Network traffic data in virtualized environments

Patent metadata

Field	Value
Publication number	US-10133591-B2
Application number	US-201715430957-A
Country	US
Kind code	B2
Filing date	Feb 13, 2017
Priority date	Feb 19, 2013
Publication date	Nov 20, 2018
Grant date	Nov 20, 2018

Abstract

Approaches are described for collecting and/or utilizing network traffic information, such as network flow data, within a virtualized computing environment. The network traffic information can be collected on one or more host computing devices that host virtual machines. The collected network traffic information can include virtualized computing environment specific information, such as a user account identifier (ID), virtual machine identifier (ID), session termination information and the like. The collected network traffic information can also be presented to the user of the virtualized computing environment.

First claim

What is claimed is:

1. A computer implemented method, comprising:
under the control of one or more computer systems configured with executable instructions,
provisioning a virtual machine on a host computing device, the virtual machine being hosted on a virtualization layer of the host computing device;
collecting, by an agent in the virtualization layer, network traffic data related to one or more sequences of network packets transmitted on the host computing device;
adding service provider information to the collected network traffic data, the service provider information including a customer account identifier and a virtual machine identifier; and
sending the network traffic data from the host computing device to a network data collector external to the host computing device.

2. The computer implemented method of claim 1 , wherein the customer account identifier is assigned to a customer associated with the virtual machine instance executing on the host computing device, the method further comprising:
providing at least a portion of the generated network traffic data to a client device.

3. The computer implemented method of claim 2 , further comprising:
adding to the network traffic data, information indicating at least one of: a normal session termination, a denial based at least in part on a policy of a service provider, a denial based at least in part on a security policy of a customer account, a throttling by abuse mitigation, or a throttling by denial of service (DOS) mitigation.

4. The computer implemented method of claim 1 , further comprising:
executing one or more queries on the network traffic data; and
identifying, based at least in part upon the one or more queries, systems that the virtual machine has communicated with at least once within a threshold duration of time.

5. The computer implemented method of claim 1 , further comprising:
storing the network traffic data in one or more state tracking tables in the virtualization layer before sending the network traffic data.

6. The computer implemented method of claim 1 , further comprising:
filtering the network traffic data based at least in part on the customer account identifier to produce a subset of the network traffic data related to one or more virtual machines of a customer; and
exposing the subset of the network traffic data to the customer by presenting the subset of the network traffic data in a format that corresponds to the format used by network router devices to store the network traffic data.

7. The computer implemented method of claim 6 , wherein presenting the subset of the network traffic data in the format that corresponds to the format used by network router devices further comprises:
recording the identifier for the virtual machine in the ingress port field or the egress port field of a network flow record.

8. The computer implemented method of claim 1 , wherein generating the network traffic data further comprises:
generating information identifying a virtual interface identifier, a virtual network of a customer account identified by the customer account identifier, a security group associated with the customer account, or one or more latency statistics.

9. A computer implemented method, comprising:
under the control of one or more computer systems configured with executable instructions,
collecting a plurality of network flow records for virtual machines from one or more host computing devices, wherein each host computing device includes a respective virtualization layer and an agent in the virtualization layer collects the plurality of network flow records for the host computing device, and wherein each network flow record is for a sequence of network packets transmitted to or from the one or more host computing devices;
adding service provider information to the collected network flow records, the service provider information including a customer account identifier and a virtual machine identifier; and
sending the network flow records from the one or more host computing devices to a network data collector external to the one or more host computing devices.

10. The computer implemented method of claim 9 , further comprising:
providing at least a portion of information from the network flow records for access to a client device in a format that corresponds to the format used by network router devices to generate network flow records.

11. The computer implemented method of claim 9 , further comprising:
receiving, from a client device, at least one application programming interface (API) call to configure the collecting of the plurality of network flow records; and
initiating the collection of the network flow records in response to the API call.

12. The computer implemented method of claim 9 , further comprising:
inspecting one or more network packets for a new source IP address and destination IP address combination; and
determining whether a new flow of network packets has begun, based at least in part upon the inspection.

13. The computer implemented method of claim 9 , wherein a virtual machine identifier is assigned to each virtual machine executing on the one or more host computing devices, the virtual machines are part of a virtual network of a customer, and the virtual network includes a virtual router.

14. The computer implemented method of claim 13 , further comprising:
generating a virtual network device network flow record from information in the network flow records, wherein the virtual network device network flow record is formatted as having been collected by the virtual router of the virtual network.

15. The computer implemented method of claim 9 , further comprising:
identifying a reason for terminating one or more sequences of network packets, wherein identifying the reason includes receiving information indicating one of: a normal session termination, a denial based at least in part on a policy of a service provider, a denial based at least in part on a security policy of the customer account, a throttling by abuse mitigation, or a throttling by denial of service (DOS) mitigation.

16. The computer implemented method of claim 9 , further comprising:
before sending the network flow records, storing the network flow records collected on each of the one or more host computing devices in a file corresponding to the respective host computing device; and
aggregating the network flow records in each file corresponding to the respective host computing device into a single network flow record file corresponding to the virtual network.

17. The computer implemented method of claim 9 , further comprising:
receiving an invocation of at least one application programming interface (API) to retrieve the network flow records; and
providing a subset of the network flow records for access to the client device in response to the invocation of the API.

18. A computing system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the computing system to:
provision one or more virtual machines on a host computing device, the one or more virtual machines hosted on a virtualization layer of the host computing device;
collect, by an agent in the virtualization layer, network traffic data related to one or more sequences of network packets transmitted on the host computing device;
add service provider information to the collected network traffic data, the service provider information including a customer account identifier and a virtual machine identifier

Assignees

• Amazon Tech Inc

Inventors

• Brandwine Eric Jason
• Dokey Aaron Douglas
• Jayamohan Ajith
• Searle Ian Roger

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L29/06877

  Electricity · mapped topic

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L47/2441

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title