Malicious virtual machine alert generator
AssigneeEmpire Technology Development LLC
InventorsGUANG YAO, SHIJIE XU, QI LI, XUEFENG SONG
Life of this patent
Estimating the term…
Abstract
Technologies are generally described for methods and systems effective to generate an alert in a data center. In some examples, a device may detect an execution of a virtual machine in the data center. The device may also analyze traffic data at a port that may be in the data center. The traffic data may be associated with a communication from the virtual machine to a destination address through the port. The device may also compare the destination address with a data center address of the data center. The device may also generate the alert based on the comparison.
Claims20
A method to generate an alert, the method comprising, by a device:
- detecting an execution of a virtual machine in a data center;
- analyzing traffic data at a port in the data center, wherein the traffic data is associated with a communication from the virtual machine to a destination address through the port;
- comparing the destination address with a data center address of the data center;
- and
- generating the alert based on the comparison.
A system effective to generate an alert in a data center, the system comprising:
- a memory configured to store a data center address of the data center;
- a port;
- a processor configured to be in communication with the memory and the port, the processor being configured to execute a virtual machine in the data center;
- a device configured to be in communication with the memory, the port, and the processor, the device being configured to:
- detect the execution of a virtual machine;
- analyze traffic data at the port, wherein the traffic data is associated with a communication from the virtual machine to a destination address through the port;
- compare the destination address with the data center address;
- and
- generate the alert based on the comparison.
A device effective to generate an alert in a data center, the device comprising:
- a memory configured to store a threshold;
- a counter configured to store a count;
- a processor configured to be in communication with the memory and the counter, the processor being configured to:
- receive a data center address of the data center;
- detect an execution of a virtual machine in the data center;
- analyze traffic data at a port of the data center, wherein the traffic data is associated with a communication from the virtual machine to a destination address through the port;
- compare the destination address with the data center address;
- control the counter to increment the count based on the comparison of the destination address with the data center address;
- compare the count with the threshold;
- and
- generate the alert based on the comparison of the count with the threshold.
Dependencies are inferred from the claim text.