Role Classification of Hosts within Enterprise Networks Based on Connection Patterns

DMCA

Role Classification of Hosts within Enterprise Networks Based on Connection Patterns (2003)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Godfrey Tan , Massimiliano Poletto , John Guttag , Frans Kaashoek

Venue:	In USENIX Annual Technical Conference
Citations:	19 - 0 self

BibTeX

@INPROCEEDINGS{Tan03roleclassification,
    author = {Godfrey Tan and Massimiliano Poletto and John Guttag and Frans Kaashoek},
    title = {Role Classification of Hosts within Enterprise Networks Based on Connection Patterns},
    booktitle = {In USENIX Annual Technical Conference},
    year = {2003},
    pages = {15--28}
}

OpenURL

Abstract

Role classification involves grouping hosts into related roles. It exposes the logical structure of a network, simplifies network management tasks such as policy checking and network segmentation, and can be used to improve the accuracy of network monitoring and analysis algorithms such as intrusion detection. This paper defines the role classification problem and introduces two practical algorithms that group hosts based on observed connection patterns while dealing with changes in these patterns over time. The algorithms have been implemented in a commercial network monitoring and analysis product for enterprise networks. Results from grouping two enterprise networks show that the number of groups identified by our algorithms can be two orders of magnitude smaller than the number of hosts and that the way our algorithms group hosts highly reflect the logical structure of the networks.

Keyphrases

enterprise network role classification connection pattern logical structure intrusion detection analysis algorithm algorithm group network monitoring practical algorithm related role observed connection pattern commercial network monitoring policy checking network segmentation network management task role classification problem analysis product

DMCA