Back to results
US 10,833,942 B2Granted
Behavioral based device clustering system and method
AssigneeSplunk Inc.
InventorsGeorge Apostolopoulos, Zhuxuan Jin
Life of this patent
Estimating the term…
Abstract
One or more embodiments are directed behavioral based device clustering. A network traffic log of devices in the network is received. Features of devices are extracted from the network traffic log and aggregated into an aggregated feature matrix on a per device basis. By applying a topic modeling algorithm to the aggregated feature matrix, the devices are clustered into device groups according to behavior groups. A device is assigned to the device group to create an assignment.
Claims30
A method comprising:
- establishing a network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and an analyzer server;
- receiving source data at the server group from one of the one or more source network nodes via a respective network connection and transforming, by the indexer server, the source data to a plurality of timestamped entries of machine data, the plurality of timestamped entries corresponding to a plurality of events recorded in a network traffic log;
- extracting, from the plurality of timestamped entries, a plurality of features of a plurality of devices;
- aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, each entry of the plurality of entries being defined for a particular feature and a particular device and comprising a value identifying a total number of a respective plurality of events having the particular feature for the particular device;
- clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups, wherein clustering comprises:
- generating, by applying the topic modeling algorithm to the aggregated feature matrix, a topic feature matrix comprising a plurality of feature scores for each of a plurality of topics,
- generating, by the topic modeling algorithm using the aggregated feature matrix and the topic feature matrix, a device topic matrix comprising a plurality of device topic scores for a device in the plurality of devices, and
- assigning, using the plurality of device topic scores of the device, a device group to the device;
- and
- assigning one or more devices of the plurality of devices on a network to one or more of the plurality of device groups to obtain an assignment.
7 more elements
A system comprising:
- memory comprising instructions;
- and
- a computer processor for executing the instructions that cause the computer processor to perform operations comprising:
- establishing a network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and an analyzer server;
- receiving source data at the server group from one of the one or more source network nodes via a respective network connection and transforming, by the indexer server, the source data to a plurality of timestamped entries of machine data, the plurality of timestamped entries corresponding to a plurality of events recorded in a network traffic log;
- extracting, from the plurality of timestamped entries, a plurality of features of a plurality of devices;
- aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, each entry of the plurality of entries being defined for a particular feature and a particular device and comprising a value identifying a total number of a respective plurality of events having the particular feature for the particular device;
- clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups, wherein clustering comprises:
- generating, by applying the topic modeling algorithm to the aggregated feature matrix, a topic feature matrix comprising a plurality of feature scores for each of a plurality of topics,
- generating, by the topic modeling algorithm using the aggregated feature matrix and the topic feature matrix, a device topic matrix comprising a plurality of device topic scores for a device in the plurality of devices, and
- assigning, using the plurality of device topic scores of the device, a device group to the device;
- and
- assigning the plurality of devices on a network to one or more of the plurality of device groups to obtain an assignment.
10 more elements
A non-transitory computer-readable storage medium storing computer-readable program code which, when executed by one or more processors, cause the one or more processors to perform operations, comprising:
- establishing a network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and an analyzer server;
- receiving source data at the server group from one of the one or more source network nodes via a respective network connection and transforming, by the indexer server, the source data to a plurality of timestamped entries of machine data, the plurality of timestamped entries corresponding to a plurality of events recorded in a network traffic log;
- extracting, from the plurality of timestamped entries, a plurality of features of a plurality of devices;
- aggregating, per device of the plurality of devices, the plurality of features into an aggregated feature matrix for the plurality of devices, wherein the aggregated feature matrix comprises a plurality of entries, each entry of the plurality of entries being defined for a particular feature and a particular device and comprising a value identifying a total number of a respective plurality of events having the particular feature for the particular device;
- clustering, by applying a topic modeling algorithm to the aggregated feature matrix, the plurality of devices into a plurality of device groups according to one or more behavior groups of the plurality of device groups, wherein clustering comprises:
- generating, by applying the topic modeling algorithm to the aggregated feature matrix, a topic feature matrix comprising a plurality of feature scores for each of a plurality of topics,
- generating, by the topic modeling algorithm using the aggregated feature matrix and the topic feature matrix, a device topic matrix comprising a plurality of device topic scores for a device in the plurality of devices, and
- assigning, using the plurality of device topic scores of the device, a device group to the device;
- and
- assigning one or more devices of the plurality of devices on a network to one or more of the plurality of device groups to obtain an assignment.
7 more elements
Dependencies are inferred from the claim text.