# US 11,909,653 B2 · Self-learning packet flow monitoring in software-defined networking environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,653 B2 - Document ID: US11909653B2 - Status: Granted - Kind: B2 - Application number: 16/744,131 - Filed: 2020-01-15 - Published: 2021-07-15 - Granted: 2024-02-20 - Earliest claimed: 2020-01-15 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Mengzhuo Lu; Margaret Petrus - Web page: https://patentgrep.com/patent/US11909653B2 ## CPC - H04L 43/026: using flow identification - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 3/091: Active learning - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/16: using machine learning or artificial intelligence - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - G06N 20/00: Machine learning - H04L 41/0894: Policy-based network configuration management - H04L 41/14: Network analysis or design - H04L 41/149: for prediction of maintenance - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 43/028: by filtering - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 43/0811: by checking connectivity - H04L 43/16: Threshold monitoring - H04L 45/74: Address processing for routing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Example methods and systems for self-learning packet flow monitoring. One example method may comprise monitoring a packet flow to identify attribute information associated with the packet flow between a source and a destination; and classifying the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow. The example method may also comprise providing, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output; requesting, via the UI, a feedback associated with the classification output for the packet flow; and updating the classification engine or the training dataset based on the feedback from the user device. ## Claims ### Claim 1 A method for a computer system to perform self-learning packet flow monitoring, wherein the method comprises: monitoring a packet flow to identify attribute information associated with the packet flow between a source virtualized computing instance and a destination virtualized computing instance; based on the attribute information, classifying the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow; providing, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output, wherein the visualization comprises a topology graph that graphically displays a visual representation of the source virtualized computing instance, the destination virtualized computing instance, and the packet flow between the source virtualized computing instance and the destination virtualized computing instance; requesting, via the UI, a feedback associated with the classification output for the packet flow, wherein the classification output indicates an issue with the packet flow; suggesting, via the UI, a remediation action to address the issue indicated by the classification output, wherein the suggested remediation action includes configuration of a distributed firewall (DFW) rule, implemented by a hypervisor, to block the packet flow; and based on the feedback from the user device, updating the classification engine or the training dataset. ### Claim 2 (depends on 1) The method of claim 1, wherein classifying the packet flow comprises: processing the attribute information using multiple layers of the classification engine to determine the classification output. ### Claim 3 (depends on 1) The method of claim 1, wherein classifying the packet flow comprises: determining the classification output to indicate whether the packet flow is suspicious or not suspicious based on the attribute information associated with the packet flow, wherein the packet flow between the source virtualized computing instance and the destination virtualized computing instance is between one or more of: the source virtualized computing instance and the destination virtualized computing instance, a source group that includes the source virtualized computing instance and a destination group that includes the destination virtualized computing instance, or a source process supported by the source virtualized computing instance and a destination process supported by the destination virtualized computing instance. ### Claim 4 (depends on 1) The method of claim 1, wherein providing the UI comprises: providing the UI that includes the visualization of a mesh of multiple packet flows and multiple classification outputs for the respective multiple packet flows. ### Claim 5 (depends on 1) The method of claim 1, wherein requesting the feedback comprises: providing, to the user device, a first UI element to request for an acceptance of the classification output or a second UI element to request for a rejection of the classification output, or both. ### Claim 6 (depends on 5) The method of claim 5, wherein updating the classification engine comprises: in response to detecting the rejection of the classification output, updating the training dataset to include the packet flow, the classification output, and the rejection of the classification output. ### Claim 7 (depends on 1) The method of claim 1, further comprising: training the classification engine using the training dataset that includes multiple training packet flows and respective multiple training outputs, wherein the classification engine is a rule-based decision tree or an artificial intelligence machine. ### Claim 8 A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of self-learning packet flow monitoring, wherein the method comprises: monitoring a packet flow to identify attribute information associated with the packet flow between a source virtualized computing instance and a destination virtualized computing instance; based on the attribute information, classifying the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow; providing, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output, wherein the visualization comprises a topology graph that graphically displays a visual representation of the source virtualized computing instance, the destination virtualized computing instance, and the packet flow between the source virtualized computing instance and the destination virtualized computing instance; requesting, via the UI, a feedback associated with the classification output for the packet flow, wherein the classification output indicates an issue with the packet flow; suggesting, via the UI, a remediation action to address the issue indicated by the classification output, wherein the suggested remediation action includes configuration of a distributed firewall (DFW) rule, implemented by a hypervisor, to block the packet flow; and based on the feedback from the user device, updating the classification engine or the training dataset. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein classifying the packet flow comprises: processing the attribute information using multiple layers of the classification engine to determine the classification output. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein classifying the packet flow comprises: determining the classification output to indicate whether the packet flow is suspicious or not suspicious based on the attribute information associated with the packet flow, wherein the packet flow between the source virtualized computing instance and the destination virtualized computing instance is between one or more of: the source virtualized computing instance and the destination virtualized computing instance, a source group that includes the source virtualized computing instance and a destination group that includes the destination virtualized computing instance, or a source process supported by the source virtualized computing instance and a destination process supported by the destination virtualized computing instance. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein providing the UI comprises: providing the UI that includes the visualization of a mesh of multiple packet flows and multiple classification outputs for the respective multiple packet flows. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein requesting the feedback comprises: providing, to the user device, a first UI element to request for an acceptance of the classification output or a second UI element to request for a rejection of the classification output, or both. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein updating the classification engine comprises: in response to detecting the rejection of the classification output, updating the training dataset to include the packet flow, the classification output, and the rejection of the classification output. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the method further comprises: training the classification engine using the training dataset that includes multiple training packet flows and respective multiple training outputs, wherein the classification engine is a rule-based decision tree or an artificial intelligence machine. ### Claim 15 A computer system, comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to: monitor a packet flow to identify attribute information associated with the packet flow between a source virtualized computing instance and a destination virtualized computing instance; based on the attribute information, classify the packet flow using a classification engine that is trained using a training dataset to determine a classification output associated with the packet flow; provide, to a user device, a user interface (UI) that includes a visualization of the packet flow and the classification output, wherein the visualization comprises a topology graph that graphically displays a visual representation of the source virtualized computing instance, the destination virtualized computing instance, and the packet flow between the source virtualized computing instance and the destination virtualized computing instance; request, via the UI, a feedback associated with the classification output for the packet flow, wherein the classification output indicates an issue with the packet flow; suggest, via the UI, a remediation action to address the issue indicated by the classification output, wherein the suggested remediation action includes configuration of a distributed firewall (DFW) rule, implemented by a hypervisor, to block the packet flow; and based on the feedback from the user device, update the classification engine or the training dataset. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the instructions that cause the processor to classify the packet flow cause the processor to: process the attribute information using multiple layers of the classification engine to determine the classification output. ### Claim 17 (depends on 15) The computer system of claim 15, wherein the instructions that cause the processor to classify the packet flow cause the processor to: determine the classification output to indicate whether the packet flow is suspicious or not suspicious based on the attribute information associated with the packet flow, wherein the packet flow between the source virtualized computing instance and the destination virtualized computing instance is between one or more of: the source virtualized computing instance and the destination virtualized computing instance, a source group that includes the source virtualized computing instance and a destination group that includes the destination virtualized computing instance, or a source process supported by the source virtualized computing instance and a destination process supported by the destination virtualized computing instance. ### Claim 18 (depends on 15) The computer system of claim 15, wherein the instructions that cause the processor to provide the UI cause the processor to: provide the UI that includes the visualization of a mesh of multiple packet flows and multiple classification outputs for the respective multiple packet flows. ### Claim 19 (depends on 15) The computer system of claim 15, wherein the instructions that cause the processor to request the feedback cause the processor to: provide, to the user device, a first UI element to request for an acceptance of the classification output or a second UI element to request for a rejection of the classification output, or both. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the instructions that cause the processor to update the classification engine cause the processor to: in response to detecting the rejection of the classification output, update the training dataset to include the packet flow, the classification output, and the rejection of the classification output. ### Claim 21 (depends on 15) The computer system of claim 15, wherein the instructions further cause the processor to: train the classification engine using the training dataset that includes multiple training packet flows and respective multiple training outputs, wherein the classification engine is a rule-based decision tree or an artificial intelligence machine.