Transparent migration of virtual network functions

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instruction that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• identifying a middlebox receiving network flow between virtual network endpoints in a virtual network layer;
• performing, using the middlebox, stateful network functions in the virtual network layer using the received network flow between the virtual network endpoints, and communicating with one or more backend virtual machines corresponding to the virtual network endpoints;
• receiving flow statistics corresponding to the network flow of the middlebox;
• identifying, based on the flow statistics, an uncommon type of network flow from the network flow, the uncommon type of network flow comprising outlier flow statistics of the flow statistics;
• identifying one or more connections associated with the uncommon type of network flow;
• migrating the one or more connections associated with the uncommon type of network flow from the middlebox to an end host;
• after migrating the one or more connections associated with the uncommon type of network flow from the middlebox to the end host, determining whether the flow statistics satisfy an offload rule, the offload rule indicating when to migrate the network flow from the middlebox to the end host;
• and
• when the flow statistics satisfy the offload rule, migrating the network flow from the middlebox to the end host.