Virtual Network Segmentation via Traffic Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual configuration of virtual network segmentation in complex computer systems is complex and requires detailed knowledge, leading to issues like blocked communications and degraded user experience due to potential inaccuracies.
Innovation Solution
A system that monitors communications and dependencies to automatically segment virtual networks, virtual machine instances, and applications, grouping them based on traffic patterns and refining segmentations based on interdependencies and external factors, with the ability to update and test segmentations dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of virtual network segmentation is performed, then security isolation is achieved, but system complexity and expertise requirements increase significantly
Solution Approach 1:
The system automatically performs network segmentation configuration by monitoring communications and dependencies between virtual machine instances, applications, and resources. The segmentation service analyzes traffic patterns and interdependencies to autonomously define segmentation boundaries and configure routing rules without requiring manual administrator intervention, thereby reducing complexity while maintaining security isolation.
Solution Approach 2:
The system continuously monitors communications and dependencies between segmented entities and uses this feedback to dynamically adjust segmentation configurations. The segmentation service evaluates routing decisions based on observed traffic patterns and interdependencies, refining segmentation boundaries to optimize both security isolation and communication efficiency.
2Ease of operation
If manual configuration of routing rules is performed, then intercommunication control is achieved, but accuracy and user experience deteriorate due to potential configuration errors
Solution Approach 1:
The segmentation service automatically analyzes actual communications and dependencies between virtual machine instances, applications, and resources to define accurate segmentation boundaries. By deriving segmentation configurations from observed traffic patterns and interdependencies rather than manual administrator input, the system eliminates configuration errors while maintaining precise control over intercommunication.
Solution Approach 2:
The system performs preliminary analysis of communications and dependencies before finalizing segmentation configurations. The segmentation service monitors traffic patterns and interdependencies in advance to pre-determine optimal segmentation boundaries and routing rules, ensuring accurate segmentation before actual deployment.
3Productivity
If automated segmentation based on traffic patterns is implemented, then manual effort is reduced, but system monitoring and data processing requirements increase
Solution Approach 1:
The segmentation service performs multiple functions using a unified approach: it monitors communications, analyzes dependencies, defines segmentation boundaries, configures routing rules, and dynamically adjusts configurations all through a single automated system. This multi-functional design consolidates monitoring and data processing requirements into one cohesive service rather than requiring separate systems for each function.
Data Source
AI summary
Techniques for segmenting an application are described herein. Communication events for an application are received. A segmentation profile for the application, which includes a set of processes, is generated based on patterns in the communication events. The segmentation profile includes two or more disjoint sets of processes of the application. Communications between processes in the two or more disjoint sets of processes are restricted by updating a communication profile for each process in the disjoint sets of processes.