Intra-datacenter attack detection

A non-transitory computer-readable medium comprising instructions stored thereon, the instructions, when executed, cause a computing device, which analyzes intra-datacenter flows and extra-datacenter flows, to perform operations comprising:

• capture traffic that includes intra-datacenter flows and extra-datacenter flows;
• identify with the captured traffic a subset of the intra-datacenter flows;
• compare the subset of the intra-datacenter flows with historical intra-datacenter-data flows, the compare comprising an iterative comparison utilizing an increasing amount of granularity;
• determine that the subset of the intra-datacenter flows corresponds to anomalous traffic based on the comparison;
• analyze the subset of the intra-datacenter flows to determine whether the subset of the intra-datacenter flows corresponds to a malicious attack;
• and
• dropping the subset of the intra-datacenter flows in response to the analyze making a determination that the subset of the intra-datacenter flows corresponds to a malicious attack.

A system, comprising:

• a non-transitory computer readable memory storing instructions;
• a processor programmed to cooperate with the instructions to perform operations comprising:
• capturing, by a datacenter analytics module, traffic that includes intra-datacenter flows and extra-datacenter flows;
• identifying with the captured traffic a subset of the intra-datacenter flows;
• comparing, by the datacenter analytics module, the subset of the intra-datacenter flows with historical intra-datacenter-data flows, the comparing comprising an iterative comparison utilizing an increasing amount of granularity;
• determining, by the datacenter analytics module, that the subset of the intra-datacenter flows corresponds to anomalous traffic based on the comparison;
• analyzing, by the datacenter analytics module, the subset of the intra-datacenter flows to determine whether the subset of the intra-datacenter flows corresponds to a malicious attack;
• and
• dropping the subset of the intra-datacenter flows in response to the analyzing making a determination that the subset of the intra-datacenter flows corresponds to a malicious attack.