Service delivery controller for learning network security services

1. A learning-based computer network security system, comprising:

one or more hardware processors;

a network security service delivery controller executing on one or more of the hardware processors,

the network security service delivery controller operable to receive network flow attributes associated with a network flow, the network flow to be sent to one or more destination machines via a communication network,

the network security service delivery controller further operable to group the network flow into a similarity group at least based on the network flow attributes, wherein the network security service delivery controller groups a plurality of network flows into a plurality of similarity groups,

the network security service delivery controller further operable to designate a network security appliance instance from a plurality of network security appliance instances for a particular similarity group, wherein the network security service delivery controller designates each of the plurality of similarity groups respectively to a network security appliance instance in the plurality of network security appliance instances,

the network security service delivery controller further operable to direct transmission of the network flow to the network security appliance designated for the similarity group associated with the network flow.

2. The system of claim 1 , wherein the network security service delivery controller is further operable to designate two or more network security appliance instances from the plurality of network security appliance instances for a particular similarity group.

3. The system of claim 1 , wherein the plurality of network security appliance instances operate in learning phase and resolution phase and the network security service delivery controller receives feedback from the plurality of network security appliance instances, the feedback comprising at least whether the network security appliance instances are operating in the learning phase or the resolution phase.

4. The system of claim 1 , wherein based on feedback received from one or more of the plurality of network security appliance instances, the network security service delivery controller performs one or more of dividing the one or more similarity groups into finer groups of similarity and unifying the similarity groups.

5. The system of claim 1 , wherein the attributes comprises one or more of an application type, network protocol and Internet Protocol address source of the network flows.

6. The system of claim 1 , wherein the network security service delivery controller is further operable to receive feedback from the network security appliance instance that the network security appliance is in resolution phase, and based on the feedback the network security service delivery controller directs transmission of a training result of the network security appliance instance to one or more other network security appliance instances and reroutes at least some of the network flows in the particular similarity group to the one or more other network security appliance instances.

7. The system of claim 6 , wherein the training result comprises one or more security rules associated with determining whether the network flows in the particular similarity group are anomalous.

8. A computer-implemented method of providing learning-based computer network security, comprising:

receiving, by a network security service delivery controller executing on one or more hardware processors, network flow attributes associated with a network flow, the network flow to be sent to one or more destination machines via a communication network;

grouping, by the network security service delivery controller the network flow into a similarity group at least based on the network flow attributes, wherein the network security service delivery controller groups a plurality of network flows into a plurality of similarity groups;

determining, by the network security service delivery controller a network security appliance instance from a plurality of network security appliance instances for a particular similarity group, wherein the network security service delivery controller designates each of the plurality of similarity groups respectively to a network security appliance instance in the plurality of network security appliance instances; and

directing transmission of the network flow to the network security appliance designated for the similarity group associated with the network flow.

9. The method of claim 8 , wherein the network security service delivery controller designates two or more network security appliance instances from the plurality of network security appliance instances for the particular similarity group.

10. The method of claim 8 , wherein the network security service delivery service controller receives and directs the network flow via a network connectivity controller operatively connected to the network security service delivery service controller.

11. The method of claim 8 , wherein the plurality of network security appliance instances operate in learning phase and resolution phase and the network security service delivery controller receives feedback from the plurality of network security appliance instances, the feedback comprising at least whether the network security appliance instances are operating in the learning phase or the resolution phase.

12. The method of claim 8 , wherein based on feedback received from one or more of the plurality of network security appliance instances, the network security service delivery controller performs one or more of dividing the one or more similarity groups into finer groups of similarity and unifying the similarity groups.

13. The method of claim 8 , wherein the attributes comprises one or more of an application type, network protocol and Internet Protocol address source of the network flows.

14. The method of claim 8 , further comprising:

receiving by the network security service delivery controller, feedback from the network security appliance instance that the network security appliance instance is in resolution phase; and

based on the feedback, directing by the network security service delivery controller, transmission of a training result of the network security appliance instance to one or more other network security appliance instances and rerouting at least some of the network flows in the particular similarity group to the one or more other network security appliance instances.

15. The method of claim 14 , wherein the training result comprises one or more security rules associated with determining whether the network flows in the particular similarity group are anomalous.

16. A computer readable storage device storing a program of instructions executable by a machine to perform a method of providing learning-based computer network security, the method comprising:

receiving, by a network security service delivery controller executing on one or more hardware processors, network flow attributes associated with a network flow, the network flow to be sent to one or more destination machines via a communication network;

grouping, by the network security service delivery controller the network flow into a similarity group at least based on the network flow attributes, wherein the network security service delivery controller groups a plurality of network flows into a plurality of similarity groups;

determining, by the network security service delivery controller a network security appliance instance from a plurality of network security appliance instances for a particular similarity group, wherein the network security service delivery controller designates each of the plurality of similarity groups respectively to a network security appliance instance in the plurality of network security appliance instances; and

directing transmission of the network flow to the network security appliance designated for the similarity group associated with the network flow.

17. The computer readable storage device of claim 16 , wherein the network security service delivery controller designates two or more network security appliance instances from the plurality of network security appliance instances for the particular similarity group.

18. The computer readable storage device of claim 16 , wherein the plurality of network security appliance instances operate in learning phase and resolution phase and the network security service delivery controller receives feedback from the plurality of network security appliance instances, the feedback comprising at least whether the network security appliance instances are operating in the learning phase or the resolution phase.

19. The computer readable storage device of claim 16 , wherein the attributes comprises one or more of an application type, network protocol and Internet Protocol address source of the network flows.

20. The computer readable storage device of claim 16 , further comprising:

receiving by the network security service delivery controller, feedback from the network security appliance instance that the network security appliance instance is in resolution phase; and

based on the feedback, directing by the network security service delivery controller, transmission of a training result of the network security appliance instance to one or more other network security appliance instances and rerouting at least some of the network flows in the particular similarity group to the one or more other network security appliance instances.