# US 12,225,056 B2 · Core services detection for a segmented network environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,056 B2
- Document ID: US12225056B2
- Status: Granted
- Kind: B2
- Application number: 18/204,038
- Filed: 2023-05-31
- Published: 2023-09-28
- Granted: 2025-02-11
- Earliest claimed: 2019-09-12
- Assignees: Illumio, Inc.
- Applicants: Illumio, Inc.
- Inventors: Paul James Kirner; Pallavi Tyagi
- Web page: https://patentgrep.com/patent/US12225056B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06N 20/00: Machine learning
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0272: {Virtual private networks}
- H04L 63/164: {at the network layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A segmentation server updates enforcement of a segmentation policy based on detection of core services. The segmentation server obtains characteristics of workloads and identifies workloads that provide core services using port matching, supervised learning based classification, semi supervised learning based classification, or a combination thereof. The segmentations server applies labels to workloads identified as core service providers indicative of the detection. Rules of the segmentation are distributed to enforcement modules based on the label sets of associated workloads to enable the enforcement modules to enforce the segmentation policy. Detection of core services reduces the likelihood of administrator inadvertently enforcing a policy that blocks essential core services.

## Claims

### Claim 1

A method for detecting workloads that provide core services in a network, the method comprising:
receiving a set of workload characteristics associated with a workload;
detecting, based on the set of workload characteristics, whether the workload provides a core service; and
responsive to detecting that the workload provides the core service, assigning a label to the workload indicative of the workload providing the core service.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining, based on a segmentation policy, a set of segmentation rules applicable to the workload based on the label indicative of the workload providing the core service; and
sending the set of segmentation rules to an enforcement module associated with a host device on which the workload is executing, the set of segmentation rules enabling the enforcement module to enforce the set of segmentation rules applicable to the workload.

### Claim 3 (depends on 1)

The method of claim 1, wherein detecting whether the workload provide the core service comprises:
generating, based on the set of workload characteristics, a feature vector representing the set of characteristics; and
applying a classification model to the feature vector to determine a class of the workload, the class indicating whether the workload provides the core service.

### Claim 4 (depends on 3)

The method of claim 3, wherein the classification model is a semi-supervised learning-based classification model, and applying the classification model comprises:
applying a clustering algorithm to map the feature vector to a cluster of a set of clusters of workloads, wherein at least one of the workloads in the cluster is verified as being a core service provider; and
classifying the workload based on the clustering algorithm.

### Claim 5 (depends on 3)

The method of claim 3, wherein generating the feature vector comprises:
generating the feature vector to encode process information associated with processes executed by the workload.

### Claim 6 (depends on 3)

The method of claim 3, wherein generating the feature vector comprises:
determining that process information associated with processes executed by the workload is not available for the workload; and
responsive to determining that the process information is not available, generating the feature vector based on port information of the workload.

### Claim 7 (depends on 3)

The method of claim 3, wherein the feature vector comprises a sequence of values in which each of the values comprises a binary representation of whether the workload exhibits one of the set of characteristics.

### Claim 8 (depends on 1)

The method of claim 1, wherein detecting whether the workload provides the core service comprises:
performing a comparison of a set of operating ports of the workload to a list of ports associated with a set of core services; and
detecting that the workload provides the core service responsive to the set operating ports having a match in the list of ports.

### Claim 9 (depends on 8)

The method of claim 8, wherein performing the comparison of the set of operating ports of the workload to a list of ports associated with a set of core services comprises:
detecting ports of the workload that are associated with connections meeting criteria of occurring at least a predefined number of times within a predefined time window,
wherein the set of operating ports using in the comparison include only the ports associated with the connections meeting the criteria.

### Claim 10 (depends on 8)

The method of claim 8, wherein performing the comparison of the set of operating ports of the workload to a list of ports associated with a set of core services comprises:
detecting ports of the workload exhibiting port scanning behavior,
wherein the set of operating ports using in the comparison exclude the ports exhibiting the port scanning behavior.

### Claim 11

A non-transitory computer-readable medium storing instructions for detecting workloads that provide core services in a network, the instructions, when executed by a computing system, causing the computing system to perform operations comprising:
receiving a set of workload characteristics associated with a workload;
detecting, based on the set of workload characteristics, whether the workload provides a core service; and
responsive to detecting that the workload provides the core service, assigning a label to the workload indicative of the workload providing the core service.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the operations further comprise:
determining, based on a segmentation policy, a set of segmentation rules applicable to the workload based on the label indicative of the workload providing the core service; and
sending the set of segmentation rules to an enforcement module associated with a host device on which the workload is executing, the set of segmentation rules enabling the enforcement module to enforce the set of segmentation rules applicable to the workload.

### Claim 13 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein detecting whether the workload provide the core service comprises:
generating, based on the set of workload characteristics, a feature vector representing the set of characteristics; and
applying a classification model to the feature vector to determine a class of the workload, the class indicating whether the workload provides the core service.

### Claim 14 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the classification model is a semi-supervised learning-based classification model, and applying the classification model comprises:
applying a clustering algorithm to map the feature vector to a cluster of a set of clusters of workloads, wherein at least one of the workloads in the cluster is verified as being a core service provider; and
classifying the workload based on the clustering algorithm.

### Claim 15 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein generating the feature vector comprises:
generating the feature vector to encode process information associated with processes executed by the workload.

### Claim 16 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein generating the feature vector comprises:
determining that process information associated with processes executed by the workload is not available for the workload; and
responsive to determining that the process information is not available, generating the feature vector based on port information of the workload.

### Claim 17 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the feature vector comprises a sequence of values in which each of the values comprises a binary representation of whether the workload exhibits one of the set of characteristics.

### Claim 18 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein detecting whether the workload provides the core service comprises:
performing a comparison of a set of operating ports of the workload to a list of ports associated with a set of core services; and
detecting that the workload provides the core service responsive to the set operating ports having a match in the list of ports.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein performing the comparison of the set of operating ports of the workload to a list of ports associated with a set of core services comprises:
detecting ports of the workload that are associated with connections meeting criteria of occurring at least a predefined number of times within a predefined time window,
wherein the set of operating ports using in the comparison include only the ports associated with the connections meeting the criteria.

### Claim 20 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein performing the comparison of the set of operating ports of the workload to a list of ports associated with a set of core services comprises:
detecting ports of the workload exhibiting port scanning behavior,
wherein the set of operating ports using in the comparison exclude the ports exhibiting the port scanning behavior.