AUTOMATIC GENERATION OF CLUSTER DESCRIPTIONS

• US 20170099304A1
• Filed: 10/01/2015
• Published: 04/06/2017
• Est. Priority Date: 10/01/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Anderson, Blake Harrell
• Granted Patent: US 10,812,496 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In one embodiment, a method includes receiving data associated with a cluster at a computer and processing the data at the computer to automatically generate a description of the cluster. The data includes cluster data comprising data within the cluster and non-cluster data comprising a remaining set of the data. The description comprises a minimal set of features that uniquely defines the cluster to differentiate the cluster data from non-cluster data. An apparatus and logic are also disclosed herein.

Claims

1. A method comprising:

receiving data associated with a cluster at a computer, the data comprising cluster data comprising data within said cluster and non-cluster data comprising a remaining set of the data; and

processing the data at the computer to automatically generate a description of said cluster;

wherein said description comprises a minimal set of features that uniquely defines said cluster to differentiate said cluster data from said non-cluster data.

2. The method of claim 1 wherein processing the data comprises:

computing a centroid for said cluster;

generating a vector based on said centroid and a threshold value; and

creating a matrix by comparing said vector to said non-cluster data.

3. The method of claim 2 wherein said vector is generated according to:

4. The method of claim 2 wherein creating said matrix comprises creating an n×

m matrix, wherein n is a number of samples of said non-cluster data and m is a number of features in said centroid of the cluster.

5. The method of claim 4 wherein each row of the matrix is computed as the absolute value of a difference between said vector and said non-cluster data.

6. The method of claim 1 further comprising utilizing an integer linear program to identify said minimal set of features.

7. The method of claim 1 wherein said minimal set of features identifies malware and further comprising transmitting said description to a network security system.

8. The method of claim 1 wherein said description comprises a machine readable rule or indicator of malware created based on said minimal set of features.

9. The method of claim 1 wherein said description of said cluster comprises a human readable description.

10. The method of claim 1 wherein processing the data comprises utilizing an optimization technique that includes said non-cluster data to reduce instances of false positives.

11. An apparatus comprising:

a processor operable to process data associated with a cluster and automatically generate a description of said cluster; and

memory for storing said data and said description;

wherein the data comprises cluster data comprising data within said cluster and non-cluster data comprising a remaining set of the data, and said description comprises a minimal set of features that uniquely defines said cluster to differentiate said cluster data from said non-cluster data.

12. The apparatus of claim 11 wherein the processor is operable to:

compute a centroid for said cluster;

generate a vector based on said centroid and a threshold value; and

create a matrix by comparing said vector to said non-cluster data.

13. The apparatus of claim 11 wherein the processor is operable to utilize an integer linear program to identify said minimal set of features.

14. The apparatus of claim 11 wherein said description comprises a machine readable rule or indicator of malware created based on said minimal set of features.

15. The apparatus of claim 11 wherein said description of said cluster comprises a human readable description.

16. The apparatus of claim 11 wherein the processor is operable to utilize an optimization technique that includes said non-cluster data to reduce instances of false positives.

17. Logic encoded on one or more non-transitory computer readable media for execution and when executed operable to:

process data associated with a cluster; and

automatically generate a description of said cluster;

wherein the data comprises cluster data comprising data within said cluster and non-cluster data comprising a remaining set of the data, and said description comprises a minimal set of features that uniquely defines said cluster to differentiate said cluster data from said non-cluster data.

18. The logic of claim 17 when executed further operable to:

compute a centroid for said cluster;

generate a vector based on said centroid and a threshold value; and

create a matrix by comparing said vector to said non-cluster data.

19. The logic of claim 17 wherein said description comprises a machine readable rule or indicator of malware created based on said minimal set of features.

20. The logic of claim 17 when executed further operable to utilize an integer linear program to identify said minimal set of features.