Fingerprinting assisted by similarity-based semantic clustering

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• obtain entity attribute data associated with network entities;
• determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
• monitor a plurality of entities coupled to a network;
• identify values for the one or more entity attributes for the plurality of entities;
• determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
• determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
• cluster the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities;
• and
• after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

• access entity attribute data associated with network entities;
• determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
• monitor a plurality of entities coupled to a network;
• identify values for the one or more entity attributes for the plurality of entities;
• determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
• determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
• cluster, by the processing device, the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities;
• identify at least one entity attribute of the one or more entity attributes of a first cluster of the plurality of entity clusters with a similarity of values that exceeds a threshold;
• and
• after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities based on at least one entity attribute of a first cluster of the plurality of entity clusters, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.