Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies

Abstract

A network analysis tool evaluates network flow information in complementary workflows to identify one-hop behavior of network assets and also identify multi-hop dependencies between network assets. In one workflow (e.g., using association rule learning), the network analysis tool can identify significant one-hop communication patterns to and/or from network assets, taken individually. Based on the identified one-hop behavior, the network analysis tool can discover patterns of similar communication among different network assets, which can inform decisions about deploying patch sets, mitigating damage, configuring a system, or detecting anomalous behavior. In a different workflow (e.g., using deep learning or cross-correlation analysis), the network analysis tool can identify significant multi-hop communication patterns that involve network assets in combination. Based on the identified multi-hop dependencies, the network analysis tool can discover functional relationships between network assets, which can inform decisions about configuring a system, managing critical network assets, or protecting critical network assets.