Activity-Based Network Profiles for Enterprise Device Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise configuration management databases (CMDBs) often contain inaccurate and stale information due to dynamic environments where devices are frequently repurposed, reconfigured, and user access patterns change, making it difficult for security analysts to obtain accurate summaries of device activities and compare network changes over time.
Innovation Solution
A method is introduced to generate activity-based network profiles for devices by identifying services communicating over the network, clustering devices based on functional characterization, and ranking them by network activity and exposure, using quantitative information about each service without requiring human supervision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual processes are used to maintain CMDB information, then accuracy can be maintained, but time consumption increases significantly in dynamic environments
Solution Approach 1:
The system automatically discovers and profiles devices by analyzing network traffic patterns, allowing the network itself to provide the information needed for CMDB updates without manual intervention. The automated profile generation process continuously monitors network communications to identify services, clients, and communication patterns, thereby maintaining accurate CMDB information while eliminating time-consuming manual processes.
Solution Approach 2:
The system continuously monitors network traffic and uses this feedback to automatically update device profiles and CMDB information. By analyzing ongoing network communications, the system receives real-time feedback about device activities, service interactions, and communication patterns, enabling dynamic updates to CMDB without manual processes.
2Productivity
If automated profile generation is implemented, then time for device evaluation is reduced, but system complexity increases
Solution Approach 1:
The profiling system is segmented into distinct functional modules: network traffic collection, service identification, client analysis, profile generation, and device ranking. Each module handles a specific aspect of the evaluation process independently, making the complex system more manageable and easier to implement while maintaining high productivity through automated processing of network data.
3Measurement precision
If detailed network monitoring is performed, then accuracy of device activity summary improves, but network overhead increases
Solution Approach 1:
The system extracts only the essential information from network traffic data needed for device profiling and CMDB updates. By focusing on identifying services, clients, and communication patterns rather than capturing all network data, the system achieves accurate device activity summaries while minimizing network overhead and bandwidth consumption.
Data Source
AI summary
Techniques are provided for generating activity-based network profiles for devices, and for ranking such devices using the activity-based network profiles. One method comprises evaluating device communications to identify services that communicated with devices of an enterprise; generating an activity-based network profile for each device based on the services that communicated with each respective device; clustering the devices into a plurality of clusters based on a functional characterization of the devices derived from the activity-based network profiles; and ranking the devices within a cluster based on network activity and/or network exposure. The activity-based network profile for a given device: (i) identifies the services that communicated with the given device, (ii) identifies other devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based on network metrics of the other devices that communicate with the respective service on the given device.