Automated Networking Rule Production via Flow Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of networking rules required for micro-segmentation in data centers leads to network slowdowns and resource limitations in networking devices, as hardware switches struggle to implement large rule sets efficiently.
Innovation Solution
Automated production of networking rules using unsupervised learning and clustering algorithms, such as K-means or random cut forest, to identify clusters from flow samples and generate a reduced set of rules that can be implemented without slowing down the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If micro-segmentation is implemented with a large number of networking rules to achieve precise security control, then security precision is improved, but device performance deteriorates due to network slowdowns and resource limitations
Solution Approach 1:
The patent segments the large set of networking rules into multiple smaller subsets that can be distributed across different networking devices or processing units. This segmentation allows the system to maintain high security precision through comprehensive rule coverage while improving device performance by reducing the rule set size each individual device must process
Solution Approach 2:
The patent applies partial action by implementing a subset of all possible networking rules on each networking device rather than the complete rule set. Flow samples are matched against rules in a distributed manner, where each device handles only the portion of rules relevant to its function, thereby maintaining security effectiveness while reducing per-device processing overhead
2Reliability
If the number of networking rules is increased to achieve comprehensive micro-segmentation coverage, then security coverage is improved, but device resource capacity is exceeded
Solution Approach 1:
The complete networking rule set is segmented into multiple smaller subsets distributed across different networking devices. This allows comprehensive security coverage to be achieved through collective rule enforcement across the network infrastructure while each individual device operates within its resource capacity limits
Solution Approach 2:
The patent creates a universal flow sample matching mechanism that can operate across multiple networking devices with different rule sets. The same flow sample can be evaluated against different rule subsets on different devices, providing universal security coverage without requiring each device to hold the complete rule set
Data Source
AI summary
The flow samples in a training set may be produced from a flow log, from an initial set of network rules, or from both. The flow samples may include header values for network flows and may be stored in a memory. A processor coupled to the memory may be configured for unsupervised and automatic networking rule production. The unsupervised and automatic rule production may include producing clusters of the flow samples and producing networking rules from the clusters, wherein each of the clusters may be used to produce one of the networking rules. An unsupervised learning algorithm may be used to produce the clusters.