Cisco products enable the customers to assign hosts in their network to Host Groups. The Host Groups are also visible in network traffic and influence the resulting risk presented to a customer. A challenge is to assess the coherency of the behaviors of the hosts assigned to the same Host Group so that it is possible to identify hosts that are, for example, assigned to the wrong Host Group. Moreover, the exploration of the host behaviors from the Host Groups' point of view will enable us to gain an initial insight into whether the Host Group information can be further used for the development of other classifiers. The student will

• execute explanatory data analysis of telemetry with respect to Host Groups
• identify behavior-based Host Groups in data from a selected customer, and determine the coherency of the Host Groups by calculating the overlap of the identified behavior-based Host Groups with the existing Host Groups,
• explore whether it is possible to develop a classifier that assigns a host to an existing Host Group based on its behavior,
• evaluate the developed classifier and compare it with the previous approach

The thesis will be done in close collaboration with Cisco Systems a.s. Cisco's data sources will be used in the thesis.