Recommending Similar Devices in Close Proximity for Network Security Management

This paper presents a prototype of a tool for network security management that recommends similar devices in close proximity to a given machine. The task of recommending similar devices helps in analyzing the impact of cyber attacks, providing early warning and mitigating a spreading infection, or investigating an attack. Our tool uses modern graph-based technologies to store and query the data and existing data models that interconnect heterogeneous information about computer networks. By traversing the graph of network entities and calculating similarity scores, the tool suggests which devices are most likely to be exploited along with or after the exploitation of a device in question. The advantage of our tool is that it considers multiple attack vectors, including social engineering.