# US 2021/0243268 A1 · Ranking of enterprise devices using activity-based network profiles and functional characterization-based device clustering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243268 A1 - Document ID: US20210243268A1 - Status: Published application - Kind: A1 - Application number: 16/778,123 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: RSA Security Inc. - Applicants: RSA Security LLC - Inventors: Sashka T. Davis; William E. Hart - Web page: https://patentgrep.com/patent/US20210243268A1 ## CPC - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3236: {using cryptographic hash functions} - H04L 41/0893: Assignment of logical groups to network elements - H04L 43/065: related to network devices - H04L 67/303: Terminal profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 9/4411: {Configuring for operating with peripheral devices; Loading of device drivers} - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/142: using statistical or mathematical methods - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are provided for generating activity-based network profiles for devices, and for ranking such devices using the activity-based network profiles. One method comprises evaluating device communications to identify services that communicated with devices of an enterprise; generating an activity-based network profile for each device based on the services that communicated with each respective device; clustering the devices into a plurality of clusters based on a functional characterization of the devices derived from the activity-based network profiles; and ranking the devices within a cluster based on network activity and/or network exposure. The activity-based network profile for a given device: (i) identifies the services that communicated with the given device, (ii) identifies other devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based on network metrics of the other devices that communicate with the respective service on the given device. ## Claims ### Claim 1 A method comprising: identifying device communications over at least one network of an enterprise; evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network; generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device; clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles; ranking the devices within one or more clusters based at least in part on one or more of network activity and network exposure; ranking the devices within one or more clusters based on factors of: a total number of services exported; a number of external IP addresses that access each device; and a total number of IP addresses that access the network; computing a product of the factors; and generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk, wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The method of claim 1, wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device. ### Claim 3 (depends on 1) The method of claim 1, wherein the activity-based network profile for the given device further identifies, for each accessed service, (i) other devices that connect to the respective accessed service on the given device, and (ii) a local fraction metric based at least in part on a ratio of one or more network metrics of communications of other devices that accessed the respective accessed service on the given device to the one or more network metrics of communications of other devices that accessed any service on the given device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: computing a centroid for each of the plurality of clusters; receiving a search request for the devices in the plurality of devices similar to a specified device; comparing the specified device to the computed centroids for the plurality of clusters; and returning the devices in the clusters having centroids similar to the specified device. ### Claim 5 (depends on 1) The method of claim 1, wherein the activity-based network profile for the given device further identifies, for each service accessed by the given device, (i) other devices where the given device accessed the respective service accessed by the given device, and (ii) a local fraction metric based at least in part on a ratio of one or more network metrics of communications of the given device with the respective service accessed by the given device to the one or more network metrics of communications with any service accessed by the given device. ### Claim 6 (depends on 1) The method of claim 1, wherein the functional characterization is further derived from one or more of the activity-based profile, the local fraction metric, a threshold value for a minimum number of network addresses that communicated with the given device, and a threshold value for the ratio of the number of services communicating with the given device, and a threshold for the ratio between the number of services and the number of network addresses communicating with the device. ### Claim 7 (depends on 1) The method of claim 1, wherein the ranking the devices within each cluster based at least in part on the network activity orders the devices assigned to a given cluster based at least in part on one or more network metrics of devices that communicated with only the services related to a main function of the given cluster. ### Claim 8 (depends on 1) The method of claim 1, wherein the ranking the devices within each cluster based at least in part on the network exposure orders the devices assigned to a given cluster based at least in part on one or more of a total number of distinct services communicating with the given device, a number of network addresses external to the at least one network of the enterprise that communicated with each given device, and a total number of network addresses that communicated with each given device. ### Claim 9 (depends on 1) The method of claim 1, further comprising assigning devices that do not demonstrate a functional characterization to a cluster using a divide and conquer clustering algorithm to form groupings based at least in part on one or more of a profile-similarity, a network proximity, and a device address proximity, wherein the divide and conquer clustering algorithm evaluates, for the given device, one or more of a set of services communicating with the given device, a total number of network addresses communicating with the given device and a network address of the given device. ### Claim 10 (depends on 1) The method of claim 1, wherein the activity-based network profile for the given device is based at least in part on one or more network metrics comprising one or more of a number of distinct network addresses, a total amount of data transferred, a total amount of data uploaded, a total amount of data downloaded and a duration of communication. ### Claim 11 (depends on 1) The method of claim 1, wherein the functional characterization of the given device is provided by a subject matter expert, and wherein at least one additional device that satisfies at least one similarity criteria is assigned to the same cluster as the given device. ### Claim 12 (depends on 1) The method of claim 1, wherein the activity-based network profile for the given device of the plurality of devices is generated by associating, with each device of the plurality of devices, a numeric feature vector that represents quantitative information about services the device exports and imports. ### Claim 13 (depends on 1) The method of claim 1, wherein the identifying is passive with respect to the devices connected to the at least one network. ### Claim 14 (depends on 1) The method of claim 1, further comprising evaluating the device communications to identify one or more previously unknown devices or a deviation of the given device from an original profile. ### Claim 15 (depends on 1) The method of claim 1, further comprising generating content or contextual details for at least one of the plurality of devices based at least in part on one or more of: (a) the activity-based network profile for each of the plurality of devices, (b) the devices within at least one cluster, and (c) the ranking of the devices within at least one cluster. ### Claim 16 (depends on 1) The method of claim 1, wherein the identifying device communications comprises processing one or more of network traffic on the at least one network and log entries for one or more of the devices connected to the at least one network. ### Claim 17 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured to implement the following steps: identifying device communications over at least one network of an enterprise; evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network; generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device; clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles; ranking the devices within one or more clusters based at least in part on one or more of network activity and network exposure; ranking the devices within one or more clusters based on factors of: a total number of services exported; a number of external IP addresses that access each device; and a total number of IP addresses that access the network; computing a product of the factors; and generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device. ### Claim 19 A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps: identifying device communications over at least one network of an enterprise; evaluating the device communications to identify one or more services that communicated with, using the at least one network, a plurality of devices of the enterprise connected to the at least one network; generating an activity-based network profile for each device of the plurality of devices based at least in part on the identified one or more services that communicated with each respective device of the plurality of devices, wherein the activity-based network profile for a given device of the plurality of devices: (i) identifies the one or more services that communicated with the given device for each service that communicated with the given device, (ii) identifies other devices of the plurality of devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based at least in part on one or more network metrics of the other devices of the plurality of devices that communicate with the respective service on the given device; clustering the devices into a plurality of clusters based at least in part on a functional characterization of the devices derived from the activity-based network profiles; ranking the devices within one or more clusters based at least in part on one or more of network activity and network exposure; ranking the devices within one or more clusters based at least in part on factors of: a total number of services exported; a number of external IP addresses that access each device; and a total number of IP addresses that access the network; computing a product of the factors; and generating an ordered rank of the devices from high to low product value, such that the rank of the devices is ordered from high risk to low risk. ### Claim 20 (depends on 19) The non-transitory processor-readable storage medium of claim 19, wherein the activity-based network profile for the given device further identifies a device type of the given device and wherein the clustering is further based on the device type such that a plurality of devices having one or more of a substantially similar functional characterization and a substantially similar device type are grouped together, wherein the functional characterization assigns the device type to each device.