System and method of recommending policies that result in particular reputation scores for hosts
A method provides for associating reputation scores with policies, stacks and hosts within a network and upon receiving information about a newly provisioned entity (such as a host or a stack), recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores. The method further includes implementing the policy scheme for the newly provisioned entity.
1. A method comprising:
associating reputation scores with policies, stacks and hosts within a network, wherein the reputation scores are based at least in part on data received from a first capturing agent at a physical layer in a network, a second capturing agent at a hypervisor layer in the network, and a third capturing agent at a virtual layer of the network;
upon receiving information about a newly provisioned entity, recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores; and
implementing the policy scheme for the newly provisioned entity.
2. The method of claim 1 , further comprising, when the particular reputation score of the newly provisioned entity falls below a threshold amount, isolating the newly provisioned entity from the network.
3. The method of claim 1 , further comprising:
after isolating the newly provisioned entity from the network, analyzing traffic from other hosts similar to the newly provisioned entity with increased scrutiny.
4. The method of claim 1 , wherein isolating the newly provisioned entity from the network further comprises removing the newly provisioned entity from the network.
5. The method of claim 1 , wherein multiple policies result in the particular reputation score.
6. The method of claim 5 , wherein, when the multiple policies result in the particular reputation score, the policy scheme that is recommended comprises a least restrictive policy of the multiply policies.
7. The method of claim 1 , wherein the newly provisioned entity comprises one of a host and a stack.
8. A system comprising:
a processor; and
a computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to perform operations comprising:
associating reputation scores with policies, stacks and hosts within a network, wherein the reputation scores are based at least in part on data received from a first capturing agent at a physical layer in a network, a second capturing agent at a hypervisor layer in the network, and a third capturing device at a virtual layer of the network;
upon receiving information about a newly provisioned entity, recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores; and
implementing the policy scheme for the newly provisioned entity.
9. The system of claim 8 , wherein the computer-readable storage medium stores further instructions which, when executed by the processor, cause the processor to perform operations comprising further comprising:
when the particular reputation score of the newly provisioned entity falls below a threshold amount, isolating the newly provisioned entity from the network.
10. The system of claim 8 , wherein the computer-readable storage medium stores further instructions which, when executed by the processor, cause the processor to perform operations comprising further comprising:
after isolating the newly provisioned entity from the network, analyzing traffic from other hosts similar to the newly provisioned entity with increased scrutiny.
11. The system of claim 8 , wherein isolating the newly provisioned entity from the network further comprises removing the newly provisioned entity from the network.
12. The system of claim 8 , wherein multiple policies result in the particular reputation score.
13. The system of claim 12 , wherein, when the multiple policies result in the particular reputation score, the policy scheme that is recommended comprises a least restrictive policy of the multiply policies.
14. The system of claim 8 , wherein the newly provisioned entity comprises one of a host and a stack.
15. A computer-readable storage device storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
associating reputation scores with policies, stacks and hosts within a network, wherein the reputation scores are based at least in part on data received from a first capturing agent at a physical layer in a network, a second capturing agent at a hypervisor layer in the network, and a third capturing device at a virtual layer of the network;
upon receiving information about a newly provisioned entity, recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores; and
implementing the policy scheme for the newly provisioned entity.
16. The computer-readable storage device of claim 15 , wherein the computer-readable storage device stores further instructions which, when executed by the processor, cause the processor to perform operations comprising further comprising:
when the particular reputation score of the newly provisioned entity falls below a threshold amount, isolating the newly provisioned entity from the network.
17. The computer-readable storage device of claim 15 , wherein the computer-readable storage device stores further instructions which, when executed by the processor, cause the processor to perform operations comprising further comprising:
after isolating the newly provisioned entity from the network, analyzing traffic from other hosts similar to the newly provisioned entity with increased scrutiny.
18. The computer-readable storage device of claim 15 , wherein isolating the newly provisioned entity from the network further comprises removing the newly provisioned entity from the network.
19. The computer-readable storage device of claim 15 , wherein multiple policies result in the particular reputation score.
20. The computer-readable storage device of claim 19 , wherein, when the multiple policies result in the particular reputation score, the policy scheme that is recommended comprises a least restrictive policy of the multiply policies.