Untitled

Abstract

Modern networks keep growing in complexity and are rather dynamic by nature. On the other hand, due to legal requirements on information security, appropriate protective measures must be identified, implemented, sustained, enforced, and documented. To this end, network administrators are confronted with the effortful task of gaining an overview over their network, dividing the communicating devices into meaningful groups, and tracking changes. Hitherto existing research approaches usually suffer from a lack of readily available and used domain knowledge, fail to obtain acceptance of the derived device classes from the users or require either active network scans or agents running on managed devices. In our approach, this classification shall be guided by the pre-specified technical and infrastructural aspects of a methodology for information security management systems, namely the modules of the German IT Baseline Protection, and achieved by passive observation of the network traffic. This paves the way to a continuous control over the network.