企业网安全的微分段无监督学习
Unsupervised Learning for security of Enterprise networks by micro-segmentation
摘要：
微分段是一种网络安全技术，需要为每个唯一的分段提供服务。要做到这一点，第一步是定义这些唯一的段（也称为安全组），然后初始化策略驱动的安全控制。在本文中，我们提出了一个无监督学习技术，涵盖了安全分组和策略创建。对于网络资产分组，我们开发了一个基于距离的机器学习算法，利用资产的动态行为。也就是说，在观察整个网络日志之后，我们的无监督学习算法建议将网络资产划分为组。这种无监督技术的一个关键点是，分组只在训练阶段生成，在测试阶段仍然有效。分组阶段的结果然后被馈送到规则（安全策略）创建阶段，使得能够将安全组建立为防火墙规则的最低粒度。我们进行了定量和定性实验，并证明了我们的网络细分方法的良好性能。我们进一步开发了一个原型，以验证我们的方法在现实世界的环境中规模的运行时性能。我们的方法的超参数为用户提供了一个灵活的模型，可以进行微调，以非常容易地适应企业的安全治理。
英文摘要：
Micro-segmentation is a network security technique that requires delivering services for each unique segment. To do so, the first stage is defining these unique segments (a.k.a security groups) and then initializing policy-driven security controls. In this paper, we propose an unsupervised learning technique that covers both the security grouping and policy creation. For the network asset grouping, we develop a distance-based machine learning algorithm using the dynamic behavior of the assets. That is, after observing the entire network logs, our unsupervised learning algorithm suggests partitioning network assets into the groups. A key point of this un-supervised technique is that the grouping is only generated during the training phase and remains valid during the testing phase. The outcome of the grouping stage is then fed into the rules (security policies) creation stage enabling to establish the security groups as the lowest granularity of firewall rules. We conducted both quantitative and qualitative experiments and demonstrate the good performance of our network micro-segmentation approach. We further developed a prototype to validate the run-time performance of our approach at scale in a real-world environment. The hyper-parameters of our approach provides users with a flexible model to be fine-tuned to adapt very easily with the enterprise's security governance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
