Zero-Touch Workload Policy Provisioning From Network Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users of workload protection solutions struggle with implementing effective segmentation strategies due to a lack of awareness and training, leading to increased vulnerability and time inefficiencies in configuring policies across dynamic application environments.
Innovation Solution
A system and method for automatically identifying and classifying network traffic using agents to generate recommended policies, leveraging telemetry data, scopes, labels, and application dependency mapping to facilitate a zero-touch approach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated policy recommendation is implemented, then security vulnerability reduction is improved, but system complexity increases
Solution Approach 1:
The system performs self-service by automatically collecting telemetry data, analyzing network traffic patterns, and generating policy recommendations without requiring manual security expertise. The workload protection solution autonomously identifies segmentation opportunities and formulates security policies, eliminating the need for users to manually configure complex security parameters.
Solution Approach 2:
The patent introduces an intermediary AI/ML engine that acts as a mediator between raw network telemetry data and security policy decisions. This intermediary layer processes complex data patterns and translates them into actionable policy recommendations, shielding users from the underlying complexity while maintaining high security standards.
2Manufacturing precision
If manual policy configuration is performed, then policy precision is improved, but time consumption increases
Solution Approach 1:
The system performs preliminary action by proactively analyzing network traffic and pre-generating policy recommendations before security incidents occur. The workload protection solution continuously monitors telemetry data and prepares segmentation policies in advance, allowing rapid deployment when needed without time-consuming manual analysis.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously monitors network traffic and policy effectiveness, using this information to refine and adjust policy recommendations. This closed-loop feedback ensures high policy precision while automating the iterative refinement process that would otherwise require extensive manual time investment.
3Measurement precision
If comprehensive telemetry collection is implemented, then traffic classification accuracy is improved, but data processing load increases
Solution Approach 1:
The system applies the extraction principle by selectively collecting only the most relevant telemetry data points needed for accurate traffic classification. The workload protection solution identifies and extracts key performance indicators and traffic patterns that provide maximum classification accuracy while filtering out redundant data that would increase processing load without adding value.
Data Source
AI summary
Devices, systems, methods, and processes for automatically generating, at least in part, a segmentation strategy. Users of workload protection solutions can initiate a process to deploy various agents onto a network with one or more operating systems. The initial scope may be defined via one or more best practices to generate a scope tree. Associated labels may be defined based on the scope design and any subnets learned from the installed agent interface subnets. Common services can also be defined based on well known ports and/or protocols. Agent-based host names can also be evaluated to define potential application groupings. A generated application dependency mapping can be applied to understand potential application boundaries and potential policy recommendations. These steps can help a user to begin their segmentation strategy when deploying a workload protection solution.