Self-learning packet flow monitoring in software-defined networking environments

A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of self-learning packet flow monitoring, wherein the method comprises:

• monitoring a packet flow to identify attribute information associated with the packet flow between a source virtualized computing instance and a destination virtualized computing instance;
• based on the attribute information, classifying the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow;
• providing, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output, wherein the visualization comprises a topology graph that graphically displays a visual representation of the source virtualized computing instance, the destination virtualized computing instance, and the packet flow between the source virtualized computing instance and the destination virtualized computing instance;
• requesting, via the UI, a feedback associated with the classification output for the packet flow, wherein the classification output indicates an issue with the packet flow;
• suggesting, via the UI, a remediation action to address the issue indicated by the classification output, wherein the suggested remediation action includes configuration of a distributed firewall (DFW) rule, implemented by a hypervisor, to block the packet flow;
• and
• based on the feedback from the user device, updating the classification engine or the training dataset.

A computer system, comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to:
• monitor a packet flow to identify attribute information associated with the packet flow between a source virtualized computing instance and a destination virtualized computing instance;
• based on the attribute information, classify the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow;
• provide, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output, wherein the visualization comprises a topology graph that graphically displays a visual representation of the source virtualized computing instance, the destination virtualized computing instance, and the packet flow between the source virtualized computing instance and the destination virtualized computing instance;
• request, via the UI, a feedback associated with the classification output for the packet flow, wherein the classification output indicates an issue with the packet flow;
• suggest, via the UI, a remediation action to address the issue indicated by the classification output, wherein the suggested remediation action includes configuration of a distributed firewall (DFW) rule, implemented by a hypervisor, to block the packet flow;
• and
• based on the feedback from the user device, update the classification engine or the training dataset.