Security threat detection based on process information

#Virtualization allows the abstraction and pooling of hardware resources to support virtual machines in a software-defined data center (SDDC). For example, through server virtualization, virtualized computing instances such as virtual machines (VMs) running different operating systems may be supported by the same physical machine (e.g., referred to as a “host”). Each VM is generally provisioned with virtual resources to run a guest operating system and applications. The virtual resources may include central processing unit (CPU) resources, memory resources, storage resources, network resources, etc. In practice, it is desirable to detect potential security threats that may affect the performance of hosts and VMs in the SDDC.

#FIG. 1 is a schematic diagram illustrating an example software-defined networking (SDN) environment in which security threat detection based on process information may be performed;

#FIG. 2 is a schematic diagram illustrating an example security threat detection based on process information in an SDN environment;

#FIG. 3 is a flowchart of an example process for a computer system to perform security threat detection based on process information in an SDN environment;

#In the following detailed description, reference is made to the accompanying drawings, which form a part hereof. In the drawings, similar symbols typically identify similar components, unless context dictates otherwise. The illustrative embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be utilized, and other changes may be made, without departing from the spirit or scope of the subject matter presented here. It will be readily understood that the aspects of the present disclosure, as generally described herein, and illustrated in the drawings, can be arranged, substituted, combined, and designed in a wide variety of different configurations, all of which are explicitly contemplated herein.

#Challenges relating to data center security will now be explained in more detail using FIG. 1, which is a schematic diagram illustrating example software-defined networking (SDN) environment 100 in which security threat detection based on process information may be performed. It should be understood that, depending on the desired implementation, SDN environment 100 may include additional and/or alternative components than that shown in FIG. 1. Although the terms “first” and “second” are used to describe various elements, these elements should not be limited by these terms. These terms are used to distinguish one element from another. For example, a first element may be referred to as a second element, and vice versa.

#SDN environment 100 includes multiple hosts 110A-B that are inter-connected via physical network 105. Each host 110A/110B may include suitable hardware 112A/112B and virtualization software (e.g., hypervisor-A 114A, hypervisor-B 114B) to support various VMs. For example, hosts 110A-B may support respective VMs 131-134. Hardware 112A/112B includes suitable physical components, such as central processing unit(s) (CPU(s)) or processor(s) 120A/120B; memory 122A/122B; physical network interface controllers (NICs) 124A/124B; and storage disk(s) 126A/126B, etc. In practice, SDN environment 100 may include any number of hosts (also known as a “host computers”, “host devices”, “physical servers”, “server systems”, “transport nodes,” etc.), where each host may be supporting tens or hundreds of virtual machines (VMs).