Intrusion detection on load balanced network traffic

A load balancer host, comprising:

• a processor connected to memory;
• and
• a module stored on a non-transitory computer readable medium and configured with instructions that when executed by the processor cause the processor to:
• establish a first execution environment in a first container within the load balancer host and execute code of a load balancer that performs load balancing within the first container;
• establish a second execution environment in a second container within the load balancer host and execute an intrusion detection system within the second container;
• wherein the load balancer of the first container and intrusion detection system of the second container communicate internally within the load balancer host via a local area network;
• perform load balancing upon network traffic that is received and transmitted as encrypted data packets over a network of computing nodes by the load balancer executing on the load balancer host;
• receive an encrypted data packet from a remote computer, wherein the encrypted data packet is to be transmitted to a destination service hosted by a destination computing node of the network;
• utilize a certificate established between the remote computer and the destination service to decrypt the encrypted data packet to create an unencrypted data packet;
• route the unencrypted data packet over the local area network from the first container to the intrusion detection system executing on the load balancer host in the second container to maintain the unencrypted data packet internal to the load balancer host, and control the intrusion detection system to execute intrusion detection upon the unencrypted data packet to detect whether the unencrypted data packet corresponds to malicious activity;
• establish a secure connection with the destination computing node;
• and
• encrypt the unencrypted data packet to create a re-encrypted data packet and transmit the re-encrypted data packet using the secure connection over the network to the destination computing node for processing by the destination service.

A computer-implemented method comprising:

• establish a first execution environment in a first container within the load balancer host and execute code of a load balancer that performs load balancing within the first container;
• establish a second execution environment in a second container within the load balancer host and execute an intrusion detection system within the second container;
• wherein the load balancer of the first container and intrusion detection system of the second container communicate internally within the load balancer host via a local area network;
• performing, by a processor of a load balancer host, load balancing upon network traffic that is received and transmitted as encrypted data packets over a network of computing nodes by the load balancer executing on the load balancer host;
• receiving, by the processor of the load balancer host, an encrypted data packet from a remote computer, wherein the encrypted data packet is to be transmitted to a destination service hosted by a destination computing node of the network;
• utilizing, by the processor of the load balancer host, a certificate established between the remote computer and the destination service to decrypt the encrypted data packet to create an unencrypted data packet;
• routing, by the processor of the load balancer host, the unencrypted data packet over the local area network from the first container to the to an intrusion detection system executing on the load balancer host in the second container to maintain the unencrypted data packet internal to the load balancer host, and control the intrusion detection system to execute intrusion detection upon the unencrypted data packet to detect whether the unencrypted data packet corresponds to malicious activity;
• establishing, by the processor of the load balancer host, a secure connection with the destination computing node;
• and
• encrypting, by the processor of the load balancer host, the unencrypted data packet to create a re-encrypted data packet and transmitting the re-encrypted data packet using the secure connection over the network to the destination computing node for processing by the destination service.