Generating Interpretable Network Asset Clusters For Security Analytics

User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While user peer group data is readily available, since it is maintained by enterprise IT for network security policy administration, asset peer group data is typically nonexistent. Therefore, a method to automatically create asset groups or clusters is desired. This is useful both in building the asset taxonomy for knowledge discovery and in asset-peer analysis for anomaly detection. This work presents a behavior-based, asset-clustering method by analyzing data from user-to-asset logon event records while leveraging the existing user peer group labels. Output asset clusters are stable, with interpretable cluster labels for operational consideration. We demonstrate the value of the derived asset clusters in peer analysis for anomaly detection.