Ranking of enterprise devices using activity-based network profiles and functional characterization-based device clustering

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to implement the following steps:
• identifying device communications over at least one network of an enterprise;
• evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network;
• generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices:
• (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device;
• clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles;
• ranking the devices within one or more clusters based at least in part on one or more of network activity and network exposure;
• ranking the devices within one or more clusters based on factors of:
• a total number of services exported;
• a number of external IP addresses that access each device;
• and
• a total number of IP addresses that access the network;
• computing a product of the factors;
• and
• generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk.

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:

• identifying device communications over at least one network of an enterprise;
• evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network;
• generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices:
• (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device;
• clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles;
• ranking the devices within one or more clusters based at least in part on one or more of network activity and network exposure;
• ranking the devices within one or more clusters based at least in part on factors of:
• a total number of services exported;
• a number of external IP addresses that access each device;
• and
• a total number of IP addresses that access the network;
• computing a product of the factors;
• and
• generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk.