SYSTEM FOR VIRTUAL MACHINE RISK MONITORING

• US 20150067143A1
• Filed: 09/03/2013
• Published: 03/05/2015
• Est. Priority Date: 09/03/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Babakhan, Andrew, Zhou, Jeffrey, Rowe, Neale, Leung, Peter
• Granted Patent: US 9,811,435 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A virtual machine may allow execution of applications decoupled from physical hardware. The virtual machine may be executed by the physical hardware in a data center. A system can monitor and assess performance and reliability of the virtual machine based on device records of network components of the data center that are supporting operation of the virtual machine.

Claims

1. A device comprising:

a virtual machine detector configured to determine identity information of a virtual machine;

a network detector configured to determine identity information of network devices comprising a network segment and store in memory the identity information of the network devices corresponding to the identity information of the virtual machine, wherein the virtual machine resides on the network segment;

a reliability calculator further configured to determine a risk level of the virtual machine based on the identity information of the network devices; and

an output device configured to output the risk level of the virtual machine.

2. The device of claim 1, wherein determination of the risk level includes accessing device records of the network devices from a knowledge base based on the identity information of the network devices.

3. The device of claim 1, wherein the network segment is a first network segment, and wherein:

the reliability calculator is further configured to monitor migration of the virtual machine from the first network segment to a second network segment;

the network detector is further configured to determine identity information of network devices comprising the second network segment; and

the reliability calculator is further configured to update the risk level of the virtual machine in response to the migration of the virtual machine.

4. The device of claim 3, further comprising:

the network detector configured to update the memory with the identity information of the network devices of the second network segment in response to the migration of the virtual machine to the second network segment.

5. The device of claim 2, wherein a device record of a network device comprises a security threat, a known defect, a field notice, a smart contract, software bugs, hardware bugs, and performance information.

6. The device of claim 1, wherein the network detector is configured to determine the network devices in the network segment by identification of a data path used by the virtual machine, wherein the data path is within a data center.

7. The device of claim 6, further comprising:

the network detector further configured to identify a data packet in the data center as being associated with the virtual machine by identification of a media access control (MAC) address of the virtual machine associated with the data packet; and

the network detector further configured to determine the data path as a series of network devices that process the data packet.

8. The device of claim 6, further comprising:

the network detector further configured to identify the data path from a unicast route information base data for the virtual machine using a media access control (MAC) address of the virtual machine.

9. A method comprising:

identifying, by a processor, a plurality of virtual machines being executed in a data center;

identifying, by the processor, a virtual machine path within the data center used by a virtual machine from among the virtual machines;

identifying, by the processor, a plurality of network components in the virtual machine path; and

recording, by the processor, in a virtual machine database the virtual machine and the corresponding virtual machine path.

10. The method of claim 9, further comprising:

accessing, by the processor, device records of the network components from a knowledge base; and

determining, by the processor, a risk level associated with the virtual machine based on the device records.

11. The method of claim 10, further comprising:

reporting, by the processor, the risk level of the virtual machine to an output device.

12. The method of claim 10, wherein the virtual machine path is a first virtual machine path, and the risk level is a first risk level, the method further comprising:

monitoring, by the processor, a trigger causing the virtual machine to use a second virtual machine path;

determining, by the processor, a second risk level of the virtual machine based on device records of network components of the second virtual machine path; and

issuing, by the processor, a warning message indicating an increased risk level of the virtual machine in response to the second risk level being greater than the first risk level.

13. The method of claim 10, wherein the device records of a network component indicate a security threat, a known defect, a field notice, a smart contract, a software bug, a hardware bug, and performance information.

14. The method of claim 9, wherein the virtual machine path is determined based on comparing a media access control (MAC) address of the virtual machine with either a unicast forwarding information from the network components or header information in a data packet received at ingress of the data center.

15. A non-transitory computer readable media comprising instructions executable by a processor, the non-transitory computer readable media comprising:

instructions to identify a virtual machine path being used by a virtual machine executed by a node of a data center;

instructions to determine stability of the virtual machine based on device records of devices in the virtual machine path;

instructions to monitor a change in the stability of the virtual machine; and

instructions to report the change in the stability via an output device.

16. The non-transitory computer readable media of claim 15, further comprising:

instructions to reconfigure the virtual machine path in response to the change in stability being outside a predetermined range.

17. The non-transitory computer readable media of claim 15, further comprising:

instructions to detect the change in the stability of the virtual machine in response to an update to the device records.

18. The non-transitory computer readable media of claim 15, further comprising:

instructions to detect the change in the stability of the virtual machine in response to a change in the virtual machine path.

19. The non-transitory computer readable media of claim 15, further comprising:

instructions to detect the change in the stability of the virtual machine in response to a change in the node.

20. The non-transitory computer readable media of claim 15, wherein the virtual machine path includes layer 2 network components comprising at least one of a switch, a router, or a network interface card.