Systems and methods for behavioral link prediction for network access microsegmentation policy

Abstract

Described herein are systems and methods for grouping computing devices in a computing network and predicting future communications links between computing devices for the purpose of developing a computing network microsegmentation policy. In one or more examples, the systems and methods described herein can predict future links in a computing network using a plurality of combinations of node similarity, node grouping, and link prediction methods. Each unique combination of methods can be assessed by comparing the predicted links to observed network traffic to determine the quality of the prediction. The quality of prediction can be assessed by generate F1 curves for each combination of methods. The combination with the highest quality prediction can then be selected and tuned (by adjusting a threshold associated with the combination). Once tuned, the selected combination (i.e., model) can then be used generate and/or modify a microsegmentation policy associated with the computing network.