Vmware, Inc.

Tejas Sanjeev Panse

Margaret Angeline Petrus

Aditi Vutukuri

Rajiv Mordani

Suket Gakhar

Lakshmi Narasimhan

Anant Kumar

Arnold Koon-Chee Poon

Santhanakrishnan Kaliya Perumal

Minjal Agarwal

Vinith Podduturi

Sonam Sinha

Some embodiments provide a method for detecting a threat to a datacenter. The method receives a set of connections between a set of DCNs in the datacenter over a particular time period. The set of DCNs includes at least a first DCN at which a first anomalous event was detected. The method analyzes a set of detected anomalous events to identify additional anomalous events detected at other DCNs in the set of DCNs during the particular time period. Based on the first anomalous event and identified additional anomalous events, the method determines whether the anomalous events indicate a threat to the datacenter.

Detecting threats to datacenter based on analysis of anomalous events

Some embodiments provide a method for identifying security threats to a datacenter. From multiple host computers in the datacenter, the method receives attribute sets for multiple flows. Each respective attribute set for a respective flow includes at least (i) a source identifier for the respective flow and (ii) an indicator as to whether the respective flow is indicative of the source of the respective flow being a security threat. For each of multiple source identifiers, the method aggregates the received attribute sets to generate an aggregate attribute set for the source identifier that includes a combined measurement of security threat indicators. For a particular source identifier, the method adjusts a security threat likelihood score for the source corresponding to the particular source identifier based on the combined measurement of security threat indicators for the source identifier.

Security threat detection based on network flow analysis

Some embodiments provide a method for detecting a threat to a datacenter. The method generates a graph of connections between data compute nodes (DCNs) in the datacenter. Each connection has an associated time period during which the connection is active. The method receives an anomalous event occurring during a particular time period at a particular DCN operating in the datacenter. The method analyzes the generated graph to determine a set of paths between DCNs in the datacenter that include connections to the particular DCN during the particular time period. The method uses the set of paths to identify a threat to the datacenter.

Identification of time-ordered sets of connections to identify threats to a datacenter

Some embodiments provide a method for identifying security threats to a datacenter. The method receives flow attribute sets for multiple flows from multiple host computers in the datacenter on which data compute nodes (DCNs) execute. Each flow attribute set indicates at least a source DCN for the flow. The method identifies flow attribute sets that correspond to DCNs responding to name resolution requests. For each DCN of a set of DCNs executing on the host computers, the method determines whether the DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the DCN based on the identified flow attribute sets. When a particular DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the particular DCN, the method identifies the particular DCN as a security threat to the datacenter.

Detection of threats based on responses to name resolution requests

Some embodiments provide a method for identifying security threats to a datacenter. From multiple host computers in the datacenter, the method receives data indicating port usage for a particular time period for each of multiple destination data compute nodes (DCNs) executing on the host computers. For each DCN of a set of the destination DCNs, identifies whether the port usage for the particular time period deviates from a historical baseline port usage for the DCN. When the port usage for a particular DCN deviates from the historical baseline for the particular DCN, the method identifies the particular DCN as a target of a security threat.

Some embodiments provide a novel method for monitoring health of an SMN that includes multiple networking components. A health analytics manager identifies a set of one or more metrics associated with the network components of the SMN. The health analytics manager uses the set of metrics to compute a first health score for the SMN. Then, the health analytics manager presents the first health score in a UI along with (1) data regarding how the first health score was computed, and (2) a set of one or more parameters for a user to modify how the health for the SMN is computed. After receiving from the user one or more modifications to at least one of the parameters, the health analytics manager computes a second health score for the SMN based on the modified set of parameters.

Modifying health monitoring through user interface

In a computer-implemented method for upgrading a fault tolerant hyper-converged infrastructure in an environment with no additional physical infrastructure, a workload domain having a plurality of hosts is chosen for an upgrade. One or more conflict groups are calculated for each host, and a physical host in the workload domain is selected. A number and a size of one or more nested hosts is determined and a different nested host is created in a management cluster for each of the one more conflict groups in the physical host. A communication network provides communication between a virtual machine (VM) on the different nested host and a VM in the physical host. The physical host is put into a maintenance mode, upgraded, and then returned from the maintenance mode to an operational mode.

Fault tolerant hyper-converged infrastructure upgrades in an environment with no additional physical infrastructure

In a computer-implemented method for using a nested host manager in a hyper converged infrastructure to streamline the upgrade process for one or more hosts in a workload domain, a first workload domain having one or more hosts is chosen, and at least one host of the one or more hosts is designated for an upgrade. The resource allotment of the at least one host is evaluated and a nested host having a comparable resource allotment is selected and provided in a second workload domain. Communication is redirected from the at least one host to the nested host. The at least one host is placed in a maintenance mode, updated, and returned to an operational mode.

Nested host manager in a hyper-converged infrastructure

Systems and methods herein can provide virtual resource management for hyper-converged infrastructures. In an example, a method can include identifying an overloaded cluster requesting at least one resource, the overloaded cluster including a hypervisor on a virtual machine. The method can further include identifying an additional cluster having a free resource corresponding to the requested resource. The method can include instantiating a nested host on the additional cluster, the nested host being configured to provide the free resource and the nested hosted comprising an additional hypervisor that manages an additional virtual machine. Further, the method can include registering the nested host with the overloaded cluster such that the overloaded cluster is authorized to use the free resource.

Systems and methods for cluster resource balancing in a hyper-converged infrastructure

Outside-of-network management of a component in a virtual data center using a remote display on a HMS is disclosed. A computing device, outside of the virtual data center network, requests access to a host JNLP file for a host on the component. After receiving the request, the host provides the host JNLP file to the HMS. The HMS initiates a web based application, opens a port for access to the application, and provides the port information to a WebService within the virtual data center network. The WebService opens a port that the computing device can use to access the WebService and provides the webService port information and the HMS port information to the computing device. The computing device uses a browser to remotely manage the component via the port information and the application operating on the HMS.

Outside-of-network management of a component in a virtual data center using a remote display on a host management server

In a system and method for outside-of-network management of a component in a virtual data center, a computing device outside of the virtual data center network requests a host java network launch protocol (JNLP) file for a host on a component in the virtual data center network. After receiving the request, the host provides the host JNLP file to a webservice that modifies a portion of the host JNLP file and provides the further modified host JNLP file to the computing device outside of the virtual data center network. The computing device outside of the virtual data center network can utilize the information in the modified host JNLP file to establish a connection to the host and remotely manage the component.

Growing community of inventors

Palo Alto, CA, United States of America

Tejas Sanjeev Panse