Determining network security policies during data center migration and detecting security violation

• US 10,015,197 B2
• Filed: 10/22/2015
• Issued: 07/03/2018
• Est. Priority Date: 10/22/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bai, Kun, Hwang, Jinho, Jermyn, Jill L., Ramasamy, Harigovind V., Vukovic, Maja
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US14/920,383
• Publication Number:
  US 20170118244A1
• Time in Patent Office: 985 Days
• Field of Search: None
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Input data are received from a source environment comprising a plurality of servers and one or more applications running on at least one of the servers. One or more patterns are discovered from the received data comprising information regarding the plurality of servers running applications that collectively perform a service. The patterns are analyzed to learn a recurring pattern. A security policy is designed for the recurring pattern. The recurring pattern and the security policy designed for the recurring pattern is stored in a database.

Claims

1. A method comprising:

receiving input data from a source environment to a destination data center environment wherein the source environment comprises a plurality of servers and one or more applications running on at least one of the servers;

discovering from the received data one or more patterns wherein the patterns comprise information regarding one or more of the plurality of servers running one or more of the applications that collectively perform a service;

analyzing the patterns to learn a recurring pattern, wherein learning the recurring pattern further comprises applying a multi-label learning algorithm to categorize the one or more discovered patterns;

determining a security policy for the recurring pattern;

storing the recurring pattern and the security policy determined for the recurring pattern in a database; and

implementing the determined security policy in the destination data center environment.

2. The method of claim 1, wherein the input data further comprises:

discovery data comprising information regarding at least one of network connectivities and logical dependencies between the plurality of servers and the one or more applications in the source environment;

application information data comprising application profiles of one or more virtual machines in the source environment and one or more types of services performed by the virtual machines; and

security requirement data comprising at least one of compliance and client specific data.

3. The method of claim 1, wherein the multi-label learning algorithm comprises training a Support Vector Machine (SVM) classifier for the received input data.

4. The method of claim 1, wherein the determined security policy is in compliance with local and global firewall rules in the source environment.

5. The method of claim 1, wherein non-compliance of the determined security policy with the local and global firewall rules indicates a security policy violation in the source environment.

6. The method of claim 1, further comprising:

detecting a security policy violation during a steady-state operation;

modifying the security policy for the recurring pattern; and

updating the database with the modified security policy.

7. An apparatus, comprising:

a memory; and

a processor operatively coupled to the memory and configured to;

receive input data from a source environment to a destination data center environment wherein the source environment comprises a plurality of servers and one or more applications running on at least one of the servers;

discover from the received data one or more patterns wherein the patterns comprise information regarding one or more of the plurality of servers running one or more of the applications that collectively perform a service;

analyze the patterns to learn a recurring pattern, wherein learning the recurring pattern further comprises applying a multi-label learning algorithm to categorize the one or more discovered patterns;

determine a security policy for the recurring pattern;

store the recurring pattern and the security policy determined for the recurring pattern in a database; and

implement the determined security policy in the destination data center environment.

8. The apparatus of claim 7, wherein the input data further comprises:

discovery data comprising information regarding at least one of network connectivities and logical dependencies between the plurality of servers and the one or more applications in the source environment;

application information data comprising application profiles of one or more virtual machines in the source environment and one or more types of services performed by the virtual machines; and

security requirement data comprising at least one of compliance and client specific data.

9. The apparatus of claim 7, wherein the multi-label learning algorithm comprises training a Support Vector Machine (SVM) classifier for the received input data.

10. The apparatus of claim 7, wherein the determined security policy is in compliance with local and global firewall rules in the source environment.

11. The apparatus of claim 7, wherein non-compliance of the determined security policy with the local and global firewall rules indicates a security policy violation in the source environment.

12. The apparatus of claim 7, wherein the processor is further configured to:

detect a security policy violation during a steady-state operation;

modify the security policy for the recurring pattern; and

update the database with the modified security policy.

13. An article of manufacture comprising a computer readable storage medium for storing computer readable program code which, when executed, causes a computer to:

receive input data from a source environment to a destination data center environment wherein the source environment comprises a plurality of servers and one or more applications running on at least one of the servers;

discover from the received data one or more patterns wherein the patterns comprise information regarding one or more of the plurality of servers running one or more of the applications that collectively perform a service;

to analyze the patterns to learn a recurring pattern, wherein learning the recurring pattern further comprises applying a multi-label learning algorithm to categorize the one or more discovered patterns;

to determine a security policy for the recurring pattern;

to store the recurring pattern and the security policy determined for the recurring pattern in a database; and

implement the determined security policy in the destination data center environment.

14. The article of claim 13, wherein the input data further comprises:

discovery data comprising information regarding at least one of network connectivities and logical dependencies between the plurality of servers and the one or more applications in the source environment;

application information data comprising application profiles of one or more virtual machines in the source environment and one or more types of services performed by the virtual machines; and

security requirement data comprising at least one of compliance and client specific data.

15. The article of manufacture of claim 13, wherein the determined security policy is in compliance with local and global firewall rules in the source environment.

16. The article of manufacture of claim 13, wherein non-compliance of the determined security policy with the local and global firewall rules indicates a security policy violation in the source environment.

17. The article of manufacture of claim 13, further causing the computer to:

detect a security policy violation during a steady-state operation;

modify the security policy for the recurring pattern; and

update the database with the modified security policy.