Monitoring an enterprise system utilizing hierarchical clustering of strings in data records

#The field relates generally to information processing, and more particularly to techniques for managing data.

#In many information processing systems, graph networks are used to provide rich compositional or contextual information. A graph network may include a plurality of nodes and edges or links connecting the nodes, with the edges or links representing relationships between the nodes. To construct a graph network, therefore, there is a need to define explicit relationships between the nodes. Each of the nodes in a graph network may represent a data record, which can comprise strings of unstructured text data. Unstructured text data typically requires special treatment, such as manual screening or manual customization and maintenance of a large set of rules that can be used to determine correspondence with predefined themes of interest. Such processing is unduly tedious and time-consuming, particularly for large volumes of unstructured text data.

#Illustrative embodiments of the present disclosure provide techniques for monitoring an enterprise system utilizing hierarchical clustering of strings in data records associated with the enterprise system.

#FIG. 1 is a block diagram of an information processing system for monitoring an enterprise system utilizing hierarchical clustering of strings in an illustrative embodiment.

#FIG. 2 is a flow diagram of an exemplary process for monitoring an enterprise system utilizing hierarchical clustering of strings in an illustrative embodiment.

#FIG. 3 illustrates a hierarchical string clustering system in an illustrative embodiment.

#Illustrative embodiments will be described herein with reference to exemplary information processing systems and associated computers, servers, storage devices and other processing devices. It is to be appreciated, however, that embodiments are not restricted to use with the particular illustrative system and device configurations shown. Accordingly, the term “information processing system” as used herein is intended to be broadly construed, so as to encompass, for example, processing systems comprising cloud computing and storage systems, as well as other types of processing systems comprising various combinations of physical and virtual processing resources. An information processing system may therefore comprise, for example, at least one data center or other type of cloud-based system that includes one or more clouds hosting tenants that access cloud resources.

#FIG. 1 shows an information processing system 100 configured in accordance with an illustrative embodiment. The information processing system 100 is assumed to be built on at least one processing platform and provides functionality for monitoring an enterprise system 110 utilizing hierarchical clustering of strings contained in data records associated with the enterprise system 110. As used herein, an “enterprise system” includes a system associated with at least one enterprise. Thus, in some embodiments, the enterprise system 110 may be associated with or include portions of two or more enterprises or other entities. The information processing system 100 includes a security operations center (SOC) 102, which is coupled via a network 106 to the enterprise system 110. The enterprise system 110, or assets of an information technology (IT) infrastructure associated therewith, is assumed to be accessed, over the network 106, by client devices 104-1, 104-2, . . . 104-M (collectively, client devices 104). The assets of the IT infrastructure may include, by way of example, physical and virtual computing resources in the enterprise system 110. Physical computing resources may include physical hardware such as servers, storage systems, networking equipment, Internet of Things (IoT) devices, other types of processing and computing devices, etc. Virtual computing resources may include virtual machines (VMs), software containers (also referred to herein as containers), etc. The assets of the enterprise system 110 are assumed to produce logs or other data records (either directly, or via monitoring tools monitoring such assets). Such logs or data records, or information derived therefrom, are stored in record database 108 as described in further detail below.

#The client devices 104 may comprise, for example, physical computing devices such as IoT devices, mobile telephones, laptop computers, tablet computers, desktop computers or other types of devices utilized by members of an enterprise, in any combination. Such devices are examples of what are more generally referred to herein as “processing devices.” Some of these processing devices are also generally referred to herein as “computers.” The client devices 104 may also or alternately comprise virtualized computing resources, such as VMs, containers, etc.