiling engine 210 in a specific template that is understandable to the rogue rule auto-profiling engine 210 after computation, and in an understandable schema (e.g.,a time series database) that can only be consumed by the rogue rule auto-profiling engine 210.

[0087] With respect to the rogue rules auto-profiler engine 210, the rogue rules auto-profiler engine 210 is generally configured to periodically perform additional analysis of the rogue classification information 204 and / or the previously analyzed rogue classification information 212 with respect to the active rogue classification policies 202 and, depending on the outcome of a particular instance of that analysis, may recommend one or more changes to the active rogue classification policies 202.

[0088] The rogue rule auto-profiler engine 210 may be coupled or otherwise connected to the storage device 200c, which may store information used or generated by the rogue rule auto-profiler engine 210. The storage device 200c may store active rogue detection policies 202, rogue classification information 204, pre-analyzed rogue classification information 212, machine learning algorithms 218, rogue classifications 220, and recommended rogue classification policies, each of which is described in more detail below.

[0089] The rogue rule auto-profiler engine 210 may periodically obtain rogue information 216 from the rogue snapshot engine 208. The rogue rule auto-profiler engine 210 may periodically query the rogue snapshot engine 208 for rogue information 216. Additionally or alternatively, the rogue snapshot engine 208 may be configured to periodically provide rogue information 216 to the rogue rule auto-profiler engine 210. In certain embodiments, the rogue rule auto-profiler engine 210 may obtain active rogue classification policies 202 from the NMS 116.

[0090] Rogue information 216 may include active rogue classification policies 202, rogue classification information 204, and / or pre-analyzed rogue classification information 212. For example, rogue information 216 may include some or all of active rogue classification policies 202, some or all of rogue classification information 204, and some or all of pre-analyzed rogue classification information 212. In certain embodiments, rogue classification information 204 and pre-analyzed rogue classification information 212 may be combined as appropriate.

[0091] The rogue rule auto-profiler engine 210 may store rogue information 216 on the storage device 200c such that the information is timestamped. As just one example, the rogue rule auto-profiler engine 210 may store active rogue classification policies 202, rogue classification information 204, and / or pre-analyzed rogue classification information 212 as time series data in the storage device 200c. This disclosure contemplates the auto-profiler engine 210 storing active rogue classification policies 202, rogue classification information 204, and / or pre-analyzed rogue classification information 212 in any suitable format.

[0092] The rogue rules auto-profiler engine 210 is configured to periodically analyze rogue classification information (204) and / or pre-analyzed rogue classification information (212) with respect to active rogue classification policies (202) and, depending on the outcome of any instance of that analysis, may recommend one or more changes to active rogue classification policies (202).

[0093] In certain embodiments, the rogue rule auto-profiler engine 210 is configured to analyze the rogue classification information 204 and / or the pre-analyzed rogue classification information 212 using one or more statistical machine learning algorithms 218, examples of which are described below. The rogue rule auto-profiler engine 210 may use a variety of machine learning or other artificial intelligence algorithms to analyze active rogue classification policies 202 and rogue classification information 204 (and / or pre-analyzed rogue classification information 212, as appropriate). The one or more statistical machine learning algorithms 218 may be used in combination to analyze the rogue classification information 204 and / or the pre-analyzed rogue classification information 212.

[0094] For example, the rogue rule auto-profiler engine 210 may analyze the rogue classification information 204 and / or the previously analyzed rogue classification information 212 using a data correlation methodology, e.g., by applying a data correlation algorithm to the corresponding attribute values ​​for the electronic devices.

[0095] As another example, the rogue rule auto-profiler engine 210 may analyze the rogue classification information 204 and / or the previously analyzed rogue classification information 212 using a data likelihood method, such as applying a data likelihood algorithm to the corresponding attribute values ​​for the electronic devices.

[0096] In certain embodiments, the one or more statistical machine learning algorithms include one or more of Z-score algorithms, K-nearest neighbors algorithms, support vector machines, and density-based clustering techniques. These or other algorithms may be used in any suitable combination.

[0097] In certain embodiments, analyzing the rogue classification information (204) and / or the pre-analyzed rogue classification information (212) includes assigning a respective threat rating to the electronic devices. The respective threat ratings may be considered risk-based scores for the detected devices. The respective threat ratings may reflect a relative ranking of the electronic devices according to the potential threat posed by the electronic devices. The respective threat ratings may be separate from the respective classifications of the electronic devices as malicious. In certain embodiments, the respective threat ratings are determined based on at least a portion of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212.For example, the threat score for a particular electronic device may be determined based on at least a portion of the corresponding attribute values ​​for the electronic device. As another example, if the Rogue Snapshot Engine 208 generates pre-analyzed rogue classification information 212, and that rogue classification information includes one or more threat scores determined for one or more attributes for a particular electronic device (or group of electronic devices), the threat score determined by the Rogue Rule Auto-Profiler Engine 210 may further consider the threat score(s) determined by the Rogue Snapshot Engine 208.

[0098] The threat rating can be based on any number of factors in any combination. As a particular example of a possible factor in determining the threat rating, an electronic device that attempts to connect to the communications network more frequently than another electronic device may be considered to pose a higher threat risk. As a particular example of another potential factor in determining the threat rating, an electronic device with an entry point (e.g., an attack vector) higher in the network may be considered to pose a greater threat than an electronic device with an entry point lower in the network.That is, in certain embodiments, the network switch 106 may be considered a greater threat than the controller 104, the controller 104 may be considered a greater threat than a WAP 102, and a WAP 102 may be considered a greater threat than a client device 108.

[0099] In certain embodiments, the auto-profiler engine 210 may use one or more data probabilistic methods for a particular device (or group of devices) to determine a threat score to assign to a particular attribute. The probabilistic method may include time-lapsed attribute values ​​for an attribute and the one or more threat scores for the attribute determined by the rogue snapshot engine 208. Based on this analysis using the data probabilistic methods, the auto-profiler engine 210 may determine a particular threat score to assign to the attribute for the particular device (or group of devices).

[0100] The rogue rule auto-profiler engine 210 may determine appropriate threat ratings for electronic devices before performing at least a portion of the analysis of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212 using one or more statistical machine learning algorithms 218, and the determined threat rating may be part of the statistical analysis. For example, one or more data correlation methods may then be applied that consider the determined threat ratings, device types, network location, neighboring devices (and / or other topology features), and any other appropriate information. For example, the auto-profiler engine 210 may then perform a threat risk analysis using a data correlation algorithm.In certain embodiments, the threat risk analysis may be based on rogue information 216, such as the type of the particular device (e.g., client device, WAP, controller, network switch, etc.), the location of the particular device within the communications network (e.g., attack vector), neighboring devices to the particular device, and / or other suitable information. This threat risk analysis may help determine an overall threat rating for the particular device.

[0101] The rogue rule auto-profiler engine 210 may repeat this process for one or more devices (or groups of devices) for which information is included in the rogue intelligence 216 to determine the respective electronic device threat ratings.

[0102] Based on the analysis of the rogue classification information (204) and / or the pre-analyzed rogue classification information (212), the rogue rules auto-profiler engine (210) may determine corresponding rogue classifications (220) for detected devices. For a given device, the rogue classification 220 for that device may or may not differ from the rogue classification determined by the NMS 116 and / or from any rogue classifications determined as part of the pre-analysis performed by the rogue snapshot engine 208. The respective rogue classifications 220 may benefit from the use of machine learning algorithms 218 and the time-lapse data of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212.

[0103] The analysis of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212 may result in an evaluation of the active rogue classification policies 202. The evaluation may include a decision about whether to deploy one or more recommended rogue classification policies 206 to update the active rogue classification policies 202. For example, based on the analysis, the rogue rule auto-profiler engine 210 may determine that one or more active rogue classification policies 202 are not performing optimally, that certain detected devices are not assigned an optimal rogue classification, or that other deficiencies exist (or are predicted) in using the active rogue classification policies 202 to classify detected devices.

[0104] In certain embodiments, the analysis of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212 may include separately performing the statistical analysis of the corresponding attribute values ​​for the attributes of the detected electronic devices and comparing the results of the analysis with active rogue classification policies 202. For example, the statistical analysis of the corresponding attribute values ​​for the attributes of the detected electronic devices may identify existing and / or predicted anomalies in the classification results generated according to an active rogue classification policy 202.The anomaly could be an anomaly in an attribute definition, an attribute value, and / or another suitable aspect of an active rogue classification policy 202 and / or rogue classification information 204 and / or pre-analyzed rogue classification information 212. If the analysis performed by the rogue rule auto-profiler engine 210 detects such anomalies, the rogue rule auto-profiler engine 210 may determine to recommend one or more recommended rogue classification policies 206. Optionally, one or more thresholds may be defined to control when a detected statistical anomaly is sufficiently significant to cause the automatic rogue rule profiling engine 210 to recommend one or more recommended rogue classification policies 206.

[0105] If the rogue rule auto-profiler engine 210 determines, based on the analysis, that one or more recommendations should be made, the rogue rule auto-profiler engine 210 may create one or more recommended rogue classification policies 206. A recommended rogue classification policy 206 may include, for example, a new rogue classification policy or an update to an active rogue classification policy 202. In certain embodiments, one or more of the recommended rogue classification policies 206 is a rogue classification policy template that includes one or more fields for configuration, for example, by a network administrator (e.g., a user of the administrator device 112).

[0106] For example, the rogue rule auto-profiler engine 210 stores (e.g., in storage device 200c) already active rogue classification policies 202, which may include a policy template and associated values ​​for one or more attributes. Optionally, a new policy template with associated suggested values ​​may be assigned and used as one of the recommended rogue classification policies 206.

[0107] In certain embodiments, the attributes that can be used for recommended rogue classification policies 206 are selectable attributes known to the rogue rule auto-profiler engine 210 (as well as the NMS 116 and the rogue snapshot engine 208) by active rogue classification policies 202. A recommended rogue classification policy 206, which is an updated and ready-to-use active rogue classification policy 202, can be enabled or disabled. If an attribute is already configured as part of the active rogue classification policies 202, the recommended rogue classification policies 206, in certain embodiments, can include a recommendation for new values ​​for that attribute for the particular active rogue classification policy 202.If an attribute is not already configured as part of the active rogue classification policies 202, the recommended rogue classification policies 206 may include a recommendation for a newly defined attribute with associated value assignment to be added to the active rogue classification policies 202. The values ​​defined by the recommended rogue classification policies 206 may be specific values ​​or ranges of values.

[0108] In certain embodiments, the rogue rule auto-profiler engine 210, possibly in cooperation with the NMS 116, automatically deploys one or more of the recommended rogue classification policies 206 such that these recommended rogue classification policies 206 automatically become part of the active rogue classification policies 202 for the future evaluation of devices of the computing environment 100. For example, the rogue rule auto-profiler engine 210 may automatically deploy one or more of the recommended rogue classification policies 206 on one or more electronic devices to cause the electronic devices to automatically adopt the recommended rogue classification policy 206 as the active rogue classification policy 202.The electronic devices on which the recommended rogue classification policy 206 is deployed may be one or more NMS 116, WAPs 102, controller 104, network switch 106, or any other suitable electronic device.

[0109] In certain embodiments, the rogue rule auto-profiler engine 210, possibly in cooperation with the NMS 116, transmits one or more of the recommended rogue classification policies 206 for review by an appropriate individual, such as a network administrator (e.g., a user of the administrator device 112). For example, the rogue rule auto-profiler engine 210 may transmit the recommended rogue classification policy 206 to the NMS 116 and / or an associated administrator device 112 (e.g., a network manager) for evaluation prior to deploying the recommended rogue classification policy 206 to adopt the recommended rogue classification policy 206 as the active rogue classification policy 202.

[0110] The rogue rule auto-profiler engine 210 may repeat this process of evaluating the active rogue classification policies 202 applied by the NMS 116 and, over time, may recommend changes to these active rogue classification policies 202 to continuously improve the accuracy of the active rogue classification policies 202 applied by the NMS 116. Furthermore, embodiments of this disclosure apply complex machine learning algorithms that benefit from historical data and analytics performed over time to analyze active rogue classification policies 202 and make associated recommendations that reduce or eliminate the dependence on individuals (e.g., a network administrator) to evaluate and adjust active rogue classification policies 202.

[0111] Although primarily described with respect to individual electronic devices (e.g., WAPs 102, controllers 104, network switches 106, and client devices 108), the NMS 116 and / or the Rogue Policy Analysis Engine 118, including the Rogue Snapshot Engine 208 and / or the Rogue Rule Auto-Profiler Engine 210, may evaluate electronic devices individually or as one or more groups of electronic devices.

[0112] The storage devices 200a, 200b, and 200c (collectively, storage devices 200) may each take the form of volatile or non-volatile storage, including, but not limited to, magnetic media, optical media, RAM, ROM, removable media, or any other suitable storage component. In certain embodiments, some or all of the storage devices 200 may include a database, such as one or more Structured Query Language (SQL) servers, time-series databases, and / or relational databases. Additionally or alternatively, in certain embodiments, some or all of the storage devices 200 may include non-relational storage. Although the storage devices 200a, 200b, and 200c are shown separately, one or more of the storage devices 200a, 200b, and 200c may be combined or further separated in any suitable manner.

[0113] Fig.1 illustrates additional details of the example computer system 110 including the NMS 116 and the rogue policy analysis engine 118 for analyzing and recommending rogue classification policies in a communications network, according to certain embodiments. Although a particular implementation of the computer system 110 is shown and described, this disclosure may contemplate any suitable implementation of the computer system 100.

[0114] Computer system 110 may be implemented with any suitable combination of hardware, firmware, and software. Computer system 110 includes a processor 300, a memory 302, and a network interface 304. Although described in the singular for simplicity, computer system 110 may include one or more processors 300, one or more memories 302, and one or more network interfaces 304.

[0115] The processor 300 may consist of one or more microprocessors, controllers, or other suitable computing devices or resources. The processor 300 may operate alone or with other components of the computing environment 100 (see Fig. ) to provide some or all of the functionality of the associated computer system 110 described herein.

[0116] The memory 302 may take the form of volatile or non-volatile memory, including, but not limited to, magnetic media, optical media, RAM, ROM, removable media, or any other suitable storage component.

[0117] The memory 302 stores NMS 116 and the Rogue Policy Analysis Engine 118. In examples where the Rogue Policy Analysis Engine 118 is implemented with the Rogue Snapshot Engine 208 and the Rogue Rule Auto-Profiler Engine 210, the memory 302 may store the Rogue Snapshot Engine 208 and the Rogue Rule Auto-Profiler Engine 210.

[0118] The memory 302 may include storage devices 200. To Fig. To avoid overloading, the contents of storage devices 200 are not shown. Although storage devices 200 are shown as part of memory 302, storage devices 200 may be part of or separate from memory 302. Furthermore, one or more of storage devices 200 may be separate and potentially remote from the one or more processing devices on which NMS 116, Rogue Snapshot Engine 208, and / or Rogue Rule Auto-Profiler Engine 210 are operating.

[0119] Interface 304 represents any suitable computing element that can receive information from a communications network, transmit information over a communications network, perform suitable processing of the information, communicate with other components (e.g., of computing environment 100), or perform any combination of the foregoing. Interface 304 is a real or virtual port or connection, including a suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, for communicating over a LAN, WAN, or other communications system that enables the exchange of information with devices of computing environment 100. Interface 304 may enable wireless and / or wired communication.

[0120] The Fig.illustrate example methods for analyzing rogue classification policies (e.g., active rogue classification policies 202) for a communications network, according to certain embodiments. Although the Fig. While the methods described may be applied to any suitable type of communications network including any suitable type of electronic devices, in certain embodiments, the communications network is a WLAN and the electronic devices include one or more of a client device (e.g., client device 108), a WAP (e.g., WAP 102), a WLAN controller (e.g., WLAN controller 104), or a network switch (e.g., network switch 106). Each of these is described below.

[0121] Fig.shows an example method 400 for analyzing and recommending rogue classification policies for a communications network, according to certain embodiments. In certain embodiments, some or all of the operations associated with method 400 are performed by computer system 110, which may also be referred to as a processing device. For example, some or all of the operations associated with method 600 may be performed by rogue policy analysis engine 118. In certain embodiments, computer system 110 includes NMS 116.

[0122] In step 402, the Rogue Policy Analysis Engine 118 obtains rogue classification information 204 for electronic devices detected within a communications network (e.g., the communications network connected to the computing environment 100) at multiple points in time. The rogue classification information 204 for each of the points in time may include timestamp information identifying the point in time; corresponding sets of attribute values ​​(e.g., as part of the rogue classification information 204) for the electronic devices detected within the communications network at that time; and respective rogue classifications (e.g., as part of the rogue classification information 204) determined according to the active rogue classification policies 202 and the corresponding sets of attribute values ​​for the electronic devices detected within the communications network at that time.

[0123] As described above, in certain embodiments, the active rogue classification policies 202 include rules for classifying electronic devices detected within the communications network (e.g., in connection with the computing environment 100) into one rogue classification from a plurality of possible rogue classifications. The plurality of possible rogue classifications define different levels of threat posed by an electronic device detected in the communications network.

[0124] In certain embodiments, the respective rogue classifications determined according to the active rogue classification policies 202 for the electronic devices detected in the communication network may be determined based on the corresponding attribute values ​​for the electronic devices detected in the communication network. The corresponding attribute values ​​may be for attributes that include device attributes and activity attributes associated with the respective electronic device.

[0125] At step 404, the rogue policy analysis engine 118 may analyze the rogue classification information 204 for the multiple times to determine whether to modify active rogue classification policies 202. Analyzing rogue classification information 204 for the multiple times may include analyzing the respective rogue classifications (e.g., rogue classification information 204) and the corresponding sets of attribute values ​​(e.g., rogue classification information 204) for the electronic devices for the multiple times using a statistical machine learning algorithm.

[0126] In certain embodiments, analyzing rogue classification information 204 using the statistical machine learning algorithm includes analyzing the corresponding attribute values ​​(e.g., of rogue classification information 204) for the electronic devices using one or more data correlation algorithms. In certain embodiments, analyzing rogue classification information 204 using the statistical machine learning algorithm includes analyzing the corresponding attribute values ​​(e.g., of rogue classification information 204) for the electronic devices using one or more data prediction algorithms.

[0127] In certain embodiments, prior to analyzing the rogue classification information 204, the rogue policy analysis engine 118 may perform a pre-analysis of the rogue classification information 204 to attempt to identify anomalies in the corresponding attribute values ​​(e.g., of the rogue classification information 204) and to validate the respective rogue classifications (e.g., of the rogue classification information 204) determined according to the active rogue classification policies 202 for the electronic devices detected in the communication network.

[0128] In certain embodiments, analyzing the rogue classification information 204 includes assigning a threat rating for a particular electronic device. The threat rating may be separate from the respective rogue classification for the particular electronic device and may be determined based on at least a portion of the corresponding attribute values ​​for the particular electronic device.

[0129] In step 406, the rogue policy analysis engine 118 determines whether to change active rogue classification policies 202 according to the analysis of the rogue classification information 204 for the plurality of times.

[0130] If the malicious policy analysis engine 118 determines in step 406 that active malicious classification policies 202 should not be changed, the method 400 may proceed to step 412.

[0131] If the Rogue Policy Analysis Engine 118 determines in step 406 that active Rogue Classification Policies 202 should be changed, the Rogue Policy Analysis Engine 118 may generate one or more recommended Rogue Classification Policies 206 in step 408 in response to the determination that active Rogue Classification Policies 202 should be changed.

[0132] In certain embodiments, a recommended rogue classification policy 206 may be a new rogue classification policy or an update to an active rogue classification policy 202. In certain embodiments, a recommended rogue classification policy 206 may be a template for a rogue classification policy that includes one or more fields for configuration, and the recommended rogue classification policy 206 may include recommended values ​​for the one or more fields. For example, the one or more fields may correspond to one or more attributes.

[0133] In step 410, the Rogue Policy Analysis Engine 118 transmits one or more recommended rogue classification policies 206 generated in step 408 for review and / or deployment. For example, a recommended rogue classification policy 206 may be transmitted to a network manager (e.g., in conjunction with the administrator device 112) for evaluation prior to deploying the recommended rogue classification policy 206 to incorporate the recommended rogue classification policy 206 as an active rogue classification policy of the active rogue classification policies 202. As another example, a recommended rogue classification policy 206 may be automatically deployed on an electronic device (e.g.,NMS 116) to cause the electronic device to automatically adopt the recommended rogue classification policy 206 as the active rogue classification policy of the active rogue classification policies 202.

[0134] The recommended rogue classification policy(ies) 206 created in step 408 may be communicated in the same or different ways. For example, some or all of the one or more recommended rogue classification policies 206 may be transmitted to a network manager (e.g., in conjunction with the administrator device 112) for evaluation prior to deploying the recommended rogue classification policy 206. As another example, some or all of the one or more recommended rogue classification policies 206 may be automatically deployed to an electronic device (e.g., NMS 116) to cause the electronic device to automatically adopt the recommended rogue classification policy 206 as the active rogue classification policy of the active rogue classification policies 202.

[0135] Fig.illustrates an example method 500 for analyzing rogue classification policies for a communications network, according to certain embodiments. In certain embodiments, some or all of the operations associated with method 500 are performed by computer system 110. For example, some or all of the operations associated with method 600 may be performed by rogue policy analysis engine 118, such as rogue snapshot engine 208. For the purposes of this example, this disclosure describes rogue snapshot engine 208 as performing the operations of method 500. As described below, method 500 may be an iterative process.

[0136] In step 502, the rogue snapshot engine 208 receives rogue information 214 from the NMS 116. In certain embodiments, the rogue snapshot engine 208 periodically requests rogue information 214 from the NMS 116, and the NMS 116 transmits the rogue information 214 to the rogue snapshot engine 208 in response to the request. Additionally or alternatively, in certain embodiments, the NMS 116 may periodically send rogue information 214 to the rogue snapshot engine 208 on its own initiative.

[0137] The rogue information 214 may include active rogue classification policies 202 and current rogue classification information 204. Although the rogue information 214 is described as including active rogue classification policies 202, in certain embodiments, active rogue classification policies 202 may be omitted from the rogue information 214.While active rogue classification policies 202 may be omitted from the rogue information 214 for any suitable reason, in certain embodiments, in addition to an initial transmission of active rogue classification policies 202, the NMS 116 transmits active rogue classification policies 202 to the rogue snapshot engine 208 when there has been a change in the active rogue classification policies 202, which may reduce the amount of data transmitted to the rogue snapshot engine 208 with at least some transmissions of rogue information 214.

[0138] In step 504, the rogue snapshot engine 208 stores the rogue information 214 as time series data. For example, the rogue snapshot engine 208 may store rogue information 214 as time series data in the storage device 200b. As a particular example, the rogue snapshot engine 208 may store current rogue classification information 204 as time series data in the storage device 200b. As described above, the rogue classification information 204 may include one or more device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identifying classifications assigned to detected devices), activity attributes (e.g.,regarding the behavior of detected devices), identification of which one or more rogue classification policies result in a particular classification for a device, network topology information, timestamp information, and / or other suitable information. Although the rogue classification information 204 is described as including specific attributes or other information, the rogue classification information 204 may include any suitable attributes or other information. In certain embodiments, the rogue snapshot engine 208 stores attribute values ​​for a particular point in time as time-series data in the storage device 202b. Over time (e.g., over multiple passes through the method 500), the rogue classification information 204 stored in the storage device 202b may form snapshots of data (e.g., attribute values) taken at particular times.

[0139] Active malicious classification policies 202 may or may not be stored as part of the time series data. For example, the rogue snapshot engine 208 may simply store a current copy of the active rogue classification policies 202. Additionally or alternatively, the rogue snapshot engine 208 may store timestamped copies of two or more unique versions of active rogue classification policies 202 determined over time.

[0140] In step 506, the rogue snapshot engine 208 performs a pre-analysis of the rogue classification information 204 to generate pre-analyzed rogue classification information 212. The rogue snapshot engine 208 may perform the pre-analysis of the rogue classification information 204 to attempt to identify anomalies in the attribute values ​​and to validate the rogue classifications determined by the NMS 116 according to the active rogue classification policies 202 for the electronic devices detected in the communication network of the computing environment 100. For example, prior to transmitting rogue information 216 to the Rogue Rule Auto-Profiler Engine 210 (at step 508, as described below), the Rogue Snapshot Engine 208 may pre-analyze active rogue classification policies 202 and rogue classification information 204 to generate pre-analyzed rogue classification information 212.The Rogue Snapshot Engine 208 may perform this pre-analysis in response to receiving rogue information 214 and / or at any other suitable interval.

[0141] In certain embodiments, the pre-analysis performed by the rogue snapshot engine 208 includes attempting to identify anomalies in the rogue classification information 204. For example, the pre-analysis performed by the rogue snapshot engine 208 includes attempting to identify anomalies in the attribute values ​​and validate the respective rogue classifications determined by the NMS 116 according to the active rogue classification policies 202 for the devices detected in the communication network of the computing environment 100.

[0142] In certain embodiments, the rogue snapshot engine 208 uses one or more statistical anomaly algorithms, such as the Z-score algorithm, the K-nearest neighbor algorithm, support vector machines, or density-based clustering techniques, to perform the pre-analysis. These or other algorithms may be used in any suitable combination.

[0143] Using one or more of these or other statistical anomaly algorithms, the rogue snapshot engine 208 may identify deviations in the rogue classification information 204 (e.g., in the values ​​for attributes or other information of the rogue classification information 204) over time for its values ​​and offer multiple predicted values ​​for a particular attribute from the range of acceptable values. In certain embodiments, the rogue snapshot engine 208 may store the actual values ​​(e.g., as contained in the rogue classification information 204) and the results of the statistical anomaly algorithms (e.g., multiple predicted values) in an array or other suitable storage format that may provide a set of sample outputs for device attributes. This information may form pre-analyzed rogue classification information 212.

[0144] Rogue Snapshot Engine 208 may store pre-analyzed rogue classification information 212 as time series data or in another suitable format. Over time (e.g., during multiple passes through method 500), the pre-analyzed rogue classification information 212 stored in storage device 202b may form snapshots of analyzed data (e.g., analyzed attribute values) performed at specific times.

[0145] In step 508, the rogue snapshot engine 208 transmits rogue information 216 to the rogue rule auto-profiler engine 210 for further analysis. The rogue information 216 may include one or more of the rogue classification information 204, pre-analyzed rogue classification information 212, or other suitable information. For example, the rogue snapshot engine 208 may transmit a current snapshot of the rogue classification information 204 to the rogue rule auto-profiler engine 210 for further analysis. Additionally or alternatively, the rogue snapshot engine 208 may transmit the most recent pre-analyzed rogue classification information 212 to the rogue rule auto-profiler engine 210 for further analysis. The Rogue Snapshot Engine 208 may have generated the most recent pre-analyzed rogue classification information 212 based at least in part on the most recent rogue classification information 204.Thus, over time (e.g., upon repeated executions of method 500), rogue snapshot engine 208 may transmit the most recent snapshot of rogue classification information 204 and / or pre-analyzed rogue classification information 212 to rogue rule auto-profiler engine 210.

[0146] In step 510, the rogue snapshot engine 208 determines whether a time interval has elapsed to determine whether to retrieve additional rogue information 214 from the NMS 116. In other words, the rogue snapshot engine 208 determines whether it is time to obtain a next snapshot of the rogue information 214 from the NMS 116. As described above, the rogue snapshot engine 208 may retrieve rogue information 214 from the NMS 116 at regular intervals. The time interval may define the frequency with which the rogue snapshot engine 208 obtains rogue information 214 (e.g., snapshots of rogue information 214) from the NMS 116. Furthermore, the time interval may be any suitable time. The time interval may be the same or may vary between different runs of the method 500.

[0147] If the malicious snapshot module 208 determines in step 510 that the time interval has not yet elapsed, the malicious snapshot module 208 may continue to wait before receiving additional malicious information 214 from the NMS 116. If the malicious snapshot module 208 determines in step 510 that the time interval has elapsed, the malicious snapshot module 208 may return to step 502 to receive additional malicious information 214 from the NMS 116.

[0148] The determination in step 510 may or may not be an explicit determination by the rogue snapshot engine 208. The rogue snapshot engine 208 may determine or otherwise be triggered to obtain additional rogue information 214 in any suitable manner. As described above, in certain embodiments, the NMS 116 may additionally or alternatively periodically send additional rogue information 214 to the rogue snapshot engine without the rogue snapshot engine 208 requesting additional rogue information 214.

[0149] Fig.shows an example method 600 for analyzing and recommending rogue classification policies for a communications network, according to certain embodiments. In certain embodiments, some or all of the operations associated with method 600 are performed by computer system 110. For example, some or all of the operations associated with method 600 may be performed by rogue policy analysis engine 118, e.g., rogue rule auto-profiler engine 210.

[0150] In step 602, the rogue rule auto-profiler engine 210 receives the rogue information 216 from the rogue snapshot engine 208. The rogue rule auto-profiler engine 210 may periodically request rogue information 216 from the rogue snapshot engine 208, and / or the rogue snapshot engine 208 may periodically transmit rogue information 216 to the rogue rule auto-profiler engine 210. In certain embodiments, the rogue rule auto-profiler engine 210 periodically requests rogue information 216 from the rogue snapshot engine 208, and the snapshot engine 208 transmits rogue information 216 to the rogue rule auto-profiler engine 210 in response to the request. Additionally or alternatively, in certain embodiments, the rogue snapshot engine 208 may periodically send rogue information 216 to the rogue rule auto-profiler engine 210.

[0151] As described above, the rogue information 216 may include one or more of the rogue classification information 204, pre-analyzed rogue classification information 212, or any other suitable information. For example, the rogue snapshot engine 208 may transmit a recent snapshot of the rogue classification information 204 to the rogue rule auto-profiler engine 210 for further analysis. Additionally or alternatively, the rogue snapshot engine 208 may transmit the most recent pre-analyzed rogue classification information 212 to the rogue rule auto-profiler engine 210 for further analysis. The rogue snapshot engine 208 may have generated the most recent pre-analyzed rogue classification information 212 based at least in part on the most recent rogue classification information 204. Thus, the rogue snapshot engine 208 can be improved over time (e.g.upon repeated executions of the method 500) transmit the most recent snapshot of the rogue classification information 204 and / or the pre-analyzed rogue classification information 212 to the rogue rule autoprofiler engine 210.

[0152] The rogue information 216 may include timestamp information identifying the time; corresponding sets of attribute values ​​(e.g., as part of the rogue classification information 204 and / or pre-analyzed rogue classification information) for the electronic devices detected at the time within the communications network; and corresponding rogue classifications (e.g., as part of the rogue classification information 204 and / or pre-analyzed rogue classification information) determined according to the active rogue classification policies 202 and the corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network. In certain embodiments, the rogue information 216 includes active rogue classification policies 202.

[0153] In step 604, the rogue rule auto-profiler engine 210 stores the rogue information 216 as time series data. For example, the rogue rule auto-profiler engine 210 may store the rogue information 216 as time series data in the storage device 200c. As a particular example, the rogue rule auto-profiler system 210 may store the current rogue classification information 204 as time series data in the storage device 200c. As described above, the rogue classification information 204 may include one or more device attributes (e.g., physical device attributes and / or virtual device attributes), device classification information (e.g., identifying classifications assigned to detected devices), activity attributes (e.g.,regarding the behavior of detected devices), identification of which one or more rogue classification policies result in a particular classification for a device, network topology information, timestamp information, and / or any other suitable information. Although the rogue classification information 204 is described as including certain attributes or other information, the rogue classification information 204 may include any suitable attributes or other information. Thus, in certain embodiments, the auto-profiler engine 210 stores attribute values ​​as time series data in the storage device 202c for a particular time. Over time (e.g., over multiple runs of the method 600), the rogue classification information 204 stored in the storage device 202c may include historical data (e.g.,attribute values) that can be used as part of the analysis of newly received rogue information 216 to evaluate active rogue classification policies 202.

[0154] Active rogue classification policies 202 may, but need not, be stored as part of the time series data. For example, the rogue rule auto-profiler system 210 may simply store a current copy of the active rogue classification policies 202. Additionally or alternatively, the auto-profiler engine 210 may store time-stamped copies of two or more unique versions of active malicious classification policies 202 obtained over time.

[0155] At step 606, the rogue rule auto-profiler engine 210 may analyze the rogue classification information 204 for the multiple times to determine whether to modify active rogue classification policies 202. Analyzing rogue classification information 204 for the multiple times may include analyzing the respective rogue classifications (e.g., rogue classification information 204) and the corresponding sets of attribute values ​​(e.g., rogue classification information 204) for the electronic devices for the multiple times using a statistical machine learning algorithm.

[0156] In certain embodiments, analyzing rogue classification information 204 using the statistical machine learning algorithm includes analyzing the corresponding attribute values ​​(e.g., of rogue classification information 204) for the electronic devices using one or more data correlation algorithms. In certain embodiments, analyzing rogue classification information 204 using the statistical machine learning algorithm includes analyzing the corresponding attribute values ​​(e.g., of rogue classification information 204) for the electronic devices using one or more data prediction algorithms.

[0157] In certain embodiments, the analysis of the differing classification information 204 includes the analysis of the previously analyzed differing classification information 212.

[0158] In certain embodiments, analyzing the rogue classification information 204 includes assigning a threat rating for a particular electronic device. The threat rating may be separate from the respective rogue classification for the particular electronic device and may be determined based on at least a portion of the corresponding attribute values ​​for the particular electronic device.

[0159] In step 608, the rogue rule auto-profiler engine 210 determines whether to modify active rogue classification policies 202 based on the analysis of the rogue classification information 204.

[0160] If the rogue rule auto-profiler engine 210 determines in step 608 that active rogue classification policies 202 should not be changed, the method 600 may proceed to step 614.

[0161] If the Rogue Policy Analysis Engine 118 determines in step 608 that active Rogue Classification Policies 202 should be changed, the Rogue Policy Analysis Engine 118 may generate one or more recommended Rogue Classification Policies 206 in step 610 in response to the determination that active Rogue Classification Policies 202 should be changed.

[0162] In certain embodiments, a recommended rogue classification policy 206 may be a new rogue classification policy or an update to an active rogue classification policy 202. In certain embodiments, a recommended rogue classification policy 206 may be a template for a rogue classification policy that includes one or more fields for configuration, and the recommended rogue classification policy 206 may include recommended values ​​for the one or more fields. For example, the one or more fields may correspond to one or more attributes.

[0163] In step 612, the Rogue Policy Analysis Engine 118 transmits one or more recommended rogue classification policies 206 generated in step 610 for review and / or deployment. For example, a recommended rogue classification policy 206 may be transmitted to a network manager (e.g., in conjunction with the administrator device 112) for evaluation prior to deploying the recommended rogue classification policy 206 to incorporate the recommended rogue classification policy 206 as an active rogue classification policy of the active rogue classification policies 202. As another example, a recommended rogue classification policy 206 may be automatically deployed on an electronic device (e.g.,NMS 116) to cause the electronic device to automatically adopt the recommended rogue classification policy 206 as the active rogue classification policy of the active rogue classification policies 202.

[0164] The recommended rogue classification policy(ies) 206 generated in step 610 may be transmitted in the same or different ways. For example, some or all of the one or more recommended rogue classification policies 206 may be transmitted to a network manager (e.g., in conjunction with the administrator device 112) for evaluation prior to deploying the recommended rogue classification policy 206. As another example, some or all of the one or more recommended rogue classification policies 206 may be automatically deployed to an electronic device (e.g., NMS 116) to cause the electronic device to automatically adopt the recommended rogue classification policy 206 as the active rogue classification policy of the active rogue classification policies 202.

[0165] Fig.shows a block diagram of an example computing device 700 according to certain embodiments. As described above, the embodiments described herein may be implemented using computing devices. For example, all or any portion of the Fig. illustrated components (e.g., NMS 116 and Rogue Policy Analysis Engine 118 (including, if applicable, Rogue Snapshot Engine 208 and Rogue Rule Auto-Profiler Engine 210) and their associated storage devices 200) may be implemented at least in part using one or more computing devices. As another example, all or any portion of the Fig. The methods illustrated may be implemented at least in part using one or more computing devices.

[0166] Computing device 700 may include one or more computer processors 702, non-persistent memory 704 (e.g., volatile memory such as RAM, cache memory, etc.), persistent storage 706 (e.g., a hard drive, an optical drive such as a CD drive or DVD drive, flash memory, etc.), a communications interface 712 (e.g., a Bluetooth interface, an infrared interface, a network interface, an optical interface, etc.), input devices 710, output devices 708, and numerous other elements and functions. Each of these components is described below.

[0167] In certain embodiments, the computer processor(s) 702 may be an integrated circuit for processing instructions. Computer processor(s) may be, for example, one or more cores or micro-cores of a processor. The processor 702 may be a general-purpose processor configured to execute program code included in the software executing on the computing device 700. The processor 702 may be a special-purpose processor in which certain instructions are integrated into the processor design. Although in Fig. While only one processor 702 is shown, the computing device 700 may include any number of processors.

[0168] Computing device 700 may also include one or more input devices 710, such as a touchscreen, a keyboard, a mouse, a microphone, a touchpad, an electronic pen, a motion sensor, or another type of input device. Input devices 710 may enable a user to interact with computer 700. In certain embodiments, computing device 700 may include one or more output devices 708, such as a screen (e.g., a liquid crystal display (LCD), a plasma display, a touchscreen, a cathode ray tube (CRT) monitor, a projector, or other display device), a printer, external storage, or another output device. One or more of the output devices may be the same as or different from the input device(s).The input and output device(s) may be connected locally or remotely to the computer processor(s) 702, the non-persistent memory 704, and the persistent memory 706. There are many different types of computing devices, and the above-mentioned input and output device(s) may take other forms. In some cases, multimodal systems may allow a user to provide multiple types of input / output to communicate with the computing device 700.

[0169] Additionally, the communications interface 712 may facilitate connection of the computing device 700 to a network (e.g., a LAN, WAN such as the Internet, a cellular network, or another type of network) and / or to another device, such as another computing device.The communication interface 712 can perform or facilitate the reception and / or transmission of wired or wireless communications using wired and / or wireless transceiver devices, including those having an audio jack / plug, a microphone jack / plug, a Universal Serial Bus (USB) port / plug, an Apple® Lightning® port / plug, an Ethernet port / plug, a fiber optic port / plug, a proprietary wired port / plug, Bluetooth® wireless signaling, BLE wireless signaling, IBEACON® wireless signaling, RFID wireless signaling, Near Field Communication (NFC) wireless signaling, Dedicated Short Range Communication (DSRC) wireless signaling, an 802.11 Wi-Fi radio signal transmission, WLAN signal transmission, Visible Light Communication (VLC), Worldwide Interoperability for Microwave Access (WiMAX), IR communication radio signal transmission, Public Switched Telephone Network (PSTN) signal transmission, Integrated Services Digital Network (ISDN) signal transmission, 3G / 4G / 5G / LTE cellular data network radio signal transmission, Ad Hoc Network signal transmission, Radio Wave signal transmission, Microwave signal transmission, Infrared signal transmission, Visible Light signal transmission, Ultraviolet Light signal transmission, Radio signal transmission along the electromagnetic spectrum, or any combination thereof.The communications interface 712 may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers used to determine the location of the computing device 700 based on the reception of one or more signals from one or more satellites associated with one or more GNSS systems. GNSS systems include, among others, the U.S. GPS, the Russian Global Navigation Satellite System (GLONASS), the Chinese BeiDou Navigation Satellite System (BDS), and the European Galileo GNSS. There is no limitation to operation on any particular hardware arrangement, and therefore the basic functions here can be easily replaced with improved hardware or firmware arrangements as they are developed.

[0170] The term "computer-readable medium" includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media capable of storing, containing, or transmitting instructions and / or data. A computer-readable medium may be a non-transitory medium capable of storing data and which does not contain carrier waves and / or transitory electronic signals that propagate wirelessly or over wired connections. Examples of a non-transitory medium may include, but are not limited to, a magnetic disk or tape, optical storage media such as CDs or DVDs, flash memory, storage, or memory devices.A computer-readable medium may store code and / or machine-executable instructions that may represent a procedure, function, subroutine, program, routine, subprogram, module, software package, class, or any combination of instructions, data structures, or program instructions. A code segment may be coupled to another code segment or hardware circuit by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc., may be passed, relayed, or transmitted by any means, such as memory sharing, message passing, token passing, network transmission, or the like.

[0171] All or any portion of the components of computing device 700 may be implemented in circuitry. For example, the components may include electronic circuitry or other electronic hardware and / or may be implemented using electronic circuitry, which may include one or more programmable electronic circuits (e.g., microprocessors, GPUs, DSPs, CPUs, and / or other suitable electronic circuits) and / or may be implemented using computer software, firmware, or any combination thereof to perform the various operations described herein. In some aspects, the computer-readable storage devices, media, and memories may include a wired or wireless signal containing a bitstream and the like.However, non-transitory computer-readable storage media expressly exclude media such as energy, carrier signals, electromagnetic waves and signals as such.

[0172] Certain embodiments may have none, some, or all of the following technical advantages.

[0173] Certain embodiments may continuously evaluate active rogue classification policies, such as those used by an NMS to classify detected electronic devices, by taking periodic snapshots of rogue classification information and performing analysis with various statistical machine learning algorithms. These snapshots and statistical machine learning algorithms may consider complex combinations of attribute values ​​for the attributes of devices detected on the network to evaluate whether a rogue classification assigned to an electronic device is the optimal rogue classification for that electronic device. This evaluation may uncover suboptimal rogue classification assignments and, thus, potential problems with active rogue classification strategies.

[0174] Certain embodiments may improve the accuracy of rogue classification policies deployed by an NMS. For example, certain embodiments may automatically and continuously generate recommended rogue classification policies based on the evaluation of active rogue classification policies to improve rogue classification based on ongoing analysis of rogue classifications performed with active rogue classification policies. Certain embodiments may make some or all of the recommended rogue classification policies available to a network administrator or other user for review, configuration (if applicable), and potential deployment.Additionally or alternatively, certain embodiments provide the ability to automatically deploy some or all of the recommended rogue classification policies for use as part of future active rogue classification policies, with little or no intervention from a user, such as a network administrator. Certain embodiments provide the ability to automatically deploy some or all of the recommended rogue classification policies for use as part of future active rogue classification policies, without requiring intervention from a network administrator or other user, thereby automatically improving the rogue classification capabilities of a communications network.

[0175] Considering the entirety of the data considered and using the algorithms used to analyze the data, problems with active rogue classification policies can be uncovered that would otherwise be difficult or impossible for a human user, such as a network administrator, to detect. Even if a highly skilled network administrator could detect some problems with active rogue classification policies, doing so would require significant training and a significant amount of time to understand and analyze the data, if at all possible. Furthermore, network administration tools often offer the network administrator only limited options for addressing the problem, such as choosing from predefined policies or making certain limited changes to the rules associated with the predefined policies.

[0176] Certain embodiments establish rogue classification guidelines that more quickly lead to more accurate rogue classifications for electronic devices. For example, it may be appropriate to classify a particular electronic device as rogue or suspected rogue when the electronic device in question is initially detected, but over time, it may be determined that the device in question is not, in fact, a rogue device. The improved rogue classification guidelines of this disclosure may reduce or eliminate the time required to correctly classify a particular electronic device into a more benign rogue category.Another example: Although a particular electronic device may be a rogue device, the particular electronic device may initially be incorrectly classified into a benign rogue classification category. However, over time, the behavior or other characteristics of the particular electronic device may make it clear that the particular device is indeed a rogue device. The improved rogue device classification guidelines in this disclosure may reduce or eliminate the time required to correctly classify a particular electronic device as a rogue device.

[0177] Improving the capabilities of electronic devices to classify malicious devices can improve the overall security of a communications network and reduce the processing overhead for electronic devices. For example, more accurate classification of malicious devices in a communications network can improve network security by identifying malicious devices that may have been misclassified by a more benign classification under active malicious device classification policies, by reducing or eliminating the misclassification of devices that pose no or low threat as malicious devices (thereby freeing resources, whether human or computing, to deal with actual malicious devices), and / or by providing other benefits.Another example is that more accurate classification of malicious devices in a communications network (or at least achieving more accurate classification more quickly) can reduce the processing burden on electronic devices by directing those processing resources to electronic devices that are more likely to pose a threat rather than to those that pose little or no threat. Network administrators can also focus on actual threats, which could also reduce their workload.

[0178] Exemplary embodiments of this disclosure are summarized herein. Other embodiments may also be understood from the entirety of the specification and claims filed herein.

[0179] Example 1. In certain embodiments, a method comprises obtaining, by a processing device, rogue classification information for electronic devices detected in a communications network at a plurality of times. The rogue classification information for each time of the plurality of times comprises: timestamp information identifying the time of the plurality of times; corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network.The method includes analyzing, by the processing device, the rogue classification information for the plurality of time points to determine whether to change the active rogue classification policies. Analyzing the rogue classification information for the plurality of time points includes analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points. The method includes generating, by the processing device, a recommended rogue classification policy in response to the determination to change the active rogue classification policies.

[0180] Example 2. The method of example 1, wherein the active rogue classification policies include rules for classifying the electronic devices detected in the communications network into one of a plurality of rogue classifications, the plurality of rogue classifications defining different levels of a threat determined to be emanating from an electronic device detected in the communications network.

[0181] Example 3. The method of any one of examples 1 to 3, wherein the corresponding attribute values ​​for the electronic devices detected in the communication network comprise values ​​for device attributes and activity attributes associated with the electronic devices detected in the communication network.

[0182] Example 4. The method of any one of Examples 1 to 3 further comprises performing a pre-analysis of the rogue classification information prior to analyzing the rogue classification information to attempt to identify anomalies in the corresponding attribute values ​​and to validate the respective rogue classifications determined according to the active rogue classification policies for the electronic devices detected within the communications network.

[0183] Example 5. The method of any of Examples 1-4, wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, wherein the threat rating is separate from the respective rogue classification for the particular electronic device and is determined according to at least a portion of the corresponding attribute values ​​for the particular electronic device.

[0184] Example 6. The method of any of examples 1-5, wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises: applying a data correlation algorithm to the corresponding attribute values ​​for the electronic devices; and applying a data prediction algorithm to the corresponding attribute values ​​for the electronic devices.

[0185] Example 7. The method of any of Examples 1 to 6 further comprises automatically deploying the recommended rogue classification policy to an electronic device to cause the electronic device to automatically adopt the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.

[0186] Example 8. The method of any one of examples 1 to 6 further comprises transmitting, by the processing device, the recommended rogue classification policy to a network manager for evaluation prior to deploying the recommended rogue classification policy to adopt the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.

[0187] Example 9. The method of Example 8, wherein the recommended rogue classification policy is a template for a rogue classification policy that includes one or more fields for configuration, the recommended rogue classification policy including recommended values ​​for the one or more fields.

[0188] Example 10. The method of any of examples 1-9, wherein the recommended rogue classification policy includes a new rogue classification policy or an update to an active rogue classification policy.

[0189] Example 11. The method of any of examples 1-10, wherein: the communications network is a WLAN; and the electronic devices comprise one or more of the following: a client device; a wireless access point; a WLAN controller; or a network switch.

[0190] Example 12. The method of example 1, wherein the processing device includes a network management system.

[0191] Example 13. In certain embodiments, a computer system includes one or more processors and one or more non-transferable computer-readable storage media storing programming for execution by the one or more processors. The programming includes instructions for obtaining, at a plurality of times, information for classifying electronic devices detected in a communications network.The rogue classification information for each time point of the plurality of time points includes: timestamp information identifying the time point of the plurality of time points; corresponding sets of attribute values ​​for the electronic devices detected at the time point within the communications network; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time point within the communications network. The programming further includes instructions for analyzing the rogue classification information for the plurality of time points to determine whether to change the active rogue classification policies.Analyzing the rogue classification information for the plurality of time points includes analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points. The programming further includes instructions for generating a recommended rogue classification policy in response to the determination to change the active rogue classification policies.

[0192] Example 14. The computer system of example 13, wherein the corresponding attribute values ​​for the electronic devices detected within the communications network include values ​​for device attributes and activity attributes associated with the electronic devices detected within the communications network.

[0193] Example 15. The computer system of any of examples 13-14, wherein the programming further includes instructions to, prior to analyzing the rogue classification information, perform a pre-analysis of the rogue classification information to attempt to identify anomalies in the corresponding attribute values ​​and to validate the respective rogue classifications determined according to the active rogue classification policies for the electronic devices detected within the communications network.

[0194] Example 16. The computer system of any of examples 13 to 15, wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, wherein the threat rating is separate from the respective rogue classification for the particular electronic device and is determined according to at least a portion of the corresponding attribute values ​​for the particular electronic device.

[0195] Example 17. The computer system of any of examples 13-16, wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises: analyzing the corresponding attribute values ​​for the electronic devices using a data correlation algorithm; and analyzing the corresponding attribute values ​​for the electronic devices using a data prediction algorithm.

[0196] Example 18. The computer system of any one of examples 13 to 17, wherein the programming further includes instructions for automatically deploying the recommended rogue classification policy on an electronic device to cause the electronic device to automatically include the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies.

[0197] Example 19. The computer system of any one of examples 13 to 17, wherein the programming further includes instructions to transmit the recommended rogue classification policy to a network manager for evaluation prior to deploying the recommended rogue classification policy to adopt the recommended rogue classification policy as the active rogue classification policy of the active rogue classification policies.

[0198] Example 20. In certain embodiments, one or more non-transferable computer-readable storage media stores programming for execution by one or more processors. The programming includes instructions for obtaining, at a plurality of times, rogue classification information for electronic devices detected on a communications network.The rogue classification information for each time point of the plurality of time points includes: timestamp information identifying the time point of the plurality of time points; corresponding sets of attribute values ​​for the electronic devices detected at the time point within the communications network; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time point within the communications network. The programming further includes instructions for analyzing the rogue classification information for the plurality of time points to determine whether to change the active rogue classification policies.Analyzing the rogue classification information for the plurality of time points includes analyzing, using a statistical machine learning algorithm, the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points. The programming further includes instructions for generating a recommended rogue classification policy in response to the determination to change the active rogue classification policies.

[0199] Although this disclosure has been described with reference to illustrative embodiments, this description is not intended to be taken in a limiting sense. Various modifications and combinations of the illustrated embodiments, as well as other embodiments of the disclosure, will be apparent to those skilled in the art from this description. It is therefore intended that the appended claims encompass all such modifications or embodiments.

Claims

[1] Procedure comprising: Obtaining, at a plurality of times by a processing device, rogue classification information for electronic devices detected within a communications network, the rogue classification information comprising for each time of the plurality of times: Timestamp information identifying the time of the plurality of time points; corresponding sets of attribute values ​​for the electronic devices detected at that time within the communications network; and respective rogue classifications as determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network; Analyzing the rogue classification information for the plurality of time points by the processing device to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of time points comprises analyzing the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points using a statistical machine learning algorithm; and Generating, by the processing device, a recommended rogue classification policy in response to the determination to modify the active rogue classification policies. [2] The method of claim 1, wherein the active rogue classification policies comprise rules for classifying the electronic devices detected in the communications network into one of a plurality of rogue classifications, the plurality of rogue classifications defining different levels of a threat determined to be emanating from an electronic device detected in the communications network. [3] The method of claim 1, wherein the corresponding attribute values ​​for the electronic devices detected within the communication network comprise values ​​for device attributes and activity attributes associated with the electronic devices detected within the communication network. [4] The method of claim 1, further comprising, prior to analyzing the rogue classification information, performing a pre-analysis of the rogue classification information to attempt to identify anomalies in the corresponding attribute values ​​and to validate the respective rogue classifications determined according to the active rogue classification policies for the electronic devices detected in the communication network. [5] The method of claim 1, wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, wherein the threat rating is separate from the respective rogue classification for the particular electronic device and is determined according to at least a portion of the corresponding attribute values ​​for the particular electronic device. [6] The method of claim 1, wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises: Applying a data correlation algorithm to the corresponding attribute values ​​for the electronic devices; and Applying a data prediction algorithm to the corresponding attribute values ​​for the electronic devices. [7] The method of claim 1, further comprising automatically deploying the recommended rogue classification policy to an electronic device to cause the electronic device to automatically include the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies. [8] The method of claim 1, further comprising transmitting the recommended rogue classification policy by the processing device to a network manager for evaluation prior to deployment of the recommended rogue classification policy to include the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies. [9] The method of claim 8, wherein the recommended rogue classification policy is a template rogue classification policy including one or more fields for configuration, the recommended rogue classification policy comprising recommended values ​​for the one or more fields. [10] The method of claim 1, wherein the recommended rogue classification policy comprises a new rogue classification policy or an update to an active rogue classification policy. [11] The method of claim 1, wherein: the communication network is a wireless local area network (WLAN); and the electronic devices include one or more of the following elements: a client device; a wireless access point; a WLAN controller; or a network switch. [12] The method of claim 1, wherein the processing device comprises a network management system. [13] Computer system comprising: one or more processors; and one or more non-transferable computer-readable storage media storing programming for execution by the one or more processors, the programming comprising instructions to: Obtaining, at a plurality of times, rogue classification information for electronic devices detected within a communications network, wherein the rogue classification information for each time of the plurality of times comprises: Timestamp information identifying the time of the plurality of time points; corresponding sets of attribute values ​​for the electronic devices detected at that time within the communications network; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network; Analyzing the rogue classification information for the plurality of time points to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of time points comprises analyzing the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points using a statistical machine learning algorithm; and Generating a recommended rogue classification policy in response to the determination to modify the active rogue classification policies. [14] The computer system of claim 13, wherein the corresponding attribute values ​​for the electronic devices detected within the communication network comprise values ​​for device attributes and activity attributes associated with the electronic devices detected within the communication network. [15] The computer system of claim 13, wherein the programming further comprises instructions to perform a pre-analysis of the rogue classification information prior to analyzing the rogue classification information to attempt to identify anomalies in the corresponding attribute values ​​and to validate the respective rogue classifications determined according to the active rogue classification policies for the electronic devices detected within the communications network. [16] The computer system of claim 13, wherein analyzing the rogue classification information comprises assigning a threat rating to a particular electronic device, wherein the threat rating is separate from the respective rogue classification for the particular electronic device and is determined according to at least a portion of the corresponding attribute values ​​for the particular electronic device. [17] The computer system of claim 13, wherein analyzing the rogue classification information using the statistical machine learning algorithm comprises: Analyzing the corresponding attribute values ​​for the electronic devices using a data correlation algorithm; and analyzing the corresponding attribute values ​​for the electronic devices using a data prediction algorithm. [18] The computer system of claim 13, wherein the programming further comprises instructions for automatically providing the recommended rogue classification policy to an electronic device to cause the electronic device to automatically include the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies. [19] The computer system of claim 13, wherein the programming further comprises instructions to transmit the recommended rogue classification policy to a network manager for evaluation prior to deploying the recommended rogue classification policy to include the recommended rogue classification policy as an active rogue classification policy of the active rogue classification policies. [20] One or more non-transferable computer-readable storage media storing programming for execution by one or more processors, the programming comprising instructions to: Obtaining, at a plurality of times, rogue classification information for electronic devices detected within a communications network, wherein the rogue classification information for each time of the plurality of times comprises: Timestamp information identifying the time of the plurality of time points; corresponding sets of attribute values ​​for the electronic devices detected at that time within the communications network; and respective rogue classifications determined according to active rogue classification policies and the corresponding sets of attribute values ​​for the electronic devices detected at the time within the communications network; Analyzing the rogue classification information for the plurality of time points to determine whether to modify the active rogue classification policies, wherein analyzing the rogue classification information for the plurality of time points comprises analyzing the respective rogue classifications and the corresponding sets of attribute values ​​for the electronic devices for the plurality of time points using a statistical machine learning algorithm; and Generate a recommended rogue classification policy in response to the determination to modify the active S rogue classification policies.

Images