Vmware, Inc.

Nicira, Inc.

Arnold Koon-Chee Poon

Rajiv Mordani

Margaret Angeline Petrus

Aditi Vutukuri

Tejas Sanjeev Panse

Sirisha Myneni

Farzad Ghannadian

Arijit Chanda

Kausum Kumar

Laxmikant Vithal Gunda

Lifeng Chen

Kamalika Das

Some embodiments of the invention provide a simplified mechanism to deploy and control a multi-segmented application by using application-based manifests that express how application segments of the multi-segment application are to be defined or modified, and how the communication profiles between these segments. In some embodiments, these manifests are application specific. Also, in some embodiments, deployment managers in a software defined datacenter (SDDC) provide these manifests as templates to administrators, who can use these templates to express their intent when they are deploying multi-segment applications in the datacenter. Application-based manifests can also be used to control previously deployed multi-segmented applications in the SDDC. Using such manifests would enable the administrators to be able to manage fine grained micro-segmentation rules based on endpoint and network attributes.

Template driven approach to deploy a multi-segmented application in an SDDC

Some embodiments provide a method for detecting a threat to a datacenter. The method receives a set of connections between a set of DCNs in the datacenter over a particular time period. The set of DCNs includes at least a first DCN at which a first anomalous event was detected. The method analyzes a set of detected anomalous events to identify additional anomalous events detected at other DCNs in the set of DCNs during the particular time period. Based on the first anomalous event and identified additional anomalous events, the method determines whether the anomalous events indicate a threat to the datacenter.

Detecting threats to datacenter based on analysis of anomalous events

Some embodiments provide a method for detecting a threat to a datacenter. The method generates a graph of connections between data compute nodes (DCNs) in the datacenter. Each connection has an associated time period during which the connection is active. The method receives an anomalous event occurring during a particular time period at a particular DCN operating in the datacenter. The method analyzes the generated graph to determine a set of paths between DCNs in the datacenter that include connections to the particular DCN during the particular time period. The method uses the set of paths to identify a threat to the datacenter.

Identification of time-ordered sets of connections to identify threats to a datacenter

Some embodiments provide a method for identifying security threats to a datacenter. The method receives flow attribute sets for multiple flows from multiple host computers in the datacenter on which data compute nodes (DCNs) execute. Each flow attribute set indicates at least a source DCN for the flow. The method identifies flow attribute sets that correspond to DCNs responding to name resolution requests. For each DCN of a set of DCNs executing on the host computers, the method determines whether the DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the DCN based on the identified flow attribute sets. When a particular DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the particular DCN, the method identifies the particular DCN as a security threat to the datacenter.

Detection of threats based on responses to name resolution requests

In one set of embodiments, a host system can perform a random walk along a graph representing network traffic in a virtual network, where the virtual network comprises a plurality of virtual machines (VMs) running on a plurality of host systems including the host system, and where the random walk starts from a node of the graph corresponding to a VM running on the host system. The host system can further construct, based on the random walk, a local neighborhood of VMs associated with the VM and determine, based on the local neighborhood, whether the VM is a localized VM. Upon determining that the VM is not a localized VM, the host system can transmit a random walk data entry identifying the VM and the local neighborhood to a server communicatively coupled with the plurality of host systems.

Distributed computation of graph embeddings for network traffic in virtual networks

The technology disclosed herein enables the micro-segmentation of a network without agents. In a particular embodiment, a method provides, in a packet-handler controller of a virtual computing environment, determining one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment. The method further provides converting the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment. Also, the method provides distributing the one or more policies in the second format to at least one of the one or more computing systems.

Growing community of inventors

San Mateo, CA, United States of America

Arnold Koon-Chee Poon