System and method of assigning reputation scores to hosts

A system comprising:

• one or more processors;
• and
• a computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the one or more processors to:
• receive network traffic from a first host in a network;
• extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;
• assess the connection data using a machine learning process to determine a reputation score for the first host;
• utilize the reputation score to assign the first host to a group having a group policy;
• and
• restrict traffic from the second host to the first host according to the group policy.

A non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:

• receive network traffic from a first host in a network;
• extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;
• assess the connection data using a machine learning process to determine a reputation score for the first host;
• utilize the reputation score to assign the first host to a group having a group policy;
• and
• restrict traffic from the second host to the first host according to the group policy.