Probe-based virtual network sensitive data traffic detection

A computing system comprising:

• at least one processor;
• and
• memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
• detect a plurality of workloads in a virtual network in a computing environment, the plurality of workloads being operationally isolated from one or more other virtual networks in the computing environment;
• deploy a plurality of probe agents to the plurality of workloads, wherein each respective probe agent of the plurality of probe agents is configured to:
• detect a data packet in network traffic on a respective workload of the plurality of workloads, the data packet being at least one of:
• sent by the respective workload to another workload in the virtual network, or
• received by the respective workload from another workload in the virtual network,
• scan the data packet to extract a packet payload from the data packet, and
• generate a data classification of the packet payload in response to a determination that the packet payload includes at least one instance of one or more pre-defined data patterns of a target data type, the target data type comprising at least one of a sensitive data type or a private data type;
• receive a scan result from a respective agent of the plurality of probe agents, wherein the scan result includes a representation of the respective packet payload scanned by the respective probe agent and the data classification of the respective packet payload;
• and
• perform a computing action based on the scan result.

A computing system comprising:

• at least one processor;
• memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
• a probe agent deployment component configured to deploy a probe agent to a first workload in a virtual private network in a cloud environment, the probe agent configured to detect network traffic representing data movement between a second workload in the virtual private network and the first workload in the virtual private network;
• a result detection component configured to detect a scan result indicative of a data packet in the network traffic detected by the probe agent, wherein the scan result includes packet payload information and an indication of a sensitive data classification relative to the data packet;
• and
• a graph generator component configured to generate a graph representation that shows a traffic path of data movement between the second workload and the first workload, wherein the graph representation comprises a first node representing the first workload, a second node representing the second workload, and an edge between the first node and second node, the edge representing the packet payload information and the sensitive data classification.