Method, computer system, and computer program for software-defined networking for intrusion prevention - Patents.com

Abstract

Methods, computer systems, and computer program products for smart SDN are provided. The invention may include recording and clustering pod behavior to generate a pod behavior transition model. The invention may include observing the pod behavior and comparing the behavior to the generated behavior transition model. The invention may include triggering a network policy change based on determining that the pod behavior is misbehaving.

Description

[Technical field]

[0001] The present invention relates generally to the field of computing, and more particularly to software-defined networking (SDN).

[0002] To protect a company's computer network from intrusions, cyber security experts may recommend micro-segmentation of the network with network policies that police communications between segments. This may require network administrators to know the behavior of each node in the network, how best to segment them, and appropriately define policies between them. Summary of the Invention

[0003] Embodiments of the present invention disclose a method, computer system, and computer program product for smart SDN. The present invention may include recording and clustering pod behavior to generate a pod behavior transition model. The present invention may include observing the pod behavior and comparing the behavior to the generated behavior transition model. The present invention may include triggering a network policy change based on determining that the pod behavior is misbehaving.

[0004] Preferred embodiments of the invention will now be described, by way of example only, with reference to the following drawings, in which: [Brief description of the drawings]

[0005] [Figure 1] FIG. 1 illustrates a networked computing environment in accordance with at least one embodiment. [Diagram 2] 1 is an operational flow diagram illustrating a process for smart intrusion prevention in accordance with at least one embodiment. [Diagram 3]FIG. 1 is an illustration of an example embodiment of micro-segmentation in accordance with at least one embodiment. [Figure 4] FIG. 1 is a diagram of an example embodiment of an enterprise network including multiple pods in accordance with at least one embodiment. [Diagram 5] FIG. 1 is an example embodiment of a state diagram illustrating operation and misoperation of a service in accordance with at least one embodiment. [Figure 6] FIG. 2 is a block diagram of internal and external components of the computer and server shown in FIG. 1 according to at least one embodiment. [Figure 7] FIG. 2 is a block diagram of an exemplary cloud computing environment including the computer system shown in FIG. 1, according to one embodiment of the disclosure. [Figure 8] FIG. 8 is a block diagram of functional layers of the exemplary cloud computing environment of FIG. 7 in accordance with one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] Because the figures are for clarity in facilitating understanding of the invention by those skilled in the art together with the detailed description, various features of the drawings are not drawn to scale.

[0007] Although detailed embodiments of the claimed structures and methods are disclosed herein, it will be understood that the disclosed embodiments are merely exemplary of the claimed structures and methods that may be embodied in various forms. However, the present invention may be embodied in many different forms and should not be construed as being limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present invention to those skilled in the art. In the present description, details of well-known features and techniques may be omitted so as not to unnecessarily obscure the presented embodiments.

[0008] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to carry out aspects of the present invention.

[0009] A computer readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or groove ridge structures having instructions recorded thereon, and any suitable combination thereof. A computer-readable storage medium, as used herein, should not be construed to be a transitory signal per se, such as, for example, radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over a wire.

[0010] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to the respective computing / processing device or to an external computer or storage device over a network, such as, for example, the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0011] The computer readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or object oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the last scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or a connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing state information of the computer readable program instructions to execute the computer readable program instructions to perform aspects of the present invention.

[0012] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0013] These computer-readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium, instructing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored constitutes an article of manufacture including instructions that implement aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0014] Furthermore, the computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to generate a computer-implemented process and cause the computer, other programmable apparatus, or other device to perform a series of operational steps, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0015] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions that includes one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions described in the blocks may occur out of the order shown. For example, depending on the functionality involved, two blocks shown in succession may in fact be executed concurrently, substantially concurrently, or the blocks may possibly be executed in the reverse order. It will also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0016] Exemplary embodiments described below provide systems, methods, and program products for smart SDN. Thus, the present embodiments have the ability to improve the technical field of software-defined networking by creating pod-specific dynamic firewalls based on observed pod (e.g., smallest deployable computing unit) behavior. More specifically, preferred embodiments of the present invention may include recording and clustering pod behavior to generate a pod behavior transition model. Preferred embodiments of the present invention may include observing pod behavior and comparing the behavior to the generated behavior transition model. Preferred embodiments of the present invention may include triggering a network policy change based on determining that the pod behavior is misbehaving.

[0017] As mentioned earlier, to protect a company's computer network from intrusions, cyber security experts may recommend micro-segmentation of the network with network policies that monitor communication between segments. This may require the network administrator to know the behavior of each node in the network, how to best segment them, and properly define policies between them. However, it may be nearly impossible for the network administrator to know the behavior of each node in the network.

[0018] In particular, it may be advantageous to capture node behavior or pod behavior in a Kubernetes® (Kubernetes is a registered trademark of The Linux Foundation in the United States and / or other countries) environment during a service node go-live event and utilize a clustering algorithm to map the node behavior or state transition model. To map the node behavior, a preferred embodiment of the present invention may prepare a list of vectors, run a k-means clustering algorithm, and utilize Calinski Harabsz scores. This may allow for the creation of micro-segmentations around each service node, where the micro-segmentation is a segment with rules that prohibit unknown behavior (e.g., network traffic that deviates from a state or erroneous transitions, which may be recognized based on behavior learned from previously recognized node behavior). An artificial intelligence (AI) model may then be used to predict the current state of the node. The AI ​​model may be a model that predicts the class and / or state to which a particular data set belongs. By comparing the predicted state with the learned behavior transition model, new network policies may be deployed to block suspicious communications (e.g., malicious intruders, cyber attackers). While conventional solutions may only support hard constraining nodes to communicate with other predefined nodes, the present invention may make it possible to constrain communication between nodes based on the behavior of the nodes at runtime.

[0019] According to at least one embodiment, the present invention may be implemented in a software defined network with micro-segmentation. Software defined networking may allow a computer network to be controlled or programmed using software applications. This control may include both management and administrative functions of the components of the computer network as well as data flows. A software defined network may be comprised of multiple layers including an application layer, a control layer, and an infrastructure layer, where the application layer may include an organization's network applications, the control layer may be a centralized software defined networking (SDN) controller that may act as the intelligence of the SDN, and the infrastructure layer may include the physical infrastructure of the network, including switches that forward network traffic to its destination. In a software defined network, the SDN controller may be a logically centralized entity that manages data flows throughout the network.

[0020] According to at least one embodiment, the present invention may be installed as an add-on component within a corporate network.

[0021] In a software-defined network with micro-segmentation, network administrators or information technology (IT) professionals can tailor security settings for different types of traffic and create policies that can restrict network and application flows between workloads that may not be explicitly allowed. By enforcing segmentation rules down to the workload or application, IT professionals can reduce the network attack surface, mitigating the risk of a network attacker moving from a compromised workload or application to other workloads or applications. Segmentation rules can also improve operational efficiency, as access control lists, routing rules, and firewall policies are often unwieldy, incurring a lot of management overhead, and are difficult to scale in rapidly changing environments.

[0022] According to at least one embodiment, the present invention may prevent malicious traffic (e.g., cyber attacker intrusions) from moving freely within a cloud environment. This may be advantageous given the rise of ransomware and cyber attackers who lock files and hold companies to ransom. While infiltration of a network may be difficult in the first place, once a cyber attacker hacks into a company or corporate intranet, the cyber attacker may be able to move freely within the network. Naturally, this may cause many problems. However, by implementing preferred embodiments of the present invention in a software-defined network (e.g., a cloud-based corporate network), hackers (e.g., cyber attackers) may be prohibited from moving freely within the corporate network. In a traditional network, there may be hardware (e.g., nodes, switches) and traffic moves between these hardware, but as companies move into the cloud and become more software-defined, the links between the hardware may become dynamic (e.g., creating pod-specific dynamic firewalls based on observed pod behavior), which means that links may change (e.g., canceled) and data may no longer be able to move between defined nodes.

[0023] Referring to FIG. 1, an exemplary networked computing environment 100 is shown according to one embodiment. The networked computing environment 100 may include a computer 102 having a processor 104 and a data storage device 106 that are enabled to execute a software program 108 and a smart SDN program 110a. The networked computing environment 100 may also include a server 112 that is enabled to execute a smart SDN program 110b that may interact with a database 114 and a communications network 116. The networked computing environment 100 may include multiple computers 102 and servers 112, only one of which is shown. The communications network 116 may include various types of communications networks, such as, for example, a wide area network (WAN), a local area network (LAN), a telecommunications network, a wireless network, a public switched network, or a satellite network, or combinations thereof. It should be understood that FIG. 1 provides only an example of one implementation and is not intended to imply any limitations with respect to the environments in which various embodiments may be implemented. Many modifications to the depicted environment may be made based on design and implementation requirements.

[0024] The client computer 102 may communicate with the server computer 112 via a communication network 116. The communication network 116 may include connections such as, for example, wired, wireless communication links, or fiber optic cables. As described with reference to FIG. 6, the server computer 112 may include internal components 902a and external components 904a, respectively, and the client computer 102 may include internal components 902b and external components 904b, respectively. The server computer 112 may also operate in a cloud computing service model, such as, for example, Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS). The server 112 may also be deployed in a cloud computing deployment model, such as, for example, a private cloud, a community cloud, a public cloud, or a hybrid cloud. The client computer 102 may be, for example, a mobile device, a phone, a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing device capable of executing programs, accessing a network, and accessing a database 114. According to various implementations of embodiments of the present invention, the smart SDN programs 110a, 110b may interact with the database 114, which may be embodied in various storage devices, such as, but not limited to, the computer / mobile device 102, a networked server 112, or a cloud storage service.

[0025] According to this embodiment, a user using a client computer 102 or a server computer 112 (respectively) may use a smart SDN program 110a, 110b to create pod-specific dynamic firewalls based on observed pod behavior, and more appropriately, malicious behavior. The smart SDN method is described in further detail below with reference to Figures 2-5.

[0026] Referring now to FIG. 2, an operational flow diagram illustrating an exemplary smart software-defined networking (SDN) process 200 used by smart SDN programs 110a and 110b in accordance with at least one embodiment is shown.

[0027] At 202, the behavior of the initial service components (pods) is recorded and clustered to generate a behavior transition model of the components. Each network flow may be recorded as a vector, and a clustering algorithm may be used to find valid groups and / or clusters. Each group may be referred to as a class or state. The network flow vector data may be shown as a time series, for example, first showing vectors clustered as state A, then showing vectors clustered as state B, and finally showing a transition from state A to state B. Generating the behavior transition model of the components may include the smart SDN programs 110a and 110b setting an artificial intelligence (AI) training period for each newly launched pod in the network. After the training period, the trained AI model may be capable of blocking anomalous network flows until retraining occurs. A human user (e.g., an administrator or other user) on the network may review the blocked flows and label them as harmless before the next retraining.

[0028] AI systems can be of two types: rule-based (including detailed functions that the system performs) and machine learning-based (rule-based models can be used to train machine learning models with many examples), where machine learning AI approaches can be more flexible since they do not need to follow strict rules. The AI ​​used here can detect whether new traffic is normal or abnormal. The advantage of this implementation can be the precise blocking that can be performed by tracking and monitoring all traffic moving from one pod to another. By being able to detect deviations from the past known behavior of a pod, blocking can be performed at a very precise point in time, for example, the moment a pod is determined to be compromised by a malicious intruder (e.g., a cyber attacker).

[0029] During training of the behavioral model, if the network detects that some of the pod's behavior is incorrect, an administrator of the network (i.e., enterprise network) may request an adjustment of the behavioral model, which triggers a retraining of the behavioral model. Retraining the behavioral model may be a rerun of the clustering and scoring algorithms. Once the behavioral model is created and trained, the behavior may be observed, as described below with respect to step 204.

[0030] Most cloud systems can be controlled by a system similar to Kubernetes® (Kubernetes is a registered trademark of The Linux Foundation in the United States and / or other countries), where administrators can control whether one pod can communicate with another pod using ingress parameters. In this regard, IP addresses and other parameters can be blocked and namespaces can be listed as exclusive namespaces to communicate with, among others. However, this typically needs to be done manually by modifying each parameter to protect the corporate network when a threat is detected. This can be tedious and impossible, since there may be no way to lock all the doors in a very short time, as can be seen from the example of a submarine described below with respect to Figure 3. It can therefore be advantageous, among others, to install this AI mechanism in the corporate network to automatically close those doors when misbehavior is detected. For this reason, it can be essential to know what is the normal behavior of the pods and what is the misbehavior.

[0031] According to at least one embodiment of the present invention, the smart SDN programs 110a and 110b may loop across all Kubernetes® (Kubernetes is a registered trademark of The Linux Foundation in the United States and / or other countries) deployments in the network and train an artificial intelligence (AI) system to recognize the normal operation of the deployments. It should be noted that Kubernetes® is just one implementation example and any cloud platform that has certain networking capabilities similar to software defined networking may be used.

[0032] A clustering algorithm may be used to create a vector based on the trends of a given pod. The vector may include details such as a destination IP address and a destination port, and all network traffic going to and from that port will include the specified parameters. The network traffic may travel to an IP address or port and may follow a particular protocol (e.g., one that defines how data is encapsulated). The network traffic may include a network payload and a source IP address (e.g., where the data came from), an executable statement and arguments (e.g., what the network traffic is associated with). For example, the network traffic may be the result of running a particular application, and the instance of the application is specified with certain arguments. There may be many parameters associated with a particular network traffic, and a vector may be formed from these alone. Thus, the vector may have many dimensions, each with a value between 0 and 1, and the present invention uses techniques to normalize or encode the parameters to turn them into values ​​between 0 and 1.

[0033] By grouping similar vectors, a state diagram can be created to determine the state of the pod based on the vectors, for example, by comparing each value of the vectors and calculating the distance using a distance formula such as: (q 1 -p 1 ) 2 +(q 2 -p 2 ) 2 +···+(q n -p n ) 2 Some vectors may be determined to belong to the same state because they have parameters close to each other (vectors are very similar or identical). K-means may be a clustering algorithm used to separate traffic (e.g., vectors) into different groups (e.g., states) and determine the best number of clusters using the K-means clustering algorithm plus the Calinski Harabsz score. Based on the behavior of the state diagram, valid states and valid transitions between states may be detected.

[0034] The dissipation mechanism (e.g., energy dissipation score to set the dissipation rate when considering distance) can be other functions that can be used to determine distance (e.g., how far a state is from another state) and whether network traffic is normal or abnormal. The energy dissipation score can be:

number

[0035] At 204, the behavior of the component is observed, which includes transition checking for each event being monitored and measuring the state distance of each transition.

[0036] As mentioned above, detecting pod behavior and misbehavior and restricting how a pod can communicate with other pods on the network can be an improvement over existing technology. This detection can be done by calculating the sum of all distances (e.g., for new traffic in the network, the distance between the new traffic or vector and the center of all other groups can be calculated). Each state can have a center that can be represented as a vector. The distance between the center of the state and the new traffic can be calculated using a distance formula. The distance between each state in the enterprise system can be combined into a rule to determine if the new traffic is too far from a known state. If the distance exceeds the minimum distance of all other distances, the new traffic to the network can be considered anomalous and the system can attempt to block outgoing traffic from the pod where the anomalous activity was detected to other pods.

[0037] At 206, misbehavior including false transitions and distant states triggers network policy changes to effectively block suspicious communications. Clustering can take into account ongoing processes and timing, effectively blocking truly malicious communications rather than specific IP addresses.

[0038] The behavioral model may make behavioral predictions and based on the behavioral predictions, network policies may be adjusted to restrict outgoing traffic, particularly in areas of the network (i.e., the enterprise network) where pods may be compromised. Before traffic may be restricted, training of the behavioral model needs to be performed, for example, during the launch or testing phase of the application on the network (as previously described with respect to step 202 above). This may be the best time to capture the behavioral model, since a pod may not be able to be compromised during testing. Thus, at this time, the behavioral model of the application may be captured, and once the application (or service) is launched, the invention may be turned "on," so to speak, and any malicious activity after the launch or testing phase may be captured. The invention may then detect malicious activity immediately, and after a single pod is compromised, other parts of the network may be protected (e.g., not infected or affected), and the compromise limited to the infected pod.

[0039] As mentioned before, in a cloud environment, there may not be physical links between nodes and the entire network is virtual. In a cloud environment, there may be various pods (mentioned above) that may house various applications. A malicious intruder (e.g., a hacker or cyber attacker) may infiltrate a pod through a particular vulnerability (e.g., if an application running on a particular pod has a vulnerability that a hacker can attack, the hacker will infiltrate this pod and eventually end up in the pod where the application is located). Thus, the goal may be to protect other pods (e.g., other parts of the corporate network) from the compromised part. A way to do this may be to reroute the network around this particular pod so that other pods are not affected by this compromise. For example, similarly, if a firewall is set up between the pods, this may prohibit communication between the pods. The protection provided by the present invention may be initiated by an AI mechanism to determine if one of the pods has been compromised (as described above with respect to step 202 above). This may be done by analyzing the behavior of the pods (as previously described with respect to step 204 above and with respect to FIG. 4 below) and determining that the pods are exhibiting unauthorized or unrecognized behavior. This may occur when an enterprise network includes multiple pods (e.g., multiple parts of a system). Links between the compromised pod and connected pods may be disabled to prohibit communication between the pods in a scenario where a portion of the system (e.g., a single pod) is compromised, which may also be determined based on monitoring pod behavior and recognizing unauthorized behavior in accordance with the present invention.

[0040] Continuing with the exemplary embodiment introduced above in step 202, the smart SDN programs 110a and 110b may be retrained to block anomalous traffic until no anomaly is detected, which may provide pod-specific resistance to new traffic on the network.

[0041] Referring now to FIG. 3, an exemplary embodiment of micro-segmentation according to at least one embodiment is shown. A current state of cyber attack against an enterprise network may be synonymous with submarine 302 shown in FIG. 3. For example, if submarine 302 begins to flood, water may flow throughout and the submarine may sink quickly. However, if there is micro-segmentation within the submarine, as shown by submarine 304, even if there are one or two flooded areas, it is highly likely that the water may be contained within these areas and the entire submarine may not flood and sink. Similarly, if the enterprise network is able to lock down certain areas, a cyber attacker may not be able to move into those areas and cause damage to the entire enterprise network.

[0042] 4, an exemplary embodiment of an enterprise network including multiple pods according to at least one embodiment is shown, in which pod behavior is analyzed using SysFlow Telemetry or the like to determine whether a pod is exhibiting unauthorized or unrecognized behavior. The enterprise network in this example includes multiple pods (e.g., multiple parts of a system), and the behavior monitor determines that the behavior of pod 3 is unrecognized and that the link between the compromised pod and connected pod 1 should be severed.

[0043] Referring now to FIG. 5, an exemplary embodiment of a state diagram illustrating operation and misbehavior of a service according to at least one embodiment is shown. As previously described, each network flow may be recorded as a vector, and a clustering algorithm may be used to find valid groups and / or clusters. Each group may then be referred to as a class or state (502 shows five states, 504 shows six states). The new state B6 in 504 is determined to be located at a far distance from the other states (e.g., based on the sum of all distances or energy dissipation scores) and is therefore determined to be a misbehavior of the enterprise network. Classifying a state transition as a misbehavior may be done for transitions that have never been seen before on the enterprise network. This misbehavior may trigger a network policy change, which may be effective as soon as the misbehavior is identified.

[0044] It will be appreciated that Figures 2-5 provide an example of one embodiment only and are not intended to impose any limitations on how various embodiments may be implemented. Many variations may be made to the illustrated embodiment based on design and implementation requirements.

[0045] Figure 6 is a block diagram 900 of internal and external components of the computer shown in Figure 1 in accordance with an exemplary embodiment of the invention. It should be understood that Figure 6 is intended as only an example of one implementation and is not intended to impose any limitations with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made based on design and implementation requirements.

[0046] The data processing systems 902, 904 represent any electronic device capable of executing machine-readable program instructions. The data processing systems 902, 904 may represent a smart phone, a computer system, a PDA, or other electronic device. Examples of computing systems, environments, or configurations, or combinations thereof, that may be represented by the data processing systems 902, 904 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network PCs, minicomputer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0047] The user client computer 102 and the network server 112 may include respective sets of internal components 902a,b and external components 904a,b shown in Figure 6. Each of the sets of internal components 902a,b includes one or more processors 906, one or more computer-readable RAMs 908, and one or more computer-readable ROMs 910 on one or more buses 912, one or more operating systems 914, and one or more computer-readable tangible storage devices 916. The one or more operating systems 914, software programs 108, and smart SDN programs 110a in the client computer 102, and smart SDN programs 110b in the network server 112 may be stored in one or more computer-readable tangible storage devices 916 for execution by one or more processors 906 via one or more RAMs 908 (typically including cache memory). 6, each of the computer-readable tangible storage devices 916 is an internal hard drive magnetic disk storage device, or alternatively, each of the computer-readable tangible storage devices 916 is a semiconductor storage device, such as ROM 910, EPROM, flash memory, or any other computer-readable tangible storage device capable of storing computer programs and digital information.

[0048] Each set of internal components 902a,b also includes a R / W drive or interface 918 for reading from and writing to one or more portable computer-readable tangible storage devices 920, such as, for example, a CD-ROM, a DVD, a memory stick, a magnetic tape, a magnetic disk, an optical disk, or a semiconductor storage device. Software programs, such as software program 108 and smart SDN programs 110a and 110b, can be stored in one or more of the respective portable computer-readable tangible storage devices 920, read via the respective R / W drive or interface 918, and loaded onto the respective hard drive 916.

[0049] Each set of internal components 902a,b may also include a network adapter (or switch port card) or interface 922, such as a TCP / IP adapter card, a wireless wi-fi interface card, or a 3G or 4G wireless interface card, or other wired or wireless communication link. The software program 108 and smart SDN program 110a in the client computer 102 and the smart SDN program 110b in the network server computer 112 may be downloaded from an external computer (e.g., a server) via a network (e.g., the Internet, a local area network, or other wide area network) and the respective network adapter or interface 922. From the network adapter (or switch port adapter) or interface 922, the software program 108 and smart SDN program 110a in the client computer 102 and the smart SDN program 110b in the network server computer 112 are loaded onto the respective hard drives 916. The network may include copper wire, fiber optics, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers.

[0050] Each of the set of external components 904a,b can include a computer display monitor 924, a keyboard 926, and a computer mouse 928. The external components 904a,b can also include touch screens, virtual keyboards, touch pads, pointing devices, and other human interface devices. Each of the set of internal components 902a,b also includes a device driver 930 for interfacing to the computer display monitor 924, the keyboard 926, and the computer mouse 928. The device driver 930, the R / W drive or interface 918, and the network adapter or interface 922 include hardware and software (stored in the storage device 916 and / or ROM 910).

[0051] Although this disclosure includes detailed descriptions of cloud computing, it should be understood in advance that implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0052] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0053] Its features are as follows. On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the provider of the service. Broad Network Access: Capabilities are available over the network and are accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs). Resource Pooling: Pooling provider computing resources to serve multiple consumers using a multi-tenant model where various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control over or knowledge of the exact location of the resources provided to them, although there is a sense of location independence in that the location may be identifiable at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Capacity can be rapidly and elastically provisioned, sometimes automatically, to quickly scale out and rapidly release to quickly scale in. To the consumer, provisionable capacity often appears to be unlimited and can be purchased in any quantity at any time. Metered Services: Cloud systems leverage metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts) to automatically control and optimize resource usage. Resource usage can be monitored, managed, and reported to provide transparency to both providers and consumers of the services utilized.

[0054] The service model is as follows: Software as a Service (SaaS): The capability offered to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer has no management or control over the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application features, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The capability offered to a consumer is to deploy applications that the consumer creates or acquires, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does control the deployed applications and possibly the application hosting environment configuration. Infrastructure as a Service (IaaS): The ability offered to consumers is to provision processing, storage, network, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does control the operating systems, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0055] The deployment model is as follows: Private Cloud: The cloud infrastructure is operated exclusively for an organization. It can be managed by the organization or a third party and can be on-premise or off-premise. Community Cloud: The cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by the organization or a third party and may exist on-premise or off-premise. Public Cloud: The cloud infrastructure is made available to the general public or large industry organizations and is owned by an organization that sells cloud services. Hybrid Cloud: A cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain unique entities but are joined by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0056] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0057] Referring now to FIG. 7, an exemplary cloud computing environment 1000 is shown. As shown, the cloud computing environment 1000 includes one or more cloud computing nodes 100 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or cell phone 1000A, a desktop computer 1000B, a laptop computer 1000C, or an automotive computer system 1000N, or combinations thereof, may communicate. The nodes 100 may communicate with each other. They may be physically or virtually grouped (not shown), for example, in one or more networks, such as the private, community, public, or hybrid clouds described above, or combinations thereof. This enables the cloud computing environment 1000 to provide infrastructure-as-a-service, platform-as-a-service, and / or software-as-a-service services without the need for cloud consumers to maintain resources on their local computing devices. It should be understood that the types of computing devices 1000A-N illustrated in FIG. 7 are intended to be exemplary only, and that the computing node 100 and cloud computing environment 1000 can communicate with any type of computerized device via any type of network and / or network addressable connection (e.g., using a web browser).

[0058] 8, there is shown a set of functional abstraction layers 1100 provided by the cloud computing environment 1000. It should be understood in advance that the components, layers, and functions shown in FIG. 8 are intended to be exemplary only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided: The hardware and software layer 1102 includes hardware and software components. Examples of hardware components include a mainframe 1104, a RISC (reduced instruction set computer) architecture based server 1106, a server 1108, a blade server 1110, a storage device 1112, and a network and networking component 1114. In some embodiments, the software components include network application server software 1116 and database software 1118.

[0059] The virtualization layer 1120 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 1122, virtual storage 1124, virtual networks including virtual private networks 1126, virtual applications and operating systems 1128, and virtual clients 1130.

[0060] In one example, the management layer 1132 may provide the following functions: Resource provisioning 1134 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 1136 provides cost tracking as resources are utilized within the cloud computing environment and accounting or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification of cloud consumers and tasks as well as protection for data and other resources. User portal 1138 provides consumers and system administrators access to the cloud computing environment. Service level management 1140 provides allocation and management of cloud computing resources such that requested service levels are met. Service level agreement (SLA) planning and fulfillment 1142 provides advance arrangement and procurement of cloud computing resources anticipated to be required in the future according to SLAs.

[0061] The workload layer 1144 provides examples of functionality for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation 1146, software development and lifecycle management 1148, virtual classroom instructional delivery 1150, data analytics processing 1152, transaction processing 1154, and smart SDN 1156. The smart SDN programs 110a, 110b provide methods for creating pod-specific dynamic firewalls based on observed pod behavior.

[0062] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many changes and modifications will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for smart SDN, comprising: recording and clustering the behavior of the pod to generate a behavior transition model of the pod; observing the behavior of the pod and comparing the behavior with the generated behavior transition model; triggering a network policy change based on determining that the behavior of the pod is misbehaving; and A method comprising:

2. The method of claim 1 , wherein the pod's operations are recorded as vectors of network flow data, the vectors being represented as time series indicating at least one state operation and at least one state transition.

3. The method of claim 2 , wherein a clustering algorithm is used to create the vector based on at least one observed trend of the pods.

4. The method according to claim 2 or 3, wherein a state diagram is created based on said vectors by comparing each value of said vector with each value of a second vector and utilizing a distance formula.

5. Generating the behavioral transition model includes: using an artificial intelligence model to learn the behavior of the pod, the artificial intelligence model detecting whether new traffic patterns are normal or anomalous. The method of any one of claims 1 to 4, further comprising:

6. Triggering the network policy change includes: Create at least one pod-specific dynamic firewall. The method of any one of claims 1 to 5, further comprising:

7. The method of claim 1 , wherein triggering the network policy change blocks suspicious communications from traveling to a second pod.

8. A computer system for smart SDN, comprising: a computer system including one or more processors, one or more computer readable memories, one or more computer readable tangible storage media, and program instructions stored in at least one of the one or more tangible storage media for execution by at least one of the one or more processors via at least one of the one or more memories, the computer system being capable of executing a method, the method comprising: recording and clustering the behavior of the pod to generate a behavior transition model of the pod; observing the behavior of the pod and comparing the behavior with the generated behavior transition model; triggering a network policy change based on determining that the behavior of the pod is misbehaving; and 1. A computer system comprising:

9. 10. The computer system of claim 8, wherein the pod operations are recorded as vectors of network flow data, the vectors being represented as time series showing at least one state operation and at least one state transition.

10. The computer system of claim 9 , wherein a clustering algorithm is used to create the vector based on at least one observed trend of the pods.

11. 11. The computer system of claim 9 or 10, wherein a state diagram is created based on said vectors by comparing each value of said vector with each value of a second vector and utilizing a distance formula.

12. Generating the behavioral transition model includes: using an artificial intelligence model to learn the behavior of the pod, the artificial intelligence model detecting whether new traffic patterns are normal or anomalous.

12. The computer system of claim 8, further comprising:

13. Triggering the network policy change includes: Create at least one pod-specific dynamic firewall.

13. The computer system of claim 8, further comprising:

14. 14. The computer system of claim 8, wherein triggering the network policy change blocks suspicious communications from traveling to a second pod.

15. A computer program product for smart SDN, comprising: one or more non-transitory computer readable storage media; and program instructions stored on at least one of the one or more tangible storage media, the program instructions being executable by a processor to cause the processor to perform a method, the method comprising: recording and clustering the behavior of the pod to generate a behavior transition model of the pod; observing the behavior of the pod and comparing the behavior with the generated behavior transition model; triggering a network policy change based on determining that the behavior of the pod is misbehaving; and 2. A computer program product comprising:

16. 16. The computer program product of claim 15, wherein the pod operations are recorded as vectors of network flow data, the vectors being represented as time series illustrating at least one state operation and at least one state transition.

17. 20. The computer program product of claim 16, wherein a clustering algorithm is used to create the vector based on at least one observed trend of the pods.

18. 18. A computer program product according to claim 16 or 17, wherein a state diagram is created based on said vectors by comparing each value of said vector with each value of a second vector and utilizing a distance formula.

19. Generating the behavioral transition model includes: using an artificial intelligence model to learn the behavior of the pod, the artificial intelligence model detecting whether new traffic patterns are normal or anomalous.

19. A computer program product according to any of claims 15 to 18, further comprising:

20. Triggering the network policy change includes: Create at least one pod-specific dynamic firewall.

20. A computer program product according to any of claims 15 to 19, further comprising:

21. A computer program comprising program code means adapted to perform the method according to any of claims 1 to 7 when said program is run on a computer.

Images