ANALYZING NETWORK TRAFFIC FOR LAYER-SPECIFIC CORRECTIVE ACTIONS IN A CLOUD COMPUTING ENVIRONMENT

• US 20150358205A1
• Filed: 06/09/2014
• Published: 12/10/2015
• Est. Priority Date: 06/09/2014
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: BROPHY, Timothy
• Granted Patent: US 10,102,019 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A device may receive information that identifies a set of rules for analyzing network traffic associated with a cloud computing environment. The device may receive network traffic information associated with the cloud computing environment. The network traffic information may be associated with network traffic transmitted to or transmitted from the cloud computing environment. The device may analyze the network traffic information using the set of rules, and may identify an action to be performed based on analyzing the network traffic information using the set of rules. The device may identify a layer of the cloud computing environment, at which to perform the action, based on analyzing the network traffic information using the set of rules. The device may cause the action to be performed to modify a configuration associated with the layer of the cloud computing environment.

Claims

1. An analysis device, comprising:

one or more processors to;

receive information that identifies a set of rules for analyzing network traffic associated with a cloud computing environment;

receive network traffic information associated with the cloud computing environment,

the network traffic information being associated with network traffic transmitted to or transmitted from the cloud computing environment;

analyze the network traffic information using the set of rules;

identify an action to be performed based on analyzing the network traffic information using the set of rules;

identify a layer of the cloud computing environment, at which to perform the action, based on analyzing the network traffic information using the set of rules; and

cause the action to be performed to modify a configuration associated with the layer of the cloud computing environment.

2. The analysis device of claim 1, where the one or more processors, when identifying the action to be performed, are further to:

identify a plurality of actions to be performed based on analyzing the network traffic information using the set of rules,

the plurality of actions including the action;

where the one or more processors, when identifying the layer, are further to;

identify a respective plurality of layers, at which to perform the plurality of actions, based on analyzing the network traffic information using the set of rules,

the plurality of layers including the layer; and

where the one or more processors, when causing the action to be performed, are further to;

cause the plurality of actions to be performed to modify a respective plurality of configurations associated with the plurality of layers of the cloud computing environment.

3. The analysis device of claim 1, where the network traffic information includes:

first network traffic information provided by a first traffic monitoring device located internal to the cloud computing environment; and

second network traffic information provided by a second traffic monitoring device located external to the cloud computing environment,

the second network traffic information being different from the first network traffic information.

4. The analysis device of claim 1, where the one or more processors, when causing the action to be performed, are further to:

send an instruction, to a device associated with the layer of the cloud computing environment, to perform the action.

5. The analysis device of claim 1, where the layer is a network layer;

and

where the one or more processors, when causing the action to be performed, are further to;

send an instruction, to a device associated with the network layer of the cloud computing environment, to modify access to the cloud computing environment.

6. The analysis device of claim 1, where the layer is a computing resource layer;

and

where the one or more processors, when causing the action to be performed, are further to;

send an instruction, to a computing resource internal to the cloud computing environment and associated with the computing resource layer, to modify access to the computing resource.

7. The analysis device of claim 1, where the layer is a network processing unit layer;

and

where the one or more processors, when causing the action to be performed, are further to;

send an instruction, to a network processing unit internal to the cloud computing environment and associated with the network processing unit layer, to modify a traffic transfer rate of network traffic within the cloud computing environment.

8. A computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

receive information that identifies a set of rules for analyzing network traffic associated with a cloud computing environment;

receive network traffic information associated with the cloud computing environment,

the network traffic information being associated with network traffic transmitted to or transmitted from the cloud computing environment;

analyze the network traffic information using the set of rules;

identify an action to be performed based on analyzing the network traffic information using the set of rules;

identify a layer of the cloud computing environment, at which to perform the action, based on analyzing the network traffic information using the set of rules; and

cause the action to be performed to modify a configuration associated with the layer of the cloud computing environment.

9. The computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to identify the action to be performed, further cause the one or more processors to:

identify a plurality of actions to be performed based on analyzing the network traffic information using the set of rules,

the plurality of actions including the action;

where the one or more instructions, that cause the one or more processors to identify the layer, further cause the one or more processors to;

identify a respective plurality of layers, at which to perform the plurality of actions, based on analyzing the network traffic information using the set of rules,

the plurality of layers including the layer; and

where the one or more instructions, that cause the one or more processors to cause the action to be performed, further cause the one or more processors to;

cause the plurality of actions to be performed to modify a respective plurality of configurations associated with the plurality of layers of the cloud computing environment.

10. The computer-readable medium of claim 8, where the network traffic information includes:

first network traffic information generated by or received from a first traffic monitoring device located internal to the cloud computing environment; and

second network traffic information generated by or received from a second traffic monitoring device located external to the cloud computing environment,

the second network traffic information being different from the first network traffic information.

11. The computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to cause the action to be performed, further cause the one or more processors to:

send an instruction, to a device associated with the layer of the cloud computing environment, to perform the action.

12. The computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to cause the action to be performed, further cause the one or more processors to:

send an instruction to modify a quality of service parameter used to handle network traffic associated with the cloud computing environment.

13. The computer-readable medium of claim 8, where the layer is a hypervisor layer;

and

where the one or more instructions, that cause the one or more processors to cause the action to be performed, further cause the one or more processors to;

send an instruction, to a hypervisor associated with the cloud computing environment and the hypervisor layer, to perform the action.

14. The computer-readable medium of claim 8, where the layer is a virtual machine layer;

and

where the one or more instructions, that cause the one or more processors to cause the action to be performed, further cause the one or more processors to;

send an instruction, to a virtual machine associated with the cloud computing environment and the virtual machine layer, to perform the action.

15. A method, comprising:

receiving, by an analysis device, information that identifies a set of rules for analyzing network traffic associated with a cloud computing environment;

receiving, by the analysis device, network traffic information associated with the cloud computing environment,

the network traffic information being associated with network traffic transmitted to or transmitted from the cloud computing environment;

analyzing, by the analysis device, the network traffic information using the set of rules;

identifying, by the analysis device, an action to be performed based on analyzing the network traffic information using the set of rules;

identifying, by the analysis device, a layer of the cloud computing environment, at which to perform the action, based on analyzing the network traffic information using the set of rules; and

causing, by the analysis device, the action to be performed to modify a configuration associated with the layer of the cloud computing environment.

16. The method of claim 15, where identifying the action further comprises:

identifying a plurality of actions to be performed based on analyzing the network traffic information using the set of rules,

the plurality of actions including the action;

where identifying the layer further comprises;

identifying a respective plurality of layers, at which to perform the plurality of actions, based on analyzing the network traffic information using the set of rules,

the plurality of layers including the layer; and

where causing the action to be performed further comprises;

causing the plurality of actions to be performed to modify a respective plurality of configurations associated with the plurality of layers of the cloud computing environment.

17. The method of claim 15, where the network traffic information includes:

first network traffic information provided by a first traffic monitoring device located internal to the cloud computing environment; and

second network traffic information provided by a second traffic monitoring device located external to the cloud computing environment,

the second network traffic information being different from the first network traffic information.

18. The method of claim 15, where causing the action to be performed further comprises:

sending an instruction, to a device associated with the layer of the cloud computing environment, to cause the action to be performed.

19. The method of claim 15, where causing the action to be performed further comprises:

generating an intrusion detection signature to be used to monitor network traffic; and

providing the intrusion detection signature to a traffic monitoring device,

the traffic monitoring device using the intrusion detection signature to monitor network traffic.

20. The method of claim 15, where causing the action to be performed further comprises:

generating a new set of rules to be used to analyze network traffic;

receiving other network traffic information associated with the cloud computing environment; and

analyzing the other network traffic information using the new set of rules.