Network Traffic Clustering for Dynamic Security Policy Enforcement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Clustering nodes for security policy enforcement in datacenters is challenging due to dynamic network conditions and the need for continuous tracking of new node and application deployments, as existing methods rely on domain knowledge and network topology, and are not inherently static.

Innovation Solution

A method that analyzes network traffic patterns using probabilistic topic modeling and clustering algorithms to identify groups of network addresses or nodes with similar traffic patterns, allowing for automated security policy application and detection of anomalous behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If network administrators manually track and group nodes using domain knowledge and network topology, then security policy enforcement can be maintained, but the administrative burden and time consumption increase significantly as new nodes and applications are continuously added and removed

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidtime consumption for tracking clusters

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs automated cluster identification by analyzing network traffic patterns itself, without requiring continuous manual intervention. The probabilistic topic modeling algorithm automatically discovers clusters and updates them as nodes are added or removed, making the system self-maintaining and eliminating the need for administrators to continuously track changes

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system proactively identifies clusters by analyzing traffic patterns before security policies need to be applied. By continuously monitoring and pre-identifying cluster structures, the system is ready to enforce policies immediately when needed, rather than reacting to changes after they occur

Inventive Principle:

Principle #10Preliminary action

2Reliability

If clusters are defined statically based on initial node groupings, then security policies can be applied consistently, but the clusters fail to adapt when nodes shift between clusters or when new applications are deployed

Engineering Contradiction:

Improvesecurity policy consistencyVSAvoidcluster dynamic adaptation

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system makes clusters dynamic by continuously analyzing network traffic patterns and updating cluster assignments based on current behavior. The probabilistic topic modeling algorithm detects when nodes change their traffic patterns and automatically reassigns them to appropriate clusters, ensuring clusters remain accurate representations of current network structure

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system uses network traffic patterns as feedback to continuously refine cluster identification. By monitoring traffic flows and analyzing changes in communication patterns, the system detects when nodes should be moved between clusters and updates assignments accordingly, creating a closed-loop system that adapts to changing network conditions

Inventive Principle:

Principle #23Feedback

3Productivity

If administrators group nodes by tier (Web, App, or DB tier) or by open ports, then initial clustering can be established quickly, but the method requires continuous domain knowledge and network topology understanding to maintain accuracy

Engineering Contradiction:

Improveinitial clustering speedVSAvoiddomain knowledge requirement

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system replaces manual administrative processes with automated algorithmic analysis. Instead of administrators manually examining network topology and domain knowledge to identify clusters, the probabilistic topic modeling algorithm automatically analyzes traffic patterns and discovers cluster structures, eliminating the need for continuous expert intervention

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system creates a computational model of cluster structure by analyzing traffic patterns and generating probability distributions that represent cluster memberships. This model serves as a virtual representation of the network structure that can be updated automatically without requiring administrators to maintain mental models or documentation

Inventive Principle:

Principle #26Copying

Data Source

PatentUS10742673B2Tracking the dynamics of application-centric clusters in a virtualized datacenter

Publication Date: 2020.08.11 VMWARE INC

AI summary

For a managed network including multiple nodes providing multiple services and executing multiple applications some embodiments provide a method for generating groupings of network addresses associated with different applications or services. The method analyzes network traffic patterns using a probabilistic topic modeling algorithm to generate the groupings of network addresses. In some embodiments, data is collected and analyzed periodically. A network administrator defines the granularity of the time stamps in some embodiments to monitor changes in network traffic patterns over time for each network address or node and/or for the network as a whole. For each network address or node, a probability distribution over the topics at a given time is stored in some embodiments. The stored distributions are then used to determine a divergence over time of the application or service provided by the network address or node. Additionally, the stored distributions can be used to detect anomalous behavior.