Smart SDN for intrusion detection

Abstract

A method, a computer system, and a computer program product for an intelligent SDN are provided. The invention may include recording and clustering behaviors of the pod to generate a behavior transition model of the pod. The invention may include observing the behavior of the pod and comparing the behavior to the generated behavior transition model. The present invention may include triggering a network policy change based on determining that the behavior of the pod is an inappropriate behavior.

Description

Background Art

[0001] The present invention relates generally to the field of computing, and more particularly to software defined networking (SDN).

[0002] To protect enterprise computer networks from intrusion, network security experts may recommend micro-segmentation of the network and develop network policies to protect communications between segments. This may require network administrators to understand the behavior of each node in the network in order to best segment them and adequately define the policies between them. Summary of the invention

[0003] Embodiments of the present invention disclose a method, computer system, and computer program product for intelligent SDN. The present invention may include recording and clustering the behavior of a pod to generate a behavior transition model of the pod. The present invention may include observing the behavior of the pod and comparing the behavior with the generated behavior transition model. The present invention may include triggering a network policy change based on determining that the behavior of the pod is inappropriate behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Preferred embodiments of the present invention will now be described, by way of example only, with reference to the following drawings:

[0005] Figure 1 illustrates a networked computer environment according to at least one embodiment;

[0006] Figure 2 is an operational flow chart illustrating a process for intelligent intrusion prevention according to at least one embodiment;

[0007] Figure 3 is an exemplary embodiment of micro-segmentation according to at least one embodiment;

[0008] Figure 4 is an exemplary embodiment of an enterprise network including a plurality of pods according to at least one embodiment;

[0009] Figure 5 is an exemplary embodiment of a state diagram describing service behavior and misbehavior according to at least one embodiment;

[0010] Figure 6 According to at least one embodiment Figure 1 A block diagram of the internal and external components of a computer and server depicted in;

[0011] Figure 7 According to an embodiment of the present disclosure, Figure 1 A block diagram of an illustrative cloud computing environment of a computer system depicted in; and

[0012] Figure 8 According to the embodiment of the present disclosure Figure 7 A block diagram of the functional layers of an illustrative cloud computing environment.

[0013] The various features of the drawings are not to scale, as they are illustrated for the sake of clarity in order to assist those skilled in the art in understanding the invention in conjunction with the detailed description. DETAILED DESCRIPTION

[0014] Detailed embodiments of the claimed structures and methods are disclosed herein; however, it is understood that the disclosed embodiments are merely illustrative of the claimed structures and methods that may be implemented in various forms. However, the present invention may be implemented in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided to make this disclosure thorough and complete and to fully convey the scope of the invention to those skilled in the art. In the description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments.

[0015] The present invention may be a system, method and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, and the computer-readable program instructions are used to cause a processor to perform various aspects of the present invention.

[0016] Computer readable storage medium can be a tangible device capable of retaining and storing instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage medium includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a convex structure in a groove with instructions recorded thereon, and any suitable combination of the foregoing. Computer readable storage medium as used herein should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0017] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network, or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network, and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0018] The computer-readable program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, in order to perform various aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute a computer-readable program instruction by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0019] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0020] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0021] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0022] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent the module, segment or part of instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frames in each frame of the block diagram and / or flow chart illustration and the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0023] The exemplary embodiments described below provide a system, method, and program product for intelligent SDN. Therefore, the present embodiment has the ability to improve the technical field of software-defined networks by creating a pod-specific dynamic firewall based on observed pod (e.g., the smallest deployable unit of computing) behavior. More specifically, a preferred embodiment of the present invention may include recording and clustering the behavior of the pod to generate a behavior transition model of the pod. A preferred embodiment of the present invention may include observing the behavior of the pod and comparing the behavior with the generated behavior transition model. A preferred embodiment of the present invention may include triggering a network policy change based on determining that the behavior of the pod is inappropriate behavior.

[0024] As mentioned earlier, to protect an enterprise computer network from intrusion, network security experts may recommend micro-segmenting the network and developing network policies to protect communications between segments. This may require network administrators to understand the behavior of each node in the network in order to best segment them and adequately define policies between them. However, it is almost impossible for network administrators to understand the behavior of each node in the network.

[0025] Therefore, during a service node go-live event, (Kubernetes is a registered trademark of the Linux Foundation in the United States and / or other countries) environment to capture the behavior of the node or the behavior of the pod, and by utilizing a clustering algorithm to map out the behavior or state transition model of the node, it may be advantageous. In order to map out the behavior of the node, a preferred embodiment of the present invention may prepare a list of vectors, run a k-means clustering algorithm and utilize the Calinski Harabsz score. This may enable the creation of micro-segments around each service node, where the micro-segments are segments with rules that prohibit unknown behaviors (e.g., network traffic out of state or error transitions, which can be identified based on behaviors learned from previously identified behaviors of the node). Then, an artificial intelligence (AI) model may be used to predict the current state of the node. The AI ​​model may be a model that predicts the class and / or state to which a specific data set belongs. By comparing the predicted state with the learned behavior transition model, a new network policy can be deployed to block any suspicious communication (e.g., malicious intruders, network attackers). While traditional solutions may only support hard-constrained nodes to communicate with predefined other nodes, the present invention can implement communication constraints between nodes based on the behavior of the node during runtime.

[0026] According to at least one embodiment, the present invention may be implemented in a software defined network with micro-segmentation. A software defined network may enable the use of software applications to control or program a computer network. Such control may include management and administrative capabilities of components of the computer network and data flows. A software defined network may consist of multiple layers, including an application layer, a control layer, and an infrastructure layer, wherein the application layer may contain the organization's network applications, the control layer may be a centralized software defined network (SDN) controller that may act as an intelligent SDN, and the infrastructure layer may include the physical infrastructure of the network, including switches that forward network traffic to its destination. In a software defined network, an SDN controller may be a logical centralized entity that manages data flows on a network.

[0027] According to at least one embodiment, the present invention may be installed as an add-on component within an enterprise network.

[0028] In a software-defined network with micro-segmentation, network administrators or information technology (IT) professionals can tailor security settings for different types of traffic, creating policies that may restrict network and application flows between workloads that might not be explicitly allowed. By applying segmentation rules down to workloads or applications, IT professionals can reduce the risk of cyber attackers moving from one compromised workload or application to another, thereby reducing the network attack surface. Segmentation rules can also improve operational efficiency because access control lists, routing rules, and firewall policies are often unwieldy and introduce a lot of management overhead, making policies difficult to scale in a rapidly changing environment.

[0029] According to at least one embodiment, the present invention can prevent malicious traffic (e.g., intrusion by a network attacker) from moving freely within a cloud environment. This may have advantages based on the rise of ransomware and network attackers who attempt to blackmail enterprises by locking files. Although entering the network may be difficult at first, when a network attacker breaks into an enterprise or company intranet, the network attacker may be able to move freely within the network. Of course, this may cause many problems. However, implementing a preferred embodiment of the present invention in a software-defined network (e.g., a cloud-based enterprise network) can prohibit hackers (e.g., network attackers) from moving freely around within the enterprise network. Although hardware (e.g., nodes, switches) may already exist in traditional networks, where traffic travels between these hardware, when enterprises enter the cloud and become more software-defined, the links between the hardware can be dynamic (e.g., creating a pod-specific dynamic firewall based on observed pod behavior), which means that the link may be changed (e.g., canceled) and the data may not be able to travel between the defined nodes.

[0030] refer to Figure 1 , describes an exemplary networked computer environment 100 according to one embodiment. The networked computer environment 100 may include a computer 102 having a processor 104 and a data storage device 106, which is capable of running a software program 108 and an intelligent SDN program 110a. The networked computer environment 100 may also include a server 112, which is enabled to run an intelligent SDN program 110b that can interact with a database 114 and a communication network 116. The networked computer environment 100 may include multiple computers 102 and servers 112, only one of which is shown. The communication network 116 may include various types of communication networks, such as a wide area network (WAN), a local area network (LAN), a telecommunications network, a wireless network, a public switched network, and / or a satellite network. It should be understood that Figure 1 This merely provides an illustration of one implementation and does not imply any limitation on the environments in which different embodiments may be implemented. Many modifications to the described environment may be made based on design and implementation requirements.

[0031] The client computer 102 can communicate with the server computer 112 via a communication network 116. The communication network 116 may include connections such as wired, wireless communication links, or fiber optic cables. Figure 6 As discussed, the server computer 112 may include an internal component 902a and an external component 904a, respectively, and the client computer 102 may include an internal component 902b and an external component 904b, respectively. The server computer 112 may also operate in a cloud computing service model, such as software as a service (SaaS), platform as a service (PaaS), or infrastructure as a service (IaaS). The server 112 may also be located in a cloud computing deployment model, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud. The client computer 102 may be, for example, a mobile device, a phone, a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing device capable of running programs, accessing a network, and accessing a database 114. According to various implementations of the present embodiment, the intelligent SDN program 110a, 110b may interact with a database 114 that may be embedded in various storage devices, such as, but not limited to, a computer / mobile device 102, a networked server 112, or a cloud storage service.

[0032] According to the present embodiment, a user using the client computer 102 or the server computer 112 can use the intelligent SDN program 110a, 110b (respectively) to create a pod-specific dynamic firewall based on observed pod behavior and more specifically misbehavior. Figures 2 to 5 Explain the intelligent SDN approach in more detail.

[0033] Reference now Figure 2 , illustrates an operational flow diagram of an exemplary intelligent software defined networking (SDN) process 200 used by intelligent SDN programs 110a and 110b according to at least one embodiment.

[0034] At 202, the behavior of the initial service component (pod) is recorded and clustered to generate a behavioral transition model of the component. Each network flow can be recorded as a vector, and a clustering algorithm can be used to find valid groups and / or clusters. Each group can be referred to as a class or state. The network flow vector data can be presented as a time series, for example, first presenting a vector clustered as state A, then presenting a vector clustered as state B, and finally presenting a transition from state A to state B. Generating a behavioral transition model of a component may include intelligent SDN programs 110a and 110b, which configure an artificial intelligence (AI) training period for each newly started pod in the network. After the training period, the trained AI model can be enabled to block abnormal network flows until retraining is completed. Human users on the network (e.g., administrators or other users) can check the blocked flows and can mark them as benign before the next retraining.

[0035] There can be two kinds of AI systems, rule-based (including detailed functions performed by the system) and machine learning-based (which can use rule-based models to train machine learning models by preparing many examples), where the machine learning AI approach is potentially more flexible due to the fact that strict rules do not need to be followed. The AI ​​used here can detect whether new traffic is normal or abnormal. An advantage of the present implementation can be precise blocking, which can be done by tracking and monitoring all traffic traveling from one pod to another. By being able to detect deviations from past known behavior of a pod, blocking can be done at very precise times, such as at the moment when a pod is determined to be compromised by a malicious intruder (e.g., a cyber attacker).

[0036] During the behavior model training, if the network finds that some pods are not behaving correctly, the administrator of the network (i.e., the enterprise network) can request a behavior model adjustment, and the behavior model adjustment will most likely trigger a retraining of the behavior model. The retraining of the behavior model can be to rerun the clustering and scoring algorithms. Once the behavior model is created and trained, the behavior can be observed as described below with respect to step 204.

[0037] Most cloud systems are likely to consist of something like (Kubernetes is a registered trademark of The Linux Foundation in the United States and / or other countries) system control, which enables administrators to control whether a pod can communicate with another pod using ingress parameters. In this sense, IP addresses and other parameters can be blocked, namespaces can be listed as exclusive namespaces to communicate with, and so on. However, this usually needs to be done manually, protecting the enterprise network by changing each parameter when a threat is detected. This can be overwhelming and impossible, as shown below about Figure 3As can be seen in the submarine example described, it may not be possible to lock all the doors in a very short period of time. Therefore, it is advantageous to have this AI mechanism installed on the enterprise network to automatically close these doors when improper behavior is detected. To do this, it may be necessary to understand what the normal behavior of the pod is and what the improper behavior is.

[0038] According to at least one embodiment of the present invention, the intelligent SDN programs 110a and 110b may loop through all (Kubernetes is a registered trademark of The Linux Foundation in the United States and / or other countries) deployment, and an artificial intelligence (AI) system can be trained to recognize normal behavior of the deployment. It should be noted that This is just one example implementation and any cloud platform with specific networking capabilities similar to software defined networking may be used.

[0039] A clustering algorithm can be used to create a vector based on the trend of a given pod. The vector can include details such as a destination IP address and a destination port, where all network traffic traveling between the ports will have specified parameters. Network traffic can travel to an IP address or port and can follow a specific protocol (e.g., which defines how to encapsulate data). Network traffic can also have a network payload and a source IP address (e.g., where the data comes from), executable statements, and parameters (e.g., what the network traffic is related to). For example, network traffic can be the result of executing a specific application, an instance of which has certain parameters specified. There can be many parameters associated with a specific network traffic, and this can form a vector alone. Therefore, a vector can have many dimensions, each with a value between 0 and 1, and the present invention uses technology to standardize or encode parameters to turn them into values ​​between 0 and 1.

[0040] A state graph can be created to determine the state of a pod based on a vector by grouping similar vectors, such as by comparing each value of the vector and calculating the distance by using a distance formula such as:

[0041] (q1-p1) 2 +(q2-p2) 2 +…+(q n -p n ) 2

[0042] Some vectors may be determined to belong to the same state because they have parameters that are close to each other (the vectors are very similar or identical). K-means may be a clustering algorithm for dividing traffic (e.g., vectors) into different groups (e.g., states) and determining the optimal number of clusters by using the K-means clustering algorithm plus the Calinski Harabsz score. Valid states and valid transitions between states may be detected based on the behavior of the state diagram.

[0043] The dissipation mechanism (e.g., an energy dissipation score that sets the dissipation rate while considering distance) can be another function that can be used to determine distance (e.g., how far away a state is from other states) and determine whether network traffic is normal or abnormal. The energy dissipation score can be:

[0044]

[0045] At 204, the behavior of the component is observed. This includes transition checking for each monitored event and measuring the state distance for each transition.

[0046] As previously mentioned, detecting pod behavior and misbehavior and limiting how pods communicate with other pods on the network can be an improvement over existing technologies. This detection can be done by calculating the sum of all distances (for example, in the case of new traffic in the network, the distance between the new traffic or vector and the center of all other groups can be calculated). There can be a center for each state that can be represented as a vector. A distance formula can be used to calculate the distance between the center of the state and the new traffic. The distance between each state in the enterprise system can be combined into rules, and it can be determined whether the new traffic is too far away from a known state. If the distance exceeds the minimum distance of all other distances, the new traffic entering the network can be considered abnormal, and the system can attempt to block outgoing traffic from the pod with detected abnormal activity to other pods.

[0047] At 206, network policy changes are triggered by inappropriate behaviors including false transitions and far states, thereby effectively blocking suspicious communications. Clustering can take into account running processes and timing, thereby effectively blocking truly malicious communications rather than specific IP addresses.

[0048] The behavioral model can make behavioral predictions, and based on the behavioral predictions, the network policy can be adjusted to limit outgoing traffic, especially in areas of the network (i.e., the enterprise network) where the pod may be compromised. Before limiting traffic, the behavioral model training must be performed, for example, during the operation (go-live) or testing phase of the application on the network (as previously described with respect to step 202 above). This may be the best time to capture the behavioral model because the security of the pod may not be compromised during testing. Therefore, at this time, the behavioral model of the application can be captured, and once the application (or service) is running, it can be said that the present invention can be "turned on" so that any malicious activity after the operation or testing phase can be captured. At this point, the present invention can detect malicious activity immediately, and after the damage of a single pod, other parts of the network (e.g., not infected or affected) can be protected, where the damage is limited to the infected pod.

[0049] As previously described, in a cloud environment, there may be no physical links between nodes, and the entire network is virtual. In a cloud environment, there may be different pods (described above) that can house different applications. A malicious intruder (e.g., a hacker or a network attacker) can enter the pod through a specific vulnerability (e.g., when an application running on a specific pod has a vulnerability that a hacker can attack, the hacker will enter the pod and terminate in the pod where the application is located). Therefore, the goal may be to protect other pods (e.g., other parts of the enterprise network) from the damaged portion. One approach may be to reroute the network around this particular pod so that other pods are not affected by such damage. For example, again, if there is a firewall established between pods, this can prohibit communication between pods. The protection provided by the present invention can be initiated by an AI mechanism to determine whether a pod has been compromised (as previously described with respect to step 202). This can be accomplished by analyzing the behavior of the pod and determining that the pod is exhibiting inappropriate behavior or unrecognized behavior (as previously described with respect to step 204 above and with respect to Figure 4 As described above). This may be the case where an enterprise network contains multiple pods (e.g., multiple parts of a system). In order to not allow communication between pods in a scenario where a portion of the system (e.g., a single pod) is compromised, the present invention may determine the communication based on monitoring pod behavior to identify improper behavior, and links between the compromised pod and any connected pods may be disabled.

[0050] Continuing with the exemplary embodiment described above in step 202, anomalous traffic may be blocked until the intelligent SDN programs 110a and 110b are retrained and non-anomalous findings are made. This may result in pod-specific resistance to new traffic on the network.

[0051] Reference now Figure 3, describes an exemplary embodiment of micro-segmentation according to at least one embodiment. The current state of a cyber attack enterprise network can be related to Figure 3 For example, if submarine 302 begins to take on water, the water may flow everywhere and the submarine may sink quickly. However, if there are tiny segments within the submarine, as depicted by submarine 304, even if there are one or two flooded areas, the water is likely to be contained within those areas and the entire submarine may not take on water and sink. Likewise, if the enterprise network is able to lock down certain areas, a cyber attacker may not be able to travel to those areas and cause damage to the entire enterprise network.

[0052] Reference now Figure 4 , describes an exemplary embodiment of an enterprise network including multiple pods according to at least one embodiment. Here, SysFlow telemetry is used to analyze the behavior of the pods, for example to determine whether the pods are exhibiting inappropriate behavior or unrecognized behavior. In this example, the enterprise network includes multiple pods (e.g., multiple parts of a system), where a behavior monitor determines that the behavior of pod 3 is unrecognized and the link between the impaired pod and the connected pod 1 should be disconnected.

[0053] Reference now Figure 5 , describes an exemplary embodiment of a state diagram describing service behavior and improper behavior according to at least one embodiment. As previously described, each network flow can be recorded as a vector, and a clustering algorithm can be used to find valid groups and / or clusters. Each group can then be referred to as a class or state (502 describes five states and 504 describes six states). The new state B6 in 504 is determined to be located at a distance far from other states (e.g., based on the sum of all distances or energy dissipation score), and is therefore determined to be improper behavior for the enterprise network. State transitions can also be classified as improper behavior for transitions that have never been seen on an enterprise network. Such improper behavior will trigger a network policy change, which is effective immediately when the improper behavior is identified.

[0054] Understandably, Figures 2 to 5 Only a description of one embodiment is provided without implying any limitation on how different embodiments may be implemented.Many modifications may be made to the described embodiments based on design and implementation requirements.

[0055] Figure 6 According to an illustrative embodiment of the present invention Figure 1 900 is a block diagram of the internal and external components of a computer shown in FIG. Figure 6 This merely provides an illustration of one implementation and does not imply any limitation on the environments in which different embodiments may be implemented. Many modifications to the described environment may be made based on design and implementation requirements.

[0056] Data processing systems 902, 904 represent any electronic device capable of executing machine-readable program instructions. Data processing systems 902, 904 may represent a smart phone, a computer system, a PDA, or other electronic device. Examples of computing systems, environments, and / or configurations that may be represented by data processing systems 902, 904 include, but are not limited to, personal computer systems, server computer systems, thin clients, fat clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network PCs, small computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0057] The user client computer 102 and the network server 112 may include Figure 6 , and the corresponding groups of internal components 902a, b and external components 904a, b shown in . Each group of internal components 902a, b includes one or more processors 906, one or more computer-readable RAMs 908 and one or more computer-readable ROMs 910 on one or more buses 912, and one or more operating systems 914 and one or more computer-readable tangible storage devices 916. One or more operating systems 914, software programs 108, and intelligent SDN programs 110a in the client computer 102 and the intelligent SDN programs 110b in the network server 112 can be stored on one or more computer-readable tangible storage devices 916 for execution by one or more processors 906 via one or more RAMs 908 (which typically include cache memory). Figure 6 In the embodiment shown in , each of the computer-readable tangible storage devices 916 is a disk storage device of an internal hard drive. Alternatively, each computer-readable tangible storage device 916 is a semiconductor memory device such as ROM 910, EPROM, flash memory or any other computer-readable tangible storage device capable of storing computer programs and digital information.

[0058] Each set of internal components 902a, b also includes a R / W drive or interface 918 to read from and write to one or more portable computer-readable tangible storage devices 920, such as CD-ROMs, DVDs, memory sticks, tapes, disks, optical disks, or semiconductor storage devices. Software programs such as the software program 108 and the intelligent SDN programs 110a and 110b can be stored on one or more of the respective portable computer-readable tangible storage devices 920, read via the respective R / W drive or interface 918, and loaded into the respective hard disk drive 916.

[0059] Each set of internal components 902a, b may also include a network adapter (or switch port card) or interface 922, such as a TCP / IP adapter card, a wireless Wi-Fi interface card, or a 3G or 4G wireless interface card or other wired or wireless communication link. The software program 108 and the intelligent SDN program 110a in the client computer 102 and the intelligent SDN program 110b in the network server computer 112 may be downloaded from an external computer (e.g., a server) via a network (e.g., the Internet, a local area network or other wide area network) and a corresponding network adapter or interface 922. From the network adapter (or switch port adapter) or interface 922, the software program 108 and the intelligent SDN program 110a in the client computer 102 and the intelligent SDN program 110b in the network server computer 112 are loaded into the corresponding hard disk drive 916. The network may include copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers.

[0060] Each set of external components 904a, b may include a computer display monitor 924, a keyboard 926, and a computer mouse 928. External components 904a, b may also include touch screens, virtual keyboards, touch pads, pointer devices, and other human-computer interface devices. Each set of internal components 902a, b also includes a device driver 930 to interface to the computer display monitor 924, keyboard 926, and computer mouse 928. The device driver 930, the R / W driver or interface 918, and the network adapter or interface 922 include hardware and software (stored in the storage device 916 and / or ROM 910).

[0061] It should be understood in advance that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings set forth herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0062] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0063] Features are as follows:

[0064] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed without requiring manual interaction with the service provider.

[0065] Wide Area Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0066] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is a sense of location independence, as consumers typically have no control or knowledge of the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0067] Rapid elasticity: In some cases, the ability to scale out quickly and in quickly can be provisioned quickly and elastically. To the consumer, the capacity available for provisioning often appears to be unlimited and can be purchased in any quantity at any time.

[0068] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0069] The service model is as follows:

[0070] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on the cloud infrastructure. The applications are accessible from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0071] Platform as a Service (PaaS): The capability provided to consumers is to deploy consumer-created or acquired applications onto cloud infrastructure, where the applications are created using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but have control over deployed applications and possible configuration of the application hosting environment.

[0072] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0073] The deployment model is as follows:

[0074] Private Cloud: The cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0075] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0076] Public cloud: Cloud infrastructure is available to the general public or large industrial groups and is owned by an organization that sells cloud services.

[0077] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community or public) that remain a unique entity but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0078] The cloud computing environment is service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure consisting of a network of interconnected nodes.

[0079] Reference now Figure 7 , depicts an illustrative cloud computing environment 1000. As shown, the cloud computing environment 1000 includes one or more cloud computing nodes 100 with which a local computing device used by a cloud consumer can communicate, such as a personal digital assistant (PDA) or cellular phone 1000A, a desktop computer 1000B, a laptop computer 1000C, and / or an automobile computer system 1000N. The nodes 100 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 1000 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Figure 7The types of computing devices 1000A-N shown in are intended for illustration only, and computing node 100 and cloud computing environment 1000 may communicate with any type of computing device over any type of network and / or network addressable connection (eg, using a web browser).

[0080] Reference now Figure 8 , shows a set of functional abstraction layers 1100 provided by the cloud computing environment 1000. It should be understood in advance that Figure 8 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0081] The hardware and software layer 1102 includes hardware and software components. Examples of hardware components include: host 1104; server 1106 based on RISC (Reduced Instruction Set Computer) architecture; server 1108; blade server 1110; storage device 1112; and network and networking components 1114. In some embodiments, software components include network application server software 1116 and database software 1118.

[0082] Virtualization layer 1120 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 1122 ; virtual storage 1124 ; virtual networks 1126 , including virtual private networks; virtual applications and operating systems 1128 ; and virtual clients 1130 .

[0083] In one example, the management layer 1132 may provide the functionality described below. Resource provisioning 1134 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 1136 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 1138 provides access to the cloud computing environment for consumers and system administrators. Service level management 1140 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 1142 provides pre-scheduling and procurement of cloud computing resources in anticipation of future demand for the cloud computing resources based on the SLA.

[0084] The workload layer 1144 provides examples of functionality that can take advantage of the cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation 1146; software development and lifecycle management 1148; virtual classroom education delivery 1150; data analytics processing 1152; transaction processing 1154; and intelligent SDN 1156. The intelligent SDN programs 110a, 110b provide a way to create pod-specific dynamic firewalls based on observed pod behavior.

[0085] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for intelligent SDN, the method comprising: Recording and clustering behaviors of the pods to generate a behavior transition model of the pods; observing the behavior of the pod and comparing the behavior to the generated behavior transition model; Based on determining that the behavior of the pod is inappropriate behavior, triggering a network policy change.

2. The method according to claim 1, wherein: The behavior of the pod is recorded as a vector of network flow data, and wherein the vector is presented as a time series depicting at least one state behavior and at least one state transition.

3. The method according to claim 2, wherein: A clustering algorithm is used to create the vector based on at least one observed trend of the pods.

4. The method according to claim 2 or 3, wherein: A state diagram is created based on the vectors by comparing each value of the vector to each value of a second vector and by utilizing a distance formula.

5. A method according to any one of the preceding claims, wherein: Generating the behavior change model further includes: An artificial intelligence model is used to learn the behavior of the pod, wherein the artificial intelligence model detects whether a new traffic pattern is normal or abnormal.

6. A method according to any one of the preceding claims, wherein: Triggering the network policy change further includes: Create at least one pod-specific dynamic firewall.

7. A method according to any one of the preceding claims, wherein: Triggering the network policy change blocks the suspicious communication from traveling to the second pod.

8. A computer system for intelligent SDN, comprising: One or more processors, one or more computer-readable memories, one or more computer-readable tangible storage media, and program instructions stored on at least one of the one or more tangible storage media, the program instructions being for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising: Recording and clustering behaviors of pods to generate a behavior transition model of the pods; observing the behavior of the pod and comparing the behavior to the generated behavior transition model; Based on determining that the behavior of the pod is inappropriate behavior, triggering a network policy change.

9. The computer system according to claim 8, wherein: The behavior of the pod is recorded as a vector of network flow data, and wherein the vector is presented as a time series depicting at least one state behavior and at least one state transition.

10. The computer system according to claim 9, wherein: A clustering algorithm is used to create the vector based on at least one observed trend of the pods.

11. The computer system according to claim 9 or 10, wherein: A state diagram is created based on the vectors by comparing each value of the vector to each value of a second vector and by utilizing a distance formula.

12. The computer system according to any one of claims 8 to 11, wherein: Generating the behavior change model further includes: An artificial intelligence model is used to learn the behavior of the pod, wherein the artificial intelligence model detects whether a new traffic pattern is normal or abnormal.

13. The computer system according to any one of claims 8 to 12, wherein: Triggering the network policy change further includes: Create at least one pod-specific dynamic firewall.

14. The computer system according to any one of claims 8 to 13, wherein: Triggering the network policy change blocks the suspicious communication from traveling to the second pod.

15. A computer program product for intelligent SDN, comprising: One or more non-transitory computer-readable storage media and program instructions stored on at least one tangible storage medium of the one or more tangible storage media, the program instructions being executable by a processor to cause the processor to perform a method comprising: Recording and clustering behaviors of pods to generate a behavior transition model of the pods; observing the behavior of the pod and comparing the behavior to the generated behavior transition model; Based on determining that the behavior of the pod is inappropriate behavior, triggering a network policy change.

16. The computer program product of claim 15, wherein: The behavior of the pod is recorded as a vector of network flow data, and wherein the vector is presented as a time series depicting at least one state behavior and at least one state transition.

17. The computer program product of claim 16, wherein: A clustering algorithm is used to create the vector based on at least one observed trend of the pods.

18. A computer program product according to claim 16 or 17, wherein: A state diagram is created based on the vectors by comparing each value of the vector to each value of a second vector and by utilizing a distance formula.

19. The computer program product according to any one of claims 15 to 18, wherein: Generating the behavior change model further includes: An artificial intelligence model is used to learn the behavior of the pod, wherein the artificial intelligence model detects whether a new traffic pattern is normal or abnormal.

20. A computer program product according to any one of claims 15 to 19, wherein: Triggering the network policy change further includes: Create at least one pod-specific dynamic firewall.

21. A computer program comprising program code means adapted to perform the method of any one of claims 1 to 7 when said program is run on a computer.

Images