Distributed network application security policy generation and enforcement for microsegmentation

A non-transitory computer-readable medium having computer program instructions stored thereon, the computer program instructions being executable by at least one computer processor communicatively coupled to a network to perform steps of:

• receiving network communication information that describes flows between hosts in the network and applications executed on the hosts;
• generating a network communication model based on the network communication information that labels flows;
• and
• providing polices to the hosts based on the network communication model where the policies cause performance a set of actions, locally at a host, on any of the flows based on corresponding labels.

A system comprising at least one processor and memory storing instructions that, when executed, cause the at least one processor to:

• receive network communication information that describes flows between hosts in a network and applications executed on the hosts;
• generate a network communication model based on the network communication information that labels flows;
• and
• provide polices to the hosts based on the network communication model where the policies cause performance a set of actions, locally at a host, on any of the flows based on corresponding labels.