System for monitoring and managing datacenters
An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.
1. A system within a data center, comprising:
two or more sensors configured to perform operations comprising:
capturing a packet;
describing the packet in a packet log;
sending the packet log to a collector;
the collector being configured to perform operations comprising:
receiving the packet logs from the two or more sensors;
determining that the logs describe at least a flow;
describing the flow in a flow log; and
an analytics module configured to perform operations comprising:
determine a status of the data center, using any connections in the flow log;
detecting, from at least the determined status of the datacenter, an attack within the data center; and
modify, in response to the detected attack, a security policy based on the status of the data center.
2. The system of claim 1 , wherein the detecting an attack comprises detecting a spike in an amount of resources used by at least one of the sensors.
3. The system of claim 1 , wherein the detecting an attack comprises detecting a hidden process embedded in traffic between two or more reference points.
4. The system of claim 1 , wherein the detecting an attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.
5. The system of claim 1 , wherein the detecting an attack comprises detecting spoofed packets.
6. The system of claim 1 , wherein the detecting an attack comprises detecting a packet that has a packet header field that is outside of an expected predictive header pattern.
7. The system of claim 1 , wherein the detecting an attack comprises detecting a distributed denial of service (DDOS) attack.
8. A method implemented with a data center, the method comprising:
at two or more sensors:
capturing a packet;
describing the packet in a packet log;
sending the packet log to a collector;
at the collector:
receiving the packet logs from the two or more sensors;
determining that the logs describe at least a flow;
describing the flow in a flow log; and
at an analytics module:
determining a status of the data center, using any connections in the flow log;
detecting, from at least the determined status of the datacenter, an attack within the data center; and
modifying, in response to the detected attack, a security policy based on the status of the data center.
9. The method of claim 8 , wherein the detecting an attack comprises detecting a spike in an amount of resources used by at least one of the sensors.
10. The method of claim 8 , wherein the detecting an attack comprises detecting a hidden process embedded in traffic between two or more reference points.
11. The method of claim 8 , wherein the detecting an attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.
12. The method of claim 8 , wherein the detecting an attack comprises detecting spoofed packets.
13. The method of claim 8 , wherein the detecting an attack comprises detecting a packet that has a packet header field that is outside of an expected predictive header pattern.
14. The method of claim 8 , wherein the detecting an attack comprises detecting a distributed denial of service (DDOS) attack.
15. A non-transitory computer-readable media having computer readable instructions stored thereon that, when executed by a data center, cause components within the data center to perform operations comprising:
at two or more sensors within the data center:
capturing a packet;
describing the packet in a packet log;
sending the packet log to a collector within the data center;
at the collector within the data center:
receiving the packet logs from the two or more sensors;
determining that the logs describe at least a flow;
describing the flow in a flow log; and
at an analytics module within the data center:
determining a status of the data center, using any connections in the flow log;
detecting, from at least the determined status of the datacenter, an attack within the data center; and
modifying, in response to the detected attack, a security policy based on the status of the data center.
16. The media of claim 15 , wherein the detecting an attack comprises detecting a spike in an amount of resources used by at least one of the sensors.
17. The media of claim 15 , wherein the detecting an attack comprises detecting a hidden process embedded in traffic between two or more reference points.
18. The media of claim 15 , wherein the detecting an attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.
19. The media of claim 15 , wherein the detecting an attack comprises detecting spoofed packets.
20. The media of claim 15 , wherein the detecting an attack comprises detecting a packet that has a packet header field that is outside of an expected predictive header pattern.