Automating network node behavior characterization by mining communication patterns

Enterprise networks of scale are complex, dynamic computing environments that respond to evolving business objectives and requirements. Characterizing system behaviors in these environments is essential for network management and cybersecurity operations. Characterization of system's communication is typical and is supported using network flow information (Net-Flow). Related work has characterized behavior using theoretical graph metrics; results are often difficult to interpret by enterprise staff. We propose a different approach, where flow information is mapped to sets of tags that contextualize the data in terms of network principals and enterprise concepts. Frequent patterns are then extracted and are expressed as behaviors. Behaviors can be compared, identifying systems expressing similar behaviors. We evaluate the approach using two case studies.