Managing a segmentation policy based on attack pattern detection

Patent metadata

Field	Value
Publication number	US-2021144159-A1
Application number	US-201916677488-A
Country	US
Kind code	A1
Filing date	Nov 7, 2019
Priority date	Nov 7, 2019
Publication date	May 13, 2021
Grant date	—

Abstract

A policy management server detects attack patterns in traffic flows reported by distributed enforcement modules enforcing the segmentation policy. The policy management server generates a traffic flow graph representing traffic flows between workloads or groups of workloads. Traffic flows matching one or more traffic flow patterns may be tagged in the traffic flow graph. For example, if an attack pattern is present in a connection that is blocked under the segmentation policy, the policy management server may block updates to the segmentation policy that attempt to enable the connection or may alert an administrator prior to enabling the update. If an attack pattern is present in a connection that is allowed under the segmentation policy, the segmentation policy may be updated to block the connection, alert an administrator, redirect traffic to a deception service, or take other remedial action.

First claim

1 . A method for generating a traffic flow graph representing traffic in a segmented network environment, the method comprising:
storing, by a policy management server, a plurality of traffic pattern rules for detecting traffic patterns indicative of malicious behavior; receiving, from a plurality of distributed enforcement modules, traffic flow data associated with a plurality of workloads managed by the plurality of distributed enforcement modules, the traffic flow data including blocked connection attempts and successful connections; processing, by the policy management server, the traffic flow data to identify a traffic flow between a first workload and a second workload that meets a matching traffic pattern rule selected from the plurality of traffic pattern rules; tagging the identified traffic flow with metadata tags indicating that the identified traffic flow corresponds to attack traffic; generating the traffic flow graph representing the traffic flow data and including the metadata tags for the identified traffic flow corresponding to the attack traffic; and providing the traffic flow graph to an application for generating or updating a segmentation policy.

2 . The method of claim 1 , wherein providing the traffic flow graph comprises:
generating a visual representation of the traffic flow graph in which a first node represents the first workload, a second node represents the second workload, and an edge between the first node and the second node represents the traffic flow between the first workload and the second workload, and in which a visual indicator represents the tagged metadata indicating that the traffic flow corresponds to the attack traffic.

3 . The method of claim 1 , further comprising:
receiving, from an application on an administrator client, a request for information about the traffic flow; and responsive to the request, providing the information about the traffic flow together with the tagged metadata indicating that the traffic flow corresponds to the attack traffic.

4 . The method of claim 1 , wherein processing the traffic flow data comprises:
transmitting the plurality of traffic pattern rules to the first workload; receiving from the first workload, first traffic flow data corresponding to traffic between the first workload and the second workload; and receiving an indication from the first workload that the first traffic flow data meets the matching traffic pattern rule.

5 . The method of claim 1 , wherein processing the traffic flow data comprises:
receiving from the first workload, first traffic flow data corresponding to traffic between the first workload and the second workload; and applying the plurality of traffic pattern rules to identify that the first traffic flow data meets the matching traffic pattern rule.

6 . The method of claim 1 , further comprising:
automatically updating a segmentation policy in response to identifying that the traffic flow between the first workload and the second workload meets the matching traffic pattern rule.

7 . The method of claim 6 , wherein automatically updating the segmentation policy comprises:
detecting that the segmentation policy allows the traffic flow between the first workload and the second workload; and updating the segmentation policy to block the traffic flow between the first workload and the second workload.

8 . The method of claim 6 , wherein automatically updating the segmentation policy comprises:
generating a filtering rule to cause the traffic flow from the second workload to the first workload to be redirected to a deception service; and sending the filtering rule to an enforcement module managing the first workload.

9 . The method of claim 1 , wherein the connection between the first workload and the second workload is blocked under the segmentation policy, the method further comprising:
receiving a request to update the segmentation policy to enable the connection between the first workload and the second workload; and generating an alert indicating that the identified traffic flow associated with the connection has been identified as having the attack pattern.

10 . A non-transitory computer-readable storage medium storing instructions for generating a traffic flow graph representing traffic in a segmented network environment, the instructions when executed by one or more processors causing the one or more processors to perform steps including:
storing, by a policy management server, a plurality of traffic pattern rules for detecting traffic patterns indicative of malicious behavior; receiving, from a plurality of distributed enforcement modules, traffic flow data associated with a plurality of workloads managed by the plurality of distributed enforcement modules, the traffic flow data including blocked connection attempts and successful connections; processing, by the policy management server, the traffic flow data to identify a traffic flow between a first workload and a second workload that meets a matching traffic pattern rule selected from the plurality of traffic pattern rules; tagging the identified traffic flow with metadata tags indicating that the identified traffic flow corresponds to attack traffic; generating the traffic flow graph representing the traffic flow data and including the metadata tags for the identified traffic flow corresponding to the attack traffic; and providing the traffic flow graph to an application for generating or updating a segmentation policy.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein providing the traffic flow graph comprises:
generating a visual representation of the traffic flow graph in which a first node represents the first workload, a second node represents the second workload, and an edge between the first node and the second node represents the traffic flow between the first workload and the second workload, and in which a visual indicator represents the tagged metadata indicating that the traffic flow corresponds to the attack traffic.

12 . The non-transitory computer-readable storage medium of claim 10 , the instructions when executed further causing the processor to perform steps including:
receiving, from an application on an administrator client, a request for information about the traffic flow; and responsive to the request, providing the information about the traffic flow together with the tagged metadata indicating that the traffic flow corresponds to the attack traffic.

13 . The non-transitory computer-readable storage medium of claim 10 , wherein processing the traffic flow data comprises:
transmitting the plurality of traffic pattern rules to the first workload; receiving from the first workload, first traffic flow data corresponding to traffic between the first workload and the second workload; and receiving an indication from the first workload that the first traffic flow data meets the matching traffic pattern rule.

14 . The non-transitory computer-readable storage medium of claim 10 , wherein processing the traffic flow data comprises:
receiving from the first workload, first traffic flow data corresponding to traffic between the first workload and the second workload; and applying the plurality of traffic pattern rules to identify that the first traffic flow data meets the matching traffic pattern rule.

15 . The non-transitory computer-readable storage medium of claim 10 , the instructions when executed further causing the processor to perform steps including:
automatically updating a segmentation policy in response to identifying that the traffic flow b

Assignees

• Illumio Inc

Inventors

• Sanghvi Rushabh
• Mishra Rupesh Kumar

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title