System for monitoring and managing datacenters

Patent metadata

Field	Value
Publication number	US-11528283-B2
Application number	US-202016899190-A
Country	US
Kind code	B2
Filing date	Jun 11, 2020
Priority date	Jun 5, 2015
Publication date	Dec 13, 2022
Grant date	Dec 13, 2022

Abstract

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

First claim

What is claimed is:

1. A system comprising:
one or more processors; and
memory storing instructions which, when executed by the one or more processors, cause the one or more processors to:
obtain network data from sensor processes executing in a data center, the network data being at least partly based on operation system states associated with two or more operating systems in the data center;
generate a log describing a connection between endpoints associated with one or more packets in the network data;
determine a status of the data center based on the log describing the connection between endpoints associated with one or more packets in the network data;
detect, based at least partly on the status of the data center, an indication of an attack within the data center; and
in response to the indication of the attack, modify a security policy based on the status of the data center.

2. The system of claim 1 , wherein the network data comprises a respective indication of active or previously active processes on each of the two or more operating systems.

3. The system of claim 1 , wherein at least one of the log or the network data identifies files present on the two or more operating systems.

4. The system of claim 1 , wherein at least one of the log or the network data comprises data describing packets captured by the sensor processes executing in the data center.

5. The system of claim 1 , wherein at least one of the two or more operating systems comprises a first operating system of a virtual machine or a second operating system of a hypervisor.

6. The system of claim 1 , wherein detecting the indication of the attack comprises at least one of detecting a spike in an amount of resources used by at least one of the sensor processes or detecting spoofed packets.

7. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a hidden process embedded in traffic between two or more reference points.

8. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.

9. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a packet that has a packet header field that differs from an expected header pattern.

10. A method comprising:
obtaining network data from sensor processes executing in a data center, the network data being at least partly based on operation system states associated with two or more operating systems in the data center;
generating a log describing a connection between endpoints associated with one or more packets in the network data;
determining a status of the data center based on the log describing the connection between endpoints associated with one or more packets in the network data;
detecting, based at least partly on the status of the data center, an indication of an attack within the data center; and
in response to the indication of the attack, modifying a security policy based on the status of the data center.

11. The method of claim 10 , wherein at least one of the log or the network data comprises a respective indication of active or previously active processes on each of the two or more operating systems.

12. The method of claim 10 , wherein at least one of the log or the network data identifies files present on the two or more operating systems.

13. The method of claim 10 , wherein at least one of the log or the network data comprises data describing packets captured by the sensor processes executing in the data center.

14. The method of claim 10 , wherein at least one of the two or more operating systems comprises a first operating system of a virtual machine or a second operating system of a hypervisor.

15. The method of claim 10 , wherein detecting the indication of the attack comprises at least one of detecting a spike in an amount of resources used by at least one of the sensor processes or detecting spoofed packets.

16. The method of claim 10 , wherein detecting the indication of the attack comprises detecting a hidden process embedded in traffic between two or more reference points.

17. The method of claim 10 , wherein detecting the indication of the attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.

18. A non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:
obtain network data from sensor processes executing in a data center, the network data being at least partly based on operation system states associated with two or more operating systems in the data center;
generate a log describing a connection between endpoints associated with one or more packets in the network data;
determine a status of the data center based on the log describing the connection between endpoints associated with one or more packets in the network data;
detect, based at least partly on the status of the data center, an indication of an attack within the data center; and
in response to the indication of the attack, modify a security policy based on the status of the data center.

19. The non-transitory computer-readable medium of claim 18 , wherein_at least one of the log or the network data comprises a respective indication of active or previously active processes on each of the two or more operating systems.

20. The non-transitory computer-readable medium of claim 18 , wherein at least one of the log or the network data comprises at least one of information about files present on the two or more operating systems or information describing packets captured by the sensor processes executing in the data center.

Assignees

• Cisco Tech Inc

Inventors

• Yadav Navindra
• Singh Abhishek Ranjan
• Gandham Shashidhar
• Scheib Ellen Christine
• Madani Omid
• Parandehgheibi Ali
• Pang Jackson Ngoc Ki
• Jeyakumar Vimalkumar
• Watts Michael Standish
• Nguyen Hoang Viet
• Deen Khawar
• Prasad Rohit Chandra
• Gupta Sunil Kumar
• Rao Supreeth Hosur Nagesh
• Gupta Anubhav
• Kulshreshtha Ashutosh
• Spadaro Roberto Fernando
• Vu Hai Trong
• Malhotra Varun Sagar
• Chang Shih-Chun
• Viswanathan Bharathwaj Sankara
• Rachita Agasthy Fnu
• Barlow Duane Thomas

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L43/0894

  Packet rate · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title