Software defined anomaly detection for workloads

A computer-implemented method associated with a cloud computing environment, comprising:

• arranging for a virtual machine of the cloud computing environment to execute a target application workload to be intercepted;
• intercepting, by a computer processor of a software defined anomaly detection engine separate from the target application workload that is also executing in the virtual machine to intercept the target application workload, network traffic that is external to the virtual machine and associated with the target application workload;
• automatically executing an anomaly detection algorithm in substantially real time on the intercepted network traffic to generate an intercept result;
• and
• transmitting an anomaly detection alert signal based on a comparison of the intercept result and an anomaly threshold value.

A system comprising:

• at least one programmable processor;
• and
• a non-transitory machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations associated with a cloud computing environment, including:
• arranging for a Kubernetes container orchestration system cluster of the cloud computing environment to execute a target application workload to be intercepted,
• intercepting, by a computer processor of a software defined anomaly detection engine, that is separate from the target application workload and that is also executing in the cluster to intercept the target application workload, network traffic that is external to the cluster and associated with the target application workload,
• automatically executing an anomaly detection spectral residual algorithm in substantially real time on the intercepted network traffic to generate an intercept result, and
• transmitting an anomaly detection alert signal based on a comparison of the intercept result and an anomaly threshold value.