Synthetic data for determining health of a network security system

A non-transitory computer-readable medium comprising instructions stored thereon that, when executed, cause a computing device to:

• capture data traversing a network from at least one source node to at least one destination node;
• determine, from the captured data generated by a plurality of nodes of the network, that the captured data corresponds to a pattern, wherein the pattern is associated with expected behavior of one or more nodes of the plurality of nodes;
• select at least one node of the plurality of nodes for generating second data corresponding to the pattern, wherein the selected node is not the at least one source node;
• cause the at least one selected node of the plurality of nodes to generate the second data corresponding to the pattern, wherein the second data is associated with actual behavior of the at least one selected node;
• compare the actual behavior with the expected behavior;
• and
• when the actual behavior does not correspond to the expected behavior, generate an alert that the at least one selected node of the plurality of nodes is non-conforming.

A system comprising:

• a processor;
• and
• a memory including instructions that, when executed by the processor, cause the processor to:
• capture data traversing a network from at least one source node to at least one destination node;
• determine, from the captured data generated by a plurality of nodes of the network, that the captured data corresponds to a pattern, the pattern associated with expected behavior of one or more nodes of the plurality of nodes;
• select at least one node of the plurality of nodes for generating second data corresponding to the pattern, wherein the selected node is not the at least one source node;
• cause the at least one selected node of the plurality of nodes to generate the second data corresponding to the pattern, wherein the second data is associated with actual behavior of the at least one selected node;
• compare the actual behavior with the expected behavior;
• and
• when the actual behavior does not correspond to the expected behavior, generate an alert that the at least one selected node of the plurality of nodes is non-conforming.