US 11,706,258 B2 · Core services detection for a segmented network environment

Abstract

A segmentation server updates enforcement of a segmentation policy based on detection of core services. The segmentation server obtains characteristics of workloads and identifies workloads that provide core services using port matching, supervised learning based classification, semi supervised learning based classification, or a combination thereof. The segmentations server applies labels to workloads identified as core service providers indicative of the detection. Rules of the segmentation are distributed to enforcement modules based on the label sets of associated workloads to enable the enforcement modules to enforce the segmentation policy. Detection of core services reduces the likelihood of administrator inadvertently enforcing a policy that blocks essential core services.

Claims20

Dependent claims

A method for updating enforcement of a segmentation policy based on detection of core services, the method comprising:

receiving a set of workload characteristics associated with a workload executing on a host device;
generating based on the set of workload characteristics, a feature vector representing the set of workload characteristics;
detecting whether the workload provides a core service, the detecting based at least in part on applying a classification model to the feature vector to determine a class of the workload, the class indicating whether or not the workload provides a core service;
responsive to detecting that the workload provides the core service, assigning a label to the workload indicative of the workload providing the core service;
determining, based on a segmentation policy, a set of segmentation rules applicable to the workload based in part on the label indicative of the workload providing the core service;
and
sending the set of segmentation rules to an enforcement module associated with the host device to enable the enforcement module to enforce the set of segmentation rules applicable to the workload.

4 more elements

A non-transitory computer-readable storage medium storing instructions for updating enforcement of a segmentation policy based on detection of core services, the instructions when executed by a processor causing the processor to perform steps comprising:

receiving a set of workload characteristics associated with a workload executing on a host device;
generating based on the set of workload characteristics, a feature vector representing the set of characteristics;
detecting whether the workload provides a core service, the detecting based at least in part on applying a classification model to the feature vector to determine a class of the workload, the class indicating whether or not the workload provides a core service;
responsive to detecting that the workload provides the core service, assigning a label to the workload indicative of the workload providing the core service;
determining, based on a segmentation policy, a set of segmentation rules applicable to the workload based in part on the label indicative of the workload providing the core service;
and
sending the set of segmentation rules to an enforcement module associated with the host device to enable the enforcement module to enforce the set of segmentation rules applicable to the workload.

4 more elements

Dependencies are inferred from the claim text.

Core services detection for a segmented network environment

Life of this patent

Core services detection for a segmented network environment

Life of this patent

Abstract

Claims20