Communication Graph Role Inference for Cloud Micro-Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments lack a comprehensive view of network communications within subscriptions, which hinders security improvements and network optimization, due to the expansive and complex nature of communication graphs.
Innovation Solution
A role inference pipeline that analyzes communication graphs using adjacency and node features, combined with domain knowledge and partial labeling, to reduce dimensionality and infer roles, enabling clearer visualizations and micro-segmentation for enhanced security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a comprehensive view of network communications is obtained, then network security and optimization are improved, but the complexity and computational cost increase
Solution Approach 1:
The patent segments the communication graph into multiple subgraphs based on domain knowledge (e.g., separating compute, storage, and network resources). This segmentation reduces the complexity of analyzing the entire graph while maintaining comprehensive security monitoring by applying analysis to each manageable subgraph separately.
Solution Approach 2:
The patent introduces role inference as an intermediary layer that translates complex communication patterns into simplified role assignments. This intermediary process bridges the gap between raw communication data and security insights, reducing the computational burden while improving security monitoring effectiveness.
2Productivity
If dimensionality reduction is applied to communication graphs, then processing efficiency is improved, but information loss may occur
Solution Approach 1:
The patent changes the parameter representation by transforming communication graph data into role-based parameters. Instead of processing raw communication matrices, the system processes role assignments that capture essential communication patterns while reducing dimensionality. This parameter transformation maintains critical information while improving processing efficiency.
Solution Approach 2:
The patent performs preliminary role inference before detailed security analysis. By pre-processing the communication graph to assign roles based on domain knowledge, the system prepares the data in a condensed format that retains essential information while reducing the complexity of subsequent security analysis operations.
3Measurement precision
If role inference is performed using domain knowledge and partial labeling, then accuracy is improved, but computational resources increase
Solution Approach 1:
The patent applies partial labeling where only a subset of nodes are labeled with domain knowledge, rather than requiring complete labeling of all nodes. This partial action approach achieves accurate role inference for the entire graph by using the labeled subset as training data, significantly reducing computational resources compared to comprehensive labeling while maintaining high accuracy.
Solution Approach 2:
The patent incorporates feedback mechanisms where the role inference process iteratively refines assignments based on domain knowledge and observed communication patterns. This feedback loop improves accuracy by continuously adjusting role assignments while optimizing computational resource usage through intelligent sampling and iterative refinement rather than exhaustive processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data processing system implements receiving telemetry data from a plurality of nodes of a cloud-based computing environment; analyzing the telemetry data using a communication graph pipeline to generate a communication graph representing communication among the plurality of nodes of the cloud-based computing environment; analyzing the communication graph using a role inference pipeline to infer roles of the plurality of nodes of the cloud-based computing environment included in the communication graph and output inferred roles for the plurality of nodes; and performing one or more actions on the communication graph based on the inferred roles for the plurality of nodes.