System and method for clustering host inventories

• US 8,549,003 B1
• Filed: 09/12/2010
• Issued: 10/01/2013
• Est. Priority Date: 09/12/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Bhargava, Rishi, Reese, David P. Jr.
• Primary Examiner(s): Fleurantin, Jean B
• Application Number:
  US12/880,125
• Publication Number:
  US 20130246422A1
• Time in Patent Office: 1,115 Days
• Field of Search: 707/737, 707/738, 707/748, 707/776, 707/791
• US Class Current: 707/737
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements

Abstract

A method in one example implementation includes obtaining a plurality of host file inventories corresponding respectively to a plurality of hosts, calculating input data using the plurality of host file inventories, and then providing the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts. The method further includes each cluster of hosts being grouped using predetermined similarity criteria. In more specific embodiments, each of the host file inventories includes a set of one or more file identifiers with each file identifier representing a different executable software file on a corresponding one of the plurality of hosts. In other more specific embodiments, calculating the input data includes transforming the host file inventories into a matrix of keyword vectors in Euclidean space. In further embodiments, calculating the input data includes transforming the host file inventories into a similarity matrix.

Claims

1. A computer implemented method, executed by one or more processors comprising:

obtaining a plurality of host file inventories corresponding respectively to a plurality of hosts in a network environment, wherein each of the plurality of host file inventories includes one or more file identifiers, each of the file identifiers of a particular host file inventory representing a different executable file on one of the plurality of hosts corresponding to the particular host file inventory;

calculating input data by transforming the plurality of host file inventories into a matrix of keyword vectors in Euclidean space based on a keyword sequence, wherein each keyword of the keyword sequence is unique, wherein each one of the plurality of hosts corresponds to one of the keyword vectors; and

providing the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts, wherein the one or more clusters of hosts are grouped using a predetermined similarity criteria.

2. The method of claim 1, wherein each of the one or more file identifiers in the plurality of host file inventories includes a token sequence of one or more tokens.

3. The method of claim 2, further comprising:

receiving input from a user selecting a number of tokens for the token sequence and selecting a configuration for each of the tokens.

4. The method of claim 2, wherein the token sequence includes a first token and a configuration for the first token is a checksum of an executable file.

5. The method of claim 2, wherein the token sequence includes a first token and a second token, wherein a first configuration for the first token is a checksum of an executable file and a second configuration for the second token is a file path of the executable file.

6. The method of claim 2, further comprising:

determining the keyword sequence, wherein each keyword of the keyword sequence is unique with respect to other keywords in the keyword sequence.

7. The method of claim 6, wherein a first keyword of the keyword sequence is equivalent to a first token of at least one of the one or more file identifiers of the plurality of host file inventories.

8. The method of claim 7, wherein a second keyword of the keyword sequence is equivalent to another first token of at least one of the one or more other file identifiers of the plurality of host file inventories, wherein the first token and the other first token are not equivalent.

9. The method of claim 7, wherein a third keyword of the keyword sequence is equivalent to a second token of at least one of the one or more file identifiers of the plurality of host file inventories.

10. The method of claim 1, wherein a first one of the keyword vectors includes a plurality of values, each value indicating whether one of the keywords in the keyword sequence is included in a first one of the plurality of host file inventories.

11. The method of claim 1, wherein a first one of the keyword vectors includes a plurality of values, each value corresponding to a frequency of occurrence of one of the keywords in a first one of the plurality of host file inventories.

12. The method of claim 1, further comprising:

generating information indicating the one or more clusters of hosts, wherein each of the one or more clusters includes at least one host.

13. The method of claim 12, wherein the information is a proximity plot.

14. The method of claim 1, wherein the clustering procedure is an agglomerative hierarchical clustering technique with the predetermined similarity criteria including a cut point determination to define a stopping point of the clustering procedure.

15. The method of claim 1, wherein the clustering procedure is a partitional clustering technique.

16. Logic encoded in one or more non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

obtaining a plurality of host file inventories corresponding respectively to a plurality of hosts in a network environment, wherein each of the plurality of host file inventories includes one or more file identifiers, each of the file identifiers of a particular host file inventory representing a different executable file on one of the plurality of hosts corresponding to the particular host file inventory;

calculating input data by transforming the plurality of host file inventories into a matrix of keyword vectors in Euclidean space based on a keyword sequence, wherein each keyword of the keyword sequence is unique, wherein each one of the plurality of hosts corresponds to one of the keyword vectors; and

providing the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts, wherein the one or more clusters of hosts are grouped using a predetermined similarity criteria.

17. The logic of claim 16, wherein each of the one or more file identifiers in the plurality of host file inventories includes a token sequence of one or more tokens.

18. The logic of claim 16, the processor being operable to perform further operations comprising:

determining the keyword sequence, wherein each keyword of the keyword sequence is unique with respect to other keywords in the keyword sequence, wherein a first one of the keyword vectors includes a plurality of values, each value indicating whether one of the keywords in the keyword sequence is included in a first one of the plurality of host file inventories.

19. An apparatus, comprising:

a host inventory preparation module;

a processor operable to execute instructions associated with the host inventory preparation module, including;

obtaining a plurality of host file inventories corresponding respectively to a plurality of hosts in a network environment, wherein each of the plurality of host file inventories includes one or more file identifiers, each of the file identifiers of a particular host file inventory representing a different executable file on one of the plurality of hosts corresponding to the particular host file inventory;

calculating input data by transforming the plurality of host file inventories into a matrix of keyword vectors in Euclidean space based on a keyword sequence, wherein each keyword of the keyword sequence is unique, wherein each one of the plurality of hosts corresponds to one of the keyword vectors; and

providing the input data to a clustering procedure to group the plurality of hosts into one or more clusters of hosts, wherein the one or more clusters of hosts are grouped using a predetermined similarity criteria.

20. The apparatus of claim 19, wherein each of the one or more file identifiers in the plurality of host file inventories includes a token sequence of one or more tokens.

21. The apparatus of claim 19, wherein the processor is operable to perform further instructions, comprising:

determining the keyword sequence, wherein each keyword of the keyword sequence is unique with respect to other keywords in the keyword sequence, wherein a first one of the keyword vectors includes a plurality of values, each value indicating whether one of the keywords in the keyword sequence is included in a first one of the plurality of host file inventories.