Heterogeneous Network Graph for Security Group Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security group management in networks is inefficient due to manual labeling and heuristic-based classification, leading to difficulties in identifying and correcting relationships between devices and their assigned security groups, especially in growing networks with frequent changes, resulting in potential redundancy and communication issues.
Innovation Solution
A system using a heterogeneous network flows graph with a distributed analytics engine to collect network data, construct a graph representing device and security group relationships, apply graph-based learning models to generate node and edge vectors, and employ binary classifiers to determine optimal network configurations, including adding or removing edges and consolidating security groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If manual heuristic-based classification is used to reconfigure security group assignments, then security group management can be performed with simple processes, but it becomes increasingly difficult and time-consuming as the network grows and VMs are added and removed
Solution Approach 1:
The system enables self-service by automatically detecting network relationships and security group assignments through distributed analytics agents deployed on VMs. The graph-based learning model autonomously processes network flow data to identify relationships and recommend security group configurations without requiring manual intervention from IT specialists.
Solution Approach 2:
The patent replaces manual mechanical processes with automated computational systems. Instead of manual review and classification of security groups, the system uses distributed analytics agents to collect data, graph-based learning models to process relationships, and automated algorithms to generate configuration recommendations, substituting human effort with computational automation.
2Adaptability or versatility
If the number of security groups increases to accommodate network growth, then more devices can be organized, but it becomes difficult to review and identify needed changes
Solution Approach 1:
The patent introduces a graph-based learning model as an intermediary between network flow data and security group configurations. This intermediary processes complex network relationships by representing them as graphs where VMs and security groups are nodes and relationships are edges, enabling the system to manage complexity through structured representation and automated analysis.
Solution Approach 2:
The system transitions from traditional flat security group management to a multi-dimensional graph-based representation. By organizing network entities and relationships in a graph structure with multiple node types (VMs, security groups, networks) and edge types (membership, communication, inheritance), the system adds dimensional organization that simplifies management of complex networks.
3Adaptability or versatility
If amorphous networks with frequent changes are allowed, then network flexibility is improved, but devices may communicate when they should not or not communicate when they should
Solution Approach 1:
The system implements continuous feedback by deploying distributed analytics agents on VMs that continuously collect network flow data and update the graph-based learning model. This real-time feedback mechanism allows the system to detect changes in network relationships and security group assignments dynamically, ensuring that communication rules remain correct even as the network evolves.
Solution Approach 2:
The patent applies preliminary action by proactively detecting and recommending security group configuration changes before incorrect communications occur. The graph-based learning model continuously analyzes network relationships and identifies potential security issues or misconfigurations before they affect network operations, allowing preventive corrections to be made.
4Adaptability or versatility
If different security groups have overlapping member devices, then device flexibility is improved, but redundancy negatively impacts efficiency
Solution Approach 1:
The graph-based learning model serves as an intermediary that analyzes overlapping security group memberships and identifies redundant configurations. By processing the graph structure to detect patterns of overlap and their impact on network efficiency, the system can recommend optimizations that maintain necessary flexibility while eliminating wasteful redundancy.
Data Source
AI summary
Systems and methods are described for recommending security groups using graph-based learning models. A server can create a network graph that illustrates network flows between devices in a network and security groups that the devices belong to. The network graph can include nodes that represent the devices and security groups. The server can apply a graph-based learning model to learn embeddings of the nodes and create vectors using the embeddings. Using vectors of two nodes, the server can calculate a vector that represents an edge between the two nodes. The server can apply a binary classifier determine whether the edge should exist. A “true” classification between two nodes can indicate that they should be able to communicate, and vice versa. A “true” classification between a device node and a security group node can indicate that the device should be assigned to the security group, and vice versa.