{"id":"https://openalex.org/W1836055303","doi":"https://doi.org/10.48550/arxiv.2603.09910","title":"Role Classification of Hosts within Enterprise Networks Based on Connection Patterns","display_name":"Role Classification of Hosts within Enterprise Networks Based on Connection Patterns","publication_year":2026,"publication_date":"2026-03-10","ids":{"openalex":"https://openalex.org/W1836055303","doi":"https://doi.org/10.48550/arxiv.2603.09910","mag":"1836055303"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2603.09910","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.09910","pdf_url":"https://arxiv.org/pdf/2603.09910","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"article","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2603.09910","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054153952","display_name":"Godfrey Tan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210109586","display_name":"Moscow Institute of Thermal Technology","ror":"https://ror.org/021es5e59","country_code":"RU","type":"facility","lineage":["https://openalex.org/I4210109586"]}],"countries":["RU"],"is_corresponding":true,"raw_author_name":"Tan, Godfrey","raw_affiliation_strings":["-MIT"],"affiliations":[{"raw_affiliation_string":"-MIT","institution_ids":["https://openalex.org/I4210109586"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027593529","display_name":"Massimiliano Poletto","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Poletto, Massimiliano","raw_affiliation_strings":["Mazu Networks#TAB#"],"affiliations":[{"raw_affiliation_string":"Mazu Networks#TAB#","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007282049","display_name":"John V. Guttag","orcid":"https://orcid.org/0000-0003-0992-0906"},"institutions":[{"id":"https://openalex.org/I4210109586","display_name":"Moscow Institute of Thermal Technology","ror":"https://ror.org/021es5e59","country_code":"RU","type":"facility","lineage":["https://openalex.org/I4210109586"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Guttag, John","raw_affiliation_strings":["-MIT"],"affiliations":[{"raw_affiliation_string":"-MIT","institution_ids":["https://openalex.org/I4210109586"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5110236312","display_name":"Frans Kaashoek","orcid":null},"institutions":[{"id":"https://openalex.org/I4210109586","display_name":"Moscow Institute of Thermal Technology","ror":"https://ror.org/021es5e59","country_code":"RU","type":"facility","lineage":["https://openalex.org/I4210109586"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Kaashoek, Frans","raw_affiliation_strings":["-MIT"],"affiliations":[{"raw_affiliation_string":"-MIT","institution_ids":["https://openalex.org/I4210109586"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5054153952"],"corresponding_institution_ids":["https://openalex.org/I4210109586"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":37,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2","last_page":"2"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7851979732513428},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5504865646362305},{"id":"https://openalex.org/keywords/enterprise-private-network","display_name":"Enterprise private network","score":0.5237541198730469},{"id":"https://openalex.org/keywords/connection","display_name":"Connection (principal bundle)","score":0.5073475241661072},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3956432640552521},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.3877086937427521},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.33475783467292786},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.2998873293399811}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7851979732513428},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5504865646362305},{"id":"https://openalex.org/C149859251","wikidata":"https://www.wikidata.org/wiki/Q483426","display_name":"Enterprise private network","level":2,"score":0.5237541198730469},{"id":"https://openalex.org/C13355873","wikidata":"https://www.wikidata.org/wiki/Q2920850","display_name":"Connection (principal bundle)","level":2,"score":0.5073475241661072},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3956432640552521},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3877086937427521},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33475783467292786},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2998873293399811},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C66938386","wikidata":"https://www.wikidata.org/wiki/Q633538","display_name":"Structural engineering","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"pmh:oai:arXiv.org:2603.09910","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.09910","pdf_url":"https://arxiv.org/pdf/2603.09910","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.150.2097","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.150.2097","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.usenix.org/publications/library/proceedings/usenix03/tech/full_papers/tan/tan.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.57.6218","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.57.6218","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://nms.lcs.mit.edu/papers/role-usenix03.ps","raw_type":"text"},{"id":"doi:10.48550/arxiv.2603.09910","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.09910","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"},{"id":"mag:1836055303","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2603.09910","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.09910","pdf_url":"https://arxiv.org/pdf/2603.09910","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W1836055303.pdf","grobid_xml":"https://content.openalex.org/works/W1836055303.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W21741679","https://openalex.org/W61646295","https://openalex.org/W183501384","https://openalex.org/W1513400187","https://openalex.org/W1560139805","https://openalex.org/W1678529581","https://openalex.org/W1790126211","https://openalex.org/W1992419399","https://openalex.org/W1994584977","https://openalex.org/W2010365467","https://openalex.org/W2059942088","https://openalex.org/W2119836184","https://openalex.org/W2120683899","https://openalex.org/W2123274874","https://openalex.org/W2129066856","https://openalex.org/W2150847526","https://openalex.org/W2273619558","https://openalex.org/W2752885492","https://openalex.org/W2913066018","https://openalex.org/W3105682467"],"related_works":["https://openalex.org/W1567483855","https://openalex.org/W2130598205","https://openalex.org/W2122226347","https://openalex.org/W2121973001","https://openalex.org/W172040345","https://openalex.org/W2136695760","https://openalex.org/W2133473417","https://openalex.org/W2119895316","https://openalex.org/W2102399005","https://openalex.org/W2011628134","https://openalex.org/W2164210932","https://openalex.org/W2152112690","https://openalex.org/W2148346742","https://openalex.org/W2130797543","https://openalex.org/W2103662262","https://openalex.org/W2096118443","https://openalex.org/W1997299558","https://openalex.org/W1973515534","https://openalex.org/W1744212210","https://openalex.org/W1559810148"],"abstract_inverted_index":{"Role":[0],"classification":[1,50],"involves":[2],"grouping":[3,92],"hosts":[4,59,117,125],"into":[5],"related":[6],"roles.":[7],"It":[8],"exposes":[9],"the":[10,33,48,98,114,120,128,132],"logical":[11,129],"structure":[12,130],"of":[13,35,100,110,116,131],"a":[14,80],"network,":[15],"simplifies":[16],"network":[17,25,36,82],"management":[18],"tasks":[19],"such":[20,41],"as":[21,42],"policy":[22],"checking":[23],"and":[24,27,38,52,84,118],"segmentation,":[26],"can":[28,106],"be":[29,107],"used":[30],"to":[31],"improve":[32],"accuracy":[34],"monitoring":[37,83],"analysis":[39,85],"algorithms":[40,56,75,105,123],"intrusion":[43],"detection.":[44],"This":[45],"paper":[46],"defines":[47],"role":[49],"problem":[51],"introduces":[53],"two":[54,93,108],"practical":[55],"that":[57,97,119],"group":[58,124],"based":[60],"on":[61],"observed":[62],"connection":[63],"patterns":[64,71],"while":[65],"dealing":[66],"with":[67],"changes":[68],"in":[69,79],"these":[70],"over":[72],"time.":[73],"The":[74],"have":[76],"been":[77],"implemented":[78],"commercial":[81],"product":[86],"for":[87],"enterprise":[88,94],"networks.":[89,133],"Results":[90],"from":[91],"networks":[95],"show":[96],"number":[99,115],"groups":[101],"identified":[102],"by":[103],"our":[104,122],"orders":[109],"magnitude":[111],"smaller":[112],"than":[113],"way":[121],"highly":[126],"reflects":[127]},"counts_by_year":[{"year":2022,"cited_by_count":1},{"year":2019,"cited_by_count":2},{"year":2016,"cited_by_count":2},{"year":2014,"cited_by_count":4},{"year":2013,"cited_by_count":4},{"year":2012,"cited_by_count":3}],"updated_date":"2026-03-13T14:20:09.374765","created_date":"2016-06-24T00:00:00"}