Clustering enhanced analysis
AssigneeForescout Technologies, Inc.
InventorsArun Raghuramu, Aveek Kumar Das, Yang Zhang
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for clustering are described. The method includes determining one or more access policies associated with each of one or more clusters of entities, wherein a cluster comprises one or more entities with similar behavior. The method further includes determining one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies. The method further includes storing data associated with at least one of the one or more clusters and the one or more anomalies.
Claims20
A method comprising:
- determining, by a processing device, one or more access policies associated with each of one or more clusters of entities, wherein a cluster comprises one or more entities with similar behavior;
- determining one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- storing data associated with at least one of the one or more clusters and the one or more anomalies.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- determine one or more access policies associated with each of one or more clusters of entities, wherein a cluster comprises one or more entities with similar behavior;
- determine one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- store data associated with at least one of the one or more clusters and the one or more anomalies.
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- determine one or more access policies associated with each of one or more clusters of entities, wherein a cluster comprises one or more entities with similar behavior;
- determine, by the processing device, one or more anomalies based on the one or more clusters, wherein the one or more access policies control communications between entities of the one or more clusters based on the one or more anomalies;
- and
- store data associated with at least one of the one or more clusters and the one or more anomalies.
Dependencies are inferred from the claim text.