Clustering enhanced analysis
AssigneeForescout Technologies, Inc.
InventorsArun Raghuramu, Aveek Kumar Das, Yang Zhang
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for clustering are described. Network traffic is accessed from a network and the network may be associated with a plurality of entities. Behavior associated with each entity of the plurality of entities may be determined. The behavior may be determined based one or more communications associated with each entity. A processing device may be used to determine one or more clusters of entities based on entities having similar behavior. A cluster may comprise one or more entities with similar behavior. One or more anomalies may be determined based on the one or more clusters and storing data associated with at least one of the one or more clusters and the one or more anomalies may be stored.
Claims20
A method comprising:
- accessing network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determining behavior associated with each entity of the plurality of entities, wherein the behavior is determined based on one or more communications associated with each entity;
- determining, by a processing device, one or more clusters of entities based on entities having similar behavior, wherein a cluster comprises one or more entities with similar behavior;
- determining one or more access policies associated with each of the one or more clusters of entities;
- determining one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- storing data associated with at least one of the one or more clusters and the one or more anomalies.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determine behavior associated with each entity of the plurality of entities, wherein the behavior is determined based on one or more communications associated with each entity;
- determine one or more clusters of entities based on entities having similar behavior, wherein a cluster comprises one or more entities with similar behavior;
- determine one or more access policies associated with each of the one or more clusters of entities;
- determine one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- store data associated with at least one of the one or more clusters and the one or more anomalies.
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determine behavior associated with each entity of the plurality of entities, wherein the behavior is determined based on one or more communications associated with each entity;
- determine, by the processing device, one or more clusters of entities based on entities having similar behavior, wherein a cluster comprises one or more entities with similar behavior;
- determine one or more access policies associated with each of the one or more clusters of entities;
- determine one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- store data associated with at least one of the one or more clusters and the one or more anomalies.
Dependencies are inferred from the claim text.