Correlated Network Entity Classification for Granular Security Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in accurately classifying network entities due to insufficient granularity in classification results, leading to inadequate application of security measures and increased vulnerability to attacks.
Innovation Solution
A multi-tiered classification system that combines classification attributes with property values using correlations and machine learning to enhance classification accuracy, leveraging meta-rules and meta-models to determine previously unknown attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a simple classification system is used, then the device complexity is reduced, but the classification precision deteriorates
Solution Approach 1:
The classification system is divided into multiple tiers or stages, where each tier performs a specific classification task using different attributes or data sources. This segmentation allows the system to achieve high classification precision through cumulative processing while keeping each individual tier relatively simple and manageable.
Solution Approach 2:
The patent introduces additional classification dimensions or attributes beyond basic device identification. By incorporating multiple dimensions (e.g., device type, security level, location, behavior patterns), the system achieves higher classification precision without exponentially increasing overall complexity, as each dimension adds independent discriminatory power.
2Reliability
If classification granularity is increased, then the reliability of security measures is improved, but the difficulty of detecting and measuring increases
Solution Approach 1:
The system performs preliminary classification using readily available device attributes and metadata before more detailed detection is required. This preliminary action establishes a baseline classification that can be refined later, reducing the overall difficulty of detection while maintaining high granularity where security reliability is most critical.
Solution Approach 2:
The patent introduces intermediary classification attributes or metadata that bridge the gap between easily detectable basic device information and the detailed characteristics needed for high-granularity classification. These intermediaries (such as device profiles, security tags, or behavioral indicators) make detailed classification more detectable and measurable without requiring direct observation of all fine-grained attributes.
Data Source
AI summary
Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed. One or more values associated with one or more properties associated with an entity may be determined. The one or more values may be determined from the network traffic. A first classification attribute is determined based on the one or more values associated with one or more properties associated with the entity. A second classification attribute is determined, by a processing device, based on the first classification attribute and the one or more values associated with one or more properties associated with the entity. The second classification attribute is stored.