CPC G06N 5/04 (2013.01) [G06N 20/00 (2019.01); H04L 63/0227 (2013.01); H04L 63/102 (2013.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01)] | 20 Claims |
1. A method comprising:
accessing network traffic from a network, wherein the network traffic is associated with a plurality of entities;
selecting an entity of the plurality of entities;
determining one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
accessing a first model associated with a first level of granularity;
determining, by a processing device, a first classification result of the entity based on the first model;
accessing a second model associated with a second level of granularity, wherein the second level of granularity is higher than the first level of granularity and wherein the second model is accessed based on the first classification result;
determining, by the processing device, a second classification result of the entity based on the second model; and
storing at least one of the first classification result or the second classification result.
|