Technologies for managing compromised sensors in virtualized environments

A system comprising:

• one or more processors;
• and
• one or more computer-readable storage devices having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch;
• comparing characteristics of the data to determine a difference in the characteristics;
• based on the difference, determining a state of at least one of the plurality of capturing agents, comprising:
• determining an indication of a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch;
• and
• determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices;
• wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices.

A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:

• receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch;
• comparing characteristics of the data to determine a difference in the characteristics;
• based on the difference, determining a state of at least one of the plurality of capturing agents, comprising:
• determining an indication of a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch;
• and
• determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices;
• wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices.