Modifying network relationships using a heterogenous network flows graph

Patent metadata

Field	Value
Publication number	US-12143393-B2
Application number	US-202217582943-A
Country	US
Kind code	B2
Filing date	Jan 24, 2022
Priority date	Jan 24, 2022
Publication date	Nov 12, 2024
Grant date	Nov 12, 2024

Abstract

Systems and methods are described for recommending security groups using graph-based learning models. A server can create a network graph that illustrates network flows between devices in a network and security groups that the devices belong to. The network graph can include nodes that represent the devices and security groups. The server can apply a graph-based learning model to learn embeddings of the nodes and create vectors using the embeddings. Using vectors of two nodes, the server can calculate a vector that represents an edge between the two nodes. The server can apply a binary classifier determine whether the edge should exist. A “true” classification between two nodes can indicate that they should be able to communicate, and vice versa. A “true” classification between a device node and a security group node can indicate that the device should be assigned to the security group, and vice versa.

First claim

What is claimed is:

1. A method, comprising:
creating a graph of network traffic flows for a network, the graph including a first device node that represents a first network device and a first security group node that represents a first security group, wherein the graph indicates that the first network device belongs to the first security group;
applying a graph-based learning model to the graph to create a first vector that represents the first device node and a second vector that represents the first security group node;
calculating a norm of the first and second vectors to create a third vector that represents an edge between the first device node and the first security group node;
applying a binary classifier to the third vector;
based on an output of the binary classifier, updating a database that stores security group information to remove the first network device from the first security group;
based on removal of the first network device from the first security group, modifying network configuration settings of the network; and
filtering network traffic of the first network device based on the modified network configuration settings.

2. The method of claim 1 , wherein the first network device is a virtual machine (VM).

3. The method of claim 1 , further comprising:
comparing the second vector to a fourth vector, the fourth vector representing a second security group node;
based on the comparison, determining a similarity level between the second vector and the fourth vector;
determining that the similarity level exceeds a threshold; and
updating the database to combine the first and second security groups into a single security group.

4. The method of claim 1 , further comprising:
adding a false edge to the graph;
applying the graph-based learning model; and
determining whether the graph-based learning model identifies the false edge as an anomaly.

5. The method of claim 1 , further comprising:
removing the edge between the first device node and the first security group node;
applying the graph-based learning model; and
determining whether the graph-based learning model predicts that the edge should exist.

6. The method of claim 1 , wherein the binary classifier is a logistic regression model.

7. The method of claim 1 , wherein the graph-based learning model is a metapath2vec algorithm.

8. A non-transitory, computer-readable medium containing instructions executable by a processor to perform operations comprising:
creating a graph of network traffic flows for a network, the graph including a first device node that represents a first network device and a first security group node that represents a first security group, wherein the graph indicates that the first network device belongs to the first security group;
applying a graph-based learning model to the graph to create a first vector that represents the first device node and a second vector that represents the first security group node;
calculating a norm of the first and second vectors to create a third vector that represents an edge between the first device node and the first security group node;
applying a binary classifier to the third vector;
based on an output of the binary classifier, updating a database that stores security group information to remove the first network device from the first security group;
based on removal of the first network device from the first security group, modifying network configuration settings of the network; and
filtering network traffic of the first network device based on the modified network configuration settings.

9. The non-transitory, computer-readable medium of claim 8 , wherein the first network device is a virtual machine (VM).

10. The non-transitory, computer-readable medium of claim 8 , the operations further comprising:
comparing the second vector to a fourth vector, the fourth vector representing a second security group node;
based on the comparison, determining a similarity level between the second vector and the fourth vector;
determining that the similarity level exceeds a threshold; and
updating the database to combine the first and second security groups into a single security group.

11. The non-transitory, computer-readable medium of claim 8 , the operations further comprising:
adding a false node to the graph;
applying the graph-based learning model; and
determining whether the graph-based learning model identifies the false node as an anomaly.

12. The non-transitory, computer-readable medium of claim 11 , the operations further comprising:
removing the edge between the first device node and the first security group node;
applying the graph-based learning model; and
determining whether the graph-based learning model indicates that the edge should exist.

13. The non-transitory, computer-readable medium of claim 8 , wherein the binary classifier is a logistic regression model.

14. The non-transitory, computer-readable medium of claim 8 , wherein the graph-based learning model is a metapath2vec algorithm.

15. A system for modifying network relationships using a heterogenous network flows graph, comprising:
a processor;
a non-transitory, computer-readable medium comprising instructions executable by the processor to perform operations comprising:
creating a graph of network traffic flows for a network, the graph including a first device node that represents a first network device and a first security group node that represents a first security group, wherein the graph indicates that the first network device belongs to the first security group;
applying a graph-based learning model to the graph to create a first vector that represents the first device node and a second vector that represents the first security group node;
calculating a norm of the first and second vectors to create a third vector that represents an edge between the first device node and the first security group node;
applying a binary classifier to the third vector;
based on an output of the binary classifier, updating a database that stores security group information to remove the first network device from the first security group;
based on removal of the first network device from the first security group, modifying network configuration settings of the network; and
filtering network traffic of the first network device based on the modified network configuration settings.

16. The system of claim 15 , wherein the first network device is a virtual machine (VM).

17. The system of claim 15 , the operations further comprising:
comparing the second vector to a fourth vector, the fourth vector representing a second security group node;
based on the comparison, determining a similarity level between the second vector and the fourth vector;
determining that the similarity level exceeds a threshold; and
updating the database to combine the first and second security groups into a single security group.

18. The system of claim 15 , the operations further comprising:
adding a false node to the graph;
applying the graph-based learning model; and
determining whether the graph-based learning model identifies the false node as an anomaly.

19. The system of claim 18 , the operations further comprising:
removing the edge between the first device node and the first security group node;
applying the graph-based learning model; and
determining whether the graph-based learning model indicates that the edge should exist.

20. The system of claim 15 , wherein the binary classi

Assignees

• VMware LLC

Inventors

• Hayrapetyan Karen
• Krishna Sunitha
• Walia Nikash
• Petrus Margaret

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0813

  characterised by the conditions triggering a change of settings · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• G06N3/04

  Architecture, e.g. interconnection topology · CPC title