Intent-based policy generation for virtual networks

A policy controller for a computer network, the policy controller comprising processing circuitry and configured to:

• receive traffic statistics for a plurality of traffic flows among first instances of a plurality of application workloads, the first instances of the plurality of application workloads executed by a first set of one or more computing devices of a computer network;
• apply a clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of the traffic statistics for the plurality of application workloads;
• generate, from the session records of traffic statistics for the plurality of application workloads, one or more tags for the plurality of application workloads;
• generate, using relationships between the one or more tags for the plurality of application workloads and the session records of the traffic statistics, one or more application firewall policies for application to the traffic flows between application workloads of the plurality of application workloads, wherein the one or more application firewall policies define whether the traffic flows between the application workloads of the plurality of application workloads are to be allowed or denied;
• and
• distribute the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows among second instances of the plurality of application workloads, the second instances of the plurality of application workloads executed by the second set of one or more computing devices, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.

A non-transitory, computer-readable medium comprising instructions that, when executed, are configured to cause processing circuitry to execute a policy controller for a computer network, the policy controller configured to:

• receive traffic statistics for a plurality of traffic flows among first instances of a plurality of application workloads, the first instances of the plurality of application workloads executed by a first set of one or more computing devices of a computer network;
• apply a clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads;
• generate, from the session records of traffic statistics for the plurality of application workloads, one or more tags for the plurality of application workloads;
• generate, using relationships between the one or more tags for the plurality of application workloads and the session records of the traffic statistics, one or more application firewall policies for application to the traffic flows between application workloads of the plurality of application workloads, wherein the one or more application firewall policies define whether the traffic flows between the application workloads of the plurality of application workloads are to be allowed or denied;
• and
• distribute the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows among second instances of the plurality of application workloads, the second instances of the plurality of application workloads executed by the second set of one or more computing devices, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.