Determining violation of a network invariant

A device implementing a verification module in a network, comprising:

• a communication module to intercept a flow rule transmitted to a switch from an SDN controller;
• a computer-readable storage medium to store a plurality of network invariants received from a policy management module;
• a match determination module to determine whether the flow rule matches any of the network invariants, wherein if the flow rule does not match any of the network invariants, the communication module transmits an event associated with the flow rule to the policy management module to request a new network invariant associated with the event;
• a policy violation module to determine whether the flow rule violates a matched network invariant or the new network invariant;
• and
• an alarm generator to generate an alarm to send to the policy management module if any of the network invariants is violated.

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:

• receive a flow rule transmitted from an SDN controller to a switch, the flow rule relating to an event;
• determine whether the flow rule matches any of a plurality of network invariants stored in the computer-readable storage medium;
• if determined that the flow rule matches one of the plurality of network invariants, determine whether the flow rule violates the matched network invariant;
• if determined that the flow rule does not match any of the plurality of network invariants, (1) report the event associated with the flow rule to a policy management module, (2) receive a new network invariant related to the event from the policy management module, and (3) determine whether the flow rule violates the new network invariant;
• and
• generate an alarm if determined that the flow rule violates any of the network invariants.