Configurable detection of network traffic anomalies at scalable virtual traffic hubs

Patent metadata

Field	Value
Publication number	US-2020162407-A1
Application number	US-201816196691-A
Country	US
Kind code	A1
Filing date	Nov 20, 2018
Priority date	Nov 20, 2018
Publication date	May 21, 2020
Grant date	—

Abstract

Packets of a network flow are received at a virtual traffic hub, which includes an action implementation layer at which routing actions generated at a decisions layer are performed. One or more properties of one or more packets of the flow are analyzed at the virtual traffic hub. An indication of an anomaly of the flow, detected based at least in part on the analysis, is provided to one or more destinations.

First claim

What is claimed is:

1 . A system, comprising:
one or more computing devices of a packet processing service; wherein the one or more computing devices include instructions that upon execution on or across one or more processors cause the one or more computing devices to:
programmatically attach a plurality of isolated networks, including a first isolated network and a second isolated network, to a virtual traffic hub established on behalf of a client of the packet processing service, wherein the virtual traffic hub comprises one or more action implementation nodes and one or more decision master nodes, wherein individual ones of the action implementation nodes implement one or more routing actions on network packets received at the virtual traffic hub, wherein the one or more routing actions are generated at the one or more decision master nodes;
determine that anomalous sequencing metrics are to be collected with respect to at least a first flow of packets processed at the virtual traffic hub, wherein at least some packets of the first flow originate at the first isolated virtual network;
compare, at the one or more action implementation nodes, (a) a respective expected sequence indicator for one or more packets of the first flow with (b) a respective actual sequence indicator of the one or more packets;
perform, at the one or more action implementation nodes, one or more of the routing actions generated at the one or more decision master nodes on the one or more packets of the first flow, resulting in a transmission of corresponding packets to one or more destinations, wherein at least some destinations of the one or more destinations are in the second isolated network; and
cause an indication of a detected anomalous packet sequence of the first flow to be provided to the client via a programmatic interface, wherein the anomalous packet sequence is detected at least in part using the comparison of the expected sequence indicators and the actual sequence indicators.

2 . The system as recited in claim 1 , wherein the determination that anomalous sequencing metrics are to be collected with respect to the first flow is based at least in part on a networking protocol being used for the first flow.

3 . The system as recited in claim 1 , wherein the determination that anomalous sequencing metrics are to be collected with respect to the first flow is based at least in part on a programmatic request indicating one or more flows for which the anomalous sequencing metrics are to be collected.

4 . The system as recited in claim 3 , wherein the programmatic request indicates, with respect to individual flows for which anomaly metrics are to be collected, one or more of: (a) a source network address, (b) a source network port, (c) a destination network address, (d) a destination network port, (e) a networking protocol, (f) a source isolated network, (g) a destination isolated network, or (h) a packet processing application category.

5 . The system as recited in claim 1 , wherein the one or more computing devices further include instructions that upon execution on or across one or more processors cause the one or more computing devices to:
obtain an indication, via a programmatic interface, of a reporting threshold for anomalous sequencing metrics of at least a second flow; and cause a filtered representation of anomalous packet sequencing metrics of the second flow to be provided to a client of a packet processing service, wherein the filtered representation is generated using the reporting threshold.

6 . A method, comprising:
performing, at one or more computing devices:
determining that anomaly metrics are to be collected with respect to at least a first flow of packets processed at a virtual traffic hub, wherein the virtual traffic hub comprises an action implementation layer and a decisions layer, wherein routing actions generated at the decisions layer are performed at the action implementation layer on packets received at the action implementation layer from one or more isolated networks;
comparing, at one or more nodes of the virtual traffic hub, (a) a respective expected property of one or more packets of the first flow with (b) a respective actual property of the one or more packets; and
causing an indication of a detected anomaly of the first flow to be provided to one or more destinations, wherein the anomaly is detected at least in part using the comparison of the expected property and the actual property.

7 . The method as recited in claim 6 , wherein determining that anomaly metrics are to be collected for the first flow is based at least in part on identifying a communication protocol being used for the first flow.

8 . The method as recited in claim 7 , wherein the communication protocol comprises one or more of: (a) the Transmission Control Protocol (TCP), (b) the Internet Control Message Protocol (ICMP).

9 . The method as recited in claim 6 , wherein determining that the anomaly metrics are to be collected for the first flow is based at least in part on a programmatic request from a client of a packet processing service.

10 . The method as recited in claim 9 , wherein the programmatic request indicates, with respect to individual flows for which anomaly metrics are to be collected, one or more of: (a) a source network address, (b) a source network port, (c) a destination network address, (d) a destination network port, (e) a networking protocol, (f) a source isolated network, (g) a destination isolated network, or (h) a packet processing application category.

11 . The method as recited in claim 6 , further comprising performing, by the one or more computing devices:
obtaining an indication, via a programmatic interface, of a reporting threshold for anomaly metrics; and causing a filtered representation of anomaly metrics to be provided to a client of a packet processing service, wherein the filtered representation is generated using the reporting threshold.

12 . The method as recited in claim 6 , wherein the one or more destinations includes a device of a client of a packet processing service, further comprising performing, by the one or more computing devices:
causing a notification mechanism, specified programmatically by the client, to be used to present the indication of a detected anomaly at the device o the client.

13 . The method as recited in claim 6 , wherein the expected property comprises a sequence indicator, the method further comprising performing, at the one or more computing devices:
generating, at the decisions layer, an executable action corresponding to the first flow, wherein the action comprises a directive to (a) store an indication, at the action implementation layer, of the expected sequence indicator of packets of the first flow and (b) compare the expected sequence indicator with an actual sequence indicator; and transmitting the executable action from the decisions layer to the action implementation layer in response to a request from the action implementation layer.

14 . The method as recited in claim 6 , wherein the virtual traffic hub is established at a provider network, wherein the indication of the detected anomaly triggers a configuration change of one or more resources of the provider network.

15 . The method as recited in claim 6 , further comprising performing, by the one or more computing devices:
obtaining a machine learning model trained to analyze network traffic data collected at the virtual traffic hub; utilizing the machine learning model to detect at least one anomalous traffic pattern of a flow; and providing an indicati

Assignees

• Amazon Tech Inc

Inventors

• Tillotson Paul John

Classifications

• H04L49/555 Primary

  Error detection · CPC title

• H04L49/70 Primary

  Virtual switches · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• H04L43/0847

  Transmission error · CPC title

• H04L45/64

  using an overlay routing layer · CPC title