Automated network supervision including detecting an anonymously administered node, identifying the administrator of the anonymously administered node, and registering the administrator and the anonymously administered node

According to one implementation, a network supervision system includes one or more computing platform(s) coupled to multiple nodes of a network including the computing platform(s), the computing platform(s) including a hardware processor and a system memory storing a network participant supervising software code and a network participant registry. The hardware processor executes the network participant supervising software code to detect an anonymously administered node of the network, aggregate system log files of the anonymously administered node, and perform an analysis of the system log files using an unsupervised machine learning algorithm to identify an administrator of the anonymously administered node. The hardware processor further executes the network participant supervising software code to generate a registration record associating the administrator with the anonymously administered node, and update the network participant registry using the registration record.

BACKGROUND

A large organization, such as a government entity, large corporation, or university, for example may utilize a communication network having thousands or hundreds of thousands of technology nodes. Each of those nodes may correspond to a technology device, such as a personal communication device or client computer system, for example, or to a software application used across the network. In such a la use environment, identification of the owner or administrator of each technology device and software application can be important for effective management of the network.

Conventional solutions for managing an organizational network tend to rely on pre-registration of network device or application owners and administrators, or seek to identify a network connected device or application directly. The process for identifying a technology device or application according to the conventional approach often includes a relatively costly and inconvenient manual investigation to identify its owner or administrator.

SUMMARY

There are provided automated network supervision systems and methods for use by such systems, substantially as shown in and/or described in connection with at least one of the figures, and as set forth more completely in the claims.

DETAILED DESCRIPTION

As stated above, a large organization, such as a government entity, large corporation, or university, for example may utilize a communication network having thousands or hundreds of thousands of technology nodes. Each of those nodes may correspond to a technology device, such as a personal communication device or client computer system, for example, or to a software application used across the network. In such a use environment, identification of the owner or administrator of each technology device and software application can be important for effective management of the network.

As also stated above, conventional solutions for managing an organizational network tend to rely on pre-registration of network device or application owners and administrators, or seek to identify a network connected device or application directly. The process for identifying a technology device or application according to the conventional approach often includes a relatively costly and inconvenient manual investigation to identify its owner or administrator.

The present application discloses a network supervision solution that overcomes the drawbacks and deficiencies in the conventional art. The present network supervision solution is an automated solution that detects an anonymously administered node of a supervised network and aggregates system log files of the anonymously administered node. By performing an analysis of the system log files using an unsupervised machine learning algorithm, the present solution advantageously enables identification of the administrator of the previously anonymously administered network node without requiring a manual investigation. The present network supervision solution then generates a registration record associating the administrator with the previously anonymously administered node and automatically updates a network participant registry using the registration record. The disclosed solution herein is able to identify anonymously administered nodes on the network, and use unsupervised learning, based on the logs, to identify the administer.

FIG. 1shows a diagram of an exemplary automated network supervision system, according to one implementation. As shown inFIG. 1, network supervision system100includes computing platform102having hardware processor104, and system memory106implemented as a non-transitory storage device. According to the present exemplary implementation, system memory106stores network participant supervising software code110and network participant registry120.

As further shown inFIG. 1, network supervision system100is implemented within a use environment including network130having network communication links132, known network nodes134aand134b, and anonymously administered node136, as well as user device150including display158. It is noted that computing platform102of network supervision system100and user device150may be other known network nodes of network130. Also shown inFIG. 1are user140of user device150, detection data142, system log files138of anonymously administered node136, and registration record112for anonymously administered node136produced using network participant supervising software code110.

It is noted that althoughFIG. 1depicts network participant supervising software code110as being stored in its entirety in memory106, that representation is merely provided as an aid to conceptual clarity. More generally, network supervision system100may include one or more computing platforms corresponding to computing platform102, such as computer servers for example, which may be co-located, or may form an interactively linked but distributed system, such as a cloud based system, for instance.

As a result, hardware processor104and system memory106may correspond to distributed processor and memory resources within network supervision system100. Thus, it is to be understood that various portions of network participant supervising software code110, such as one or more of the modules described below by reference toFIG. 4, may be stored and/or executed using the distributed memory and/or processor resources of network supervision system100.

In some implementations, computing platform102of network supervision system100may correspond to one or more web servers, accessible over a packet-switched network such as the Internet, for example. Alternatively, computing platform102of network supervision system100may correspond to one or more computer servers supporting a local area network (LAN), or included in another type of private communication network. That is to say, in some implementations, network130may be a private network.

Known network nodes134aand134b, and anonymously administered node136may correspond to client systems of network130. Examples of such client systems include a variety of hardware including computer work stations, portable computing devices, mobile communication devices, switches, routers, repeaters, and the like. Alternatively, or in addition, one or more of known network nodes134aand134b, and/or anonymously administered node136take the form of a network interface of a software application utilized on network130.

Although user device150is shown as a desktop computer inFIG. 1, that representation is also provided merely as an example. More generally, user device150may be any suitable mobile or stationary computing device or system that implements data processing capabilities sufficient to provide a user interface, support connections to network130, and implement the functionality ascribed to user device150herein. For example, in other implementations, user device150may take the form of a laptop computer, tablet computer, or smartphone, for example.

User140, who may be a security officer or administrator of network130, for example, may utilize user device150to interact with network supervision system100. In some implementations, for example, user140may provide detection data142for facilitating detection of the presence of anonymously administered node136on network130by network participant supervising software code110.

It is noted that, in various implementations, registration record112for anonymously administered node136, when generated using network participant supervising software code110, may be stored in network participation registry120and/or may be copied to non-volatile storage (not shown inFIG. 1). Alternatively, or in addition, as shown inFIG. 1, in some implementations, registration record112for anonymously administered node136may be sent to user device150for storage, and or display to user140by display158. It is further noted that display158may take the form of a liquid crystal display (LCD), a light-emitting diode (LED) display, an organic light-emitting diode (OLED) display, or another suitable display screen that performs a physical transformation of signals to light.

FIG. 2shows exemplary system250and computer-readable non-transitory medium222including instructions for performing automated network supervision, according to one implementation. System250includes computing platform252having hardware processor254and system memory256, interactively linked to display258. Display258may take the form of an LCD, LED display, an OLED display, or another suitable display screen that performs a physical transformation of signals to light. System250including computing platform252having hardware processor254and system memory256corresponds in general to network supervision system100including computing platform102having hardware processor104and system memory106, inFIG. 1. Consequently, system250may share any of the characteristics attributed to corresponding network supervision system100by the present disclosure.

Also shown inFIG. 2is computer-readable non-transitory medium222having network participant supervising software code210stored thereon. The expression “computer-readable non-transitory medium,” as used in the present application, refers to any medium, excluding a carrier wave or other transitory signal, that provides instructions to hardware processor254of computing platform252. Thus, a computer-readable non-transitory medium may correspond to various types of media, such as volatile media and non-volatile media, for example. Volatile media may include dynamic memory, such as dynamic random access memory (dynamic RAM), while non-volatile memory may include optical, magnetic, or electrostatic storage devices. Common forms of computer-readable non-transitory media include, for example, optical discs, RAM, programmable read-only memory (PROM), erasable PROM (EPROM), and FLASH memory.

According to the implementation shown inFIG. 2, computer-readable non-transitory medium222provides network participant supervising software code210for execution by hardware processor254of computing platform252. Network participant supervising software code210corresponds in general to network participant supervising software code110, inFIG. 1, and is capable of performing all of the operations attributed to that corresponding feature by the present disclosure.

The functionality of network participant supervising software code110/210will be further described by reference toFIG. 3in combination withFIGS. 1, 2, and4.FIG. 3shows flowchart360presenting an exemplary method for use by a system, such as network supervision system100, inFIG. 1, or system250, inFIG. 2, for performing automated network supervision. With respect to the method outlined inFIG. 3, it is noted that certain details and features have been left out of flowchart360in order not to obscure the discussion of the inventive features in the present application.

FIG. 4shows exemplary network participant supervising software code410suitable for execution by hardware processor104/254of the respective systems shown byFIGS. 1 and 2, according to one implementation. As shown inFIG. 4, network participant supervising software code410may include network mapping module482, system log file aggregation module484, analysis module486, and registration module488. Also shown inFIG. 4are detection data442, system log files438including individual system log files472aand472b, aggregated system log file data474, identification data476identifying the administrator of anonymously administered node136, and registration record412for anonymously administered node136.

Detection data442, system log files438, and registration record412correspond respectively in general to detection data142, system log files138, and registration record112, inFIG. 1, and may share any of the characteristics attributed to those corresponding features by the present disclosure. Moreover, network participant supervising software code410corresponds in general to network participant supervising software code110/210, inFIGS. 1 and 2, and those corresponding features may share the characteristics attributed to any corresponding feature by the present disclosure. Thus, like network participant supervising software code410, network participant supervising software code110/210may include modules corresponding to network mapping module482, system log file aggregation module484, analysis module486, and registration module488.

Referring now toFIG. 3in combination withFIGS. 1, 2, and 4, flowchart360begins with detecting anonymously administered node136of network130(action361). Anonymously administered node136of network130may be detected by network participant supervising software code110/210/410of network supervision system100, executed by hardware processor104/254.

Anonymously administered node136of network130may be detected by network supervision system100in a number of ways. In some implementations, detection of anonymously administered node136may be performed as an automated process by network supervision system100. For example, in those implementations, network supervision system100may automatically poll or probe network130for the presence of anonymously administered node136. In one such implementation, for example, network participant supervising software code110/210/410, executed by hardware processor104/254may utilize network mapping module482to compare anonymously administered node136with registration records for known network nodes stored in network participant registry120.

Alternatively, or in addition, network supervision system100may detect anonymously administered node136based on detection data142/442received from user140. As noted above, user140may be a security officer or administrator of network130and may detect the presence of anonymously administered node136in the course performing network maintenance or supervision. Detection data142/442may be received by network mapping module482of network participant supervising software code110/210/410and may be used to reference registration records stored in network participant registry. For example, network mapping module482may be used by network participant supervising software code110/210/410to reference network participation registry to identify the administrator of anonymously administered network node136, or to confirm that the administrator of anonymously administered node136is presently unknown.

Flowchart360continues with aggregating system log files138/438of anonymously administered node136(action362). System log files138/438may include any data typically stored as system log data, as known in the art. For example, system log files138/438may comply with the RFC5424 Syslog protocol, which is hereby incorporated fully by reference into the present application.

Aggregation of system log files138/438of anonymously administered node136may be performed by network participant supervising software code110/210/410, executed by hardware processor104/254, and using system log aggregation module484. The aggregation of system log files138/438by system log aggregation module484of participant supervising software code110/210/410may be performed via communication network130. In one implementation, the aggregation of system log files138/438may include receiving system log files138/438in one or more data dump(s) obtained from anonymously administered node136. However, in other implementations, the aggregation of system log files138/438may be a gradual process in which system log aggregation module484of participant supervising software code110/210/410collects system log files138/438from anonymously administered node136over time.

Flowchart360continues with performing an analysis of system log files138/438using an unsupervised machine learning algorithm (action363). As shown inFIG. 4, in one implementation, network participant supervising software code110/210/410, executed by hardware processor104/254, may utilize analysis module486to analyze system log files138/438based on aggregated system log file data474received from system log aggregation module484.

Analysis module486may execute one or more unsupervised machine learning algorithms to perform the analysis based on aggregated system log file data484. For example, in one implementation, analysis module486of network participant supervising software code110/210/410may rely on one of cluster analysis, or application of a radial basis function network for the analysis of aggregated system log file data474. Alternatively, or in addition, analysis module486of network participant supervising software code110/210/410may utilize an expectation-maximization (EM) algorithm, either alone, or in combination with a generative topographic map (GTM) to analyze aggregated system log file data474. It is noted that cluster analysis, application of a radial basis function network, the EM algorithm and GTM are merely a few exemplary unsupervised machine learning techniques suitable for use by analysis module486of network participant supervising software code110/210/410.

Flowchart360continues with identifying the administrator of anonymously administered node136based on the analysis performed in action363(action364). Identification of the administrator of anonymously administered node136may be performed by network participant supervising software code110/210/410, executed by hardware processor104/254, and also using analysis module486.

The analysis of aggregated system log file data474performed in action463may reveal characteristics of anonymously administered node136that are shared in common with other known network nodes of network130, such as one or more of known network nodes134aand134b. For example, analysis of aggregated system log file data474may reveal that anonymously administered node136routinely runs a software application that is also run by other known network nodes administered by a single organization, such as a corporate subdivision or subsidiary. Alternatively, or in addition, analysis of aggregated system log file data474may reveal that anonymously administered node136is consistently accessed by a user who logs on to anonymously administered system node136with a user identification (user ID) or department ID that can be identified, for example, by reference to network participant registry120.

Thus, in various implementations, the administrator of anonymously administered network node136may be identified as one of a specific organization having control over anonymously administered node136, a department within the organization, or an individual person using anonymously administered network node136. Identification of the administrator of anonymously administered network node136in action364results in generation of identification data476by analysis module486of network participant supervising software code110/210/410. As shown inFIG. 4, identification data476is provided as an output by analysis module486to update network mapping module482, as well as for use by registration module488.

Flowchart360continues with generating registration record112/412associating the administrator identified in action364with anonymously administered node136(action365). Registration record112/412may include substantially all data required to produce or update an entry in network participant registry120. For example, registration record112/412may include a network address of anonymously administered network node136on network130, and data and/or resource accessing rights and constraints of anonymously administered network node136, as well as identifying the administrator of anonymously administered network node136. Generation of registration record112/412may be performed by network participant supervising software code110/210/410, executed by hardware processor104/254, and using registration module488.

Flowchart360can conclude with updating network participant registry120using registration record112/412(action366). Updating of network participant registry120using registration record112/412may be performed by network participant supervising software code110/210/410, executed by hardware processor104/254. In addition to its use for updating network participant registry120, in some implementations, registration record112/412for anonymously administered node136may be sent to user device150or system250for storage, and or display to user140by display158/258.

As a result of actions361,362,363,364,365, and366(hereinafter “actions361-366”), which may be performed in an automated process by network supervision system100, the administrator of anonymously administered node136is identified and included in network participant registry120. Consequently, anonymously administered network node136advantageously becomes another known network node of network130. Actions361-366may be repeated in each instance in which an anonymously administered node of network130is detected, thereby advantageously providing a robust automated network supervision solution.

Thus, the present application discloses an automated network supervision solution. The present network supervision solution detects an anonymously administered node of a supervised network and aggregates system log files of the anonymously administered node. By performing an analysis of the system log files using an unsupervised machine learning algorithm, the present solution advantageously enables identification of the administrator of the previously anonymously administered network node without requiring a manual investigation. The present network supervision solution then generates a registration record associating the administrator with the previously anonymously administered node and automatically updates a network participant registry using the registration record.