Methods and systems for applying security policies in a virtualization environment

1. A method of applying security policies in a virtualization environment, comprising:

at an electronic device of a plurality of electronic devices in a computing network, the electronic device having one or more processors and memory storing instructions for execution by the one or more processors:

instantiating a plurality of user-space instances, wherein:

each respective user-space instance of the plurality of user-space instances is instantiated within a respective operating system environment, has a distinct virtual address space in virtual memory of the respective operating system environment, and is for executing a respective application in user space of the distinct virtual address space; and

the respective virtual address spaces of the user-space instances are distinct from a kernel address space of the virtual memory;

identifying one or more respective properties that characterize the user-space instances of the plurality of user-space instances;

based on the one or more identified properties characterizing the user-space instances:

forming two or more clusters of user-space instances from the plurality of user-space instances, wherein each cluster of the two or more clusters includes a respective set of two or more user-space instances that are characterized by one or more common properties of the one or more identified properties; and

for each respective cluster of the two or more clusters, identifying a respective set of security policies that define authorized or unauthorized operations for respective user-space instances in the respective cluster, and authorized or unauthorized data communications sent by and/or received by respective user-space instances in the respective cluster; and

for each respective cluster of the two or more clusters, applying the identified set of security policies for the respective cluster to the user-space instances in the cluster so as to detect and/or remediate violations of the identified set of security policies.

2. The method of claim 1 , wherein instantiating the plurality of user-space instances includes instantiating the plurality of the user-space instances within a first operating system environment of a first virtual machine.

3. The method of claim 1 , further including applying a set of system-level security policies, implemented by the respective operating system environment, to operations performed by and communications sent by and/or received by the plurality of user-space instances.

4. The method of claim 1 , wherein a first subset of the plurality of user-space instances is instantiated within a first operating system environment of a first virtual machine, a second subset of the plurality of user-space instances distinct from the first subset is instantiated within a second operating system environment of a second virtual machine distinct from the first virtual machine, and a first cluster of the two or more clusters includes at least one user-space instance instantiated in the first virtual machine and at least one user-space instance instantiated in the second virtual machine.

5. The method of claim 4 , wherein a first cluster of the one or more formed clusters includes user-space instances from both of the first and second subsets of the plurality of user-space instances.

6. The method of claim 1 , wherein the one or more respective properties include at least one of: a user-space instance type, a user-space instance sub-type, a user-space instance version, a user-space instance name, associated access controls for a respective user-space instance, a respective network communication protocol used by a respective user-space instance, and a respective network communications port used for data communications.

7. The method of claim 6 , wherein the user-space instance type corresponds to user-space instances that are applications accessible via an external network.

8. The method of claim 6 , wherein the user-space instance type corresponds to user-space instances that are database applications.

9. The method of claim 8 , wherein the database applications corresponding to the user-space instance type do not have direct access to an external network.

10. The method of claim 1 , wherein identifying the one or more respective properties comprises:

inspecting communications sent by and/or received by the user-space instances of the plurality of user-space instances; and

deriving at least some of the one or more respective properties from the inspected communications.

11. The method of claim 10 , wherein:

the inspected communications include data packets, each comprising a respective header portion and a respective data portion; and

inspecting the communications comprises inspecting at least the data portions of the data packets.

12. The method of claim 10 , wherein the inspected communications include data sent by a first user-space instance of the plurality of user-space instances to a second user-space instance of the plurality of user-space instances.

13. The method of claim 12 , wherein the first user-space instance is instantiated within a first operating system environment of a first virtual machine, and the second user-space instance is instantiated within a second operating system environment of a second virtual machine distinct from the first virtual machine.

14. The method of claim 10 , wherein the inspected communications include data sent by and/or received by a first user-space instance, of the plurality of user-space instances, over an external network to which the computing network is communicably connected.

15. The method of claim 1 , wherein applying the identified set of security policies for each respective cluster of the one or more clusters comprises:

monitoring the operations for the respective user-space instances in the respective cluster, and/or monitoring the data communications sent by and/or received by the respective user-space instances in the respective cluster;

detecting a violation of the identified set of security policies for the respective cluster in the monitored operations and/or the monitored communications; and

in response to detecting the violation, remediating the violation.

16. The method of claim 15 , wherein detecting the violation includes detecting attempts to access an external network by one or more of the respective user-space instances in the respective cluster that are not authorized to access, or have not previously accessed, the external network.

17. The method of claim 15 , wherein detecting the violation includes detecting attempts by a first user-space instance, of the respective user-space instances in the respective cluster, to transmit data managed by a second user-space instance of the plurality of user-space instances to an external network,

wherein the first user-space instance is authorized to access the external network, and the second user-space instance is not authorized to access the external network.

18. The method of claim 15 , wherein detecting the violation includes detecting attempts to access a first user-space instance, of the respective user-space instances in the respective cluster, wherein the access attempts originate from an external network that is not authorized to access the first user-space instance.

19. The method of claim 15 , wherein detecting the violation includes detecting attempts by a first user-space instance, of the respective user-space instances in the respective cluster, to access a second user-space instance of the plurality of user-space instances, wherein the first user-space instance is not authorized to access, or has not previously accessed, the second user-space instance.

20. The method of claim 15 , wherein remediating the violation includes at least one of: generating an alert for the violation, terminating one or more of the plurality of user-space instances that violated the identified set of security policies for the respective cluster, or modifying access privileges of one or more of the plurality of user-space instances that violated the identified set of security policies for the respective cluster.

21. The method of claim 1 , wherein a first cluster includes a first subset and a second subset of user-space instances, and a first set of security policies for the first cluster includes a first subset of security policies that apply to the first subset of user-space instances, and a second subset of security policies that apply to the second subset of user-space instances.

22. The method of claim 21 , wherein the first subset and second subset of user-space instances correspond to first and second user-space instance sub-types of a same user-space instance type.

23. The method of claim 1 , wherein identifying the one or more respective properties and applying the identified set of security policies are performed, in user space of the respective operating system environment, by a security instance distinct from the plurality of user-space instances.

24. A computer system device in a computing network having a plurality of computer systems, the electronic device comprising:

one or more processors;

a communication interface for communicating with other computer systems in the computing network; and

memory storing one or more programs for execution by the one or more processors, the one or more programs including instructions for performing operations, including:

instantiating a plurality of user-space instances, wherein:

each respective user-space instance of the plurality of user-space instances is instantiated within a respective operating system environment, has a distinct virtual address space in virtual memory of the respective operating system environment, and is for executing a respective application in user space of the distinct virtual address space; and

the respective virtual address spaces of the user-space instances are distinct from a kernel address space of the virtual memory;

identifying one or more respective properties that characterize the user-space instances of the plurality of user-space instances;

based on the one or more identified properties characterizing the user-space instances:

forming two or more clusters of user-space instances from the plurality of user-space instances, wherein each cluster of the two or more clusters includes a respective set of two or more user-space instances that are characterized by one or more common properties of the one or more identified properties; and

for each respective cluster of the two or more clusters, identifying a respective set of security policies that define authorized or unauthorized operations for respective user-space instances in the respective cluster, and authorized or unauthorized data communications sent by and/or received by respective user-space instances in the respective cluster; and

for each respective cluster of the two or more clusters, applying the identified set of security policies for the respective cluster to the user-space instances in the cluster so as to detect and/or remediate violations of the identified set of security policies.

25. A non-transitory computer readable storage medium, storing one or more programs that when executed by one or more processors of a computer system, in a computing network having a plurality of computer systems, cause the computer system to perform operations, including:

one or more processors;

a communication interface for communicating with other computer systems in the computing network; and

memory storing one or more programs for execution by the one or more processors, the one or more programs including instructions for performing operations, including:

instantiating a plurality of user-space instances, wherein:

each respective user-space instance of the plurality of user-space instances is instantiated within a respective operating system environment, has a distinct virtual address space in virtual memory of the respective operating system environment, and is for executing a respective application in user space of the distinct virtual address space; and

the respective virtual address spaces of the user-space instances are distinct from a kernel address space of the virtual memory;

identifying one or more respective properties that characterize the user-space instances of the plurality of user-space instances;

based on the one or more identified properties characterizing the user-space instances:

forming two or more clusters of user-space instances from the plurality of user-space instances, wherein each cluster of the two or more clusters includes a respective set of two or more user-space instances that are characterized by one or more common properties of the one or more identified properties; and

for each respective cluster of the two or more clusters, identifying a respective set of security policies that define authorized or unauthorized operations for respective user-space instances in the respective cluster, and authorized or unauthorized data communications sent by and/or received by respective user-space instances in the respective cluster; and

for each respective cluster of the two or more clusters, applying the identified set of security policies for the respective cluster to the user-space instances in the cluster so as to detect and/or remediate violations of the identified set of security policies.

26. The computer system device of claim 24 , wherein instantiating the plurality of user-space instances includes instantiating the plurality of the user-space instances within a first operating system environment of a first virtual machine.

27. The computer system device of claim 24 , wherein one or more programs include instructions for applying a set of system-level security policies, implemented by the respective operating system environment, to operations performed by and communications sent by and/or received by the plurality of user-space instances.

28. The computer system device of claim 24 , wherein a first subset of the plurality of user-space instances is instantiated within a first operating system environment of a first virtual machine, a second subset of the plurality of user-space instances distinct from the first subset is instantiated within a second operating system environment of a second virtual machine distinct from the first virtual machine, and a first cluster of the two or more clusters includes at least one user-space instance instantiated in the first virtual machine and at least one user-space instance instantiated in the second virtual machine.

29. The computer system device of claim 28 , wherein a first cluster of the one or more formed clusters includes user-space instances from both of the first and second subsets of the plurality of user-space instances.

30. The computer system device of claim 24 , wherein the one or more respective properties include at least one of: a user-space instance type, a user-space instance sub-type, a user-space instance version, a user-space instance name, associated access controls for a respective user-space instance, a respective network communication protocol used by a respective user-space instance, and a respective network communications port used for data communications.

31. The computer system device of claim 24 , wherein identifying the one or more respective properties comprises:

inspecting communications sent by and/or received by the user-space instances of the plurality of user-space instances; and

deriving at least some of the one or more respective properties from the inspected communications.

32. The computer system device of claim 24 , wherein applying the identified set of security policies for each respective cluster of the one or more clusters comprises:

monitoring the operations for the respective user-space instances in the respective cluster, and/or monitoring the data communications sent by and/or received by the respective user-space instances in the respective cluster;

detecting a violation of the identified set of security policies for the respective cluster in the monitored operations and/or the monitored communications; and

in response to detecting the violation, remediating the violation.