System and method for managing security-relevant information in a computer network

1. A computer-implemented method for managing security-relevant information in a computer network, the method comprising:

uploading different types of security-relevant data from components in the computer network to a security information plane (SIP) manager via a southbound SIP interface of the SIP manager, wherein at least some of the different types of security-relevant data are uploaded to the SIP manager from a global security endpoint manager in a customized virtual computing instance running on a host computer, wherein the customized virtual computing instance provides isolation from other virtual computing instances running on the host computer and wherein each of the customized the virtual computing instance and the other virtual computing instances includes a virtual central processing unit (CPU), virtual memory and virtual storage;

at the SIP manager, performing at least one aggregation operation on the security-relevant data to produce networkwide aggregated security information;

storing the networkwide aggregated security information in a database accessible by the SIP manager;

downloading the networkwide aggregated security information from the SIP manager via a northbound SIP interface of the SIP manager to a global security controller;

at the global security controller, controlling security applications running in the computer network using the networkwide aggregated security information downloaded from the SIP manager;

downloading the networkwide aggregated security information from the SIP manager via the southbound SIP interface of the SIP manager to at least some of the components in the computer network, including the global security endpoint manager in the customized virtual computing instance running on the host computer; and

at the host computer, executing a security service by a security application running in the customized virtual computing instance of the host computer using the networkwide aggregated security data downloaded from the SIP manager.

2. The method of claim 1 , wherein the aggregation operation is a data composition operation, a differential analysis operation or a correlation operation.

3. The method of claim 1 , wherein the aggregation operation is a graph generating operation or a machine learning model generating operation.

4. The method of claim 1 , wherein the different types of security-relevant data that are uploaded from the components in the computer network include raw security data, security alerts and security polices from the components.

5. The method of claim 1 , wherein the global security endpoint manager in the customized virtual computing instance defines (1) the different types of security-relevant data that are uploaded to the SIP manager, (2) an upload handling function, and (3) an exchange mode.

6. The method of claim 1 , wherein the global security controller includes a global security manager that manages data exchange between the SIP manager and the global security controller.

7. The method of claim 1 , wherein uploading different types of security-relevant data includes using a single exchange, streaming, event-driven or publication/subscription mode to upload the different types of security-relevant data from the components in the computer network to the SIP manager.

8. A non-transitory computer-readable storage medium containing program instructions for method for managing security-relevant information in a computer network, wherein execution of the program instructions by one or more processors of a computer system causes the one or more processors to perform steps comprising:

uploading different types of security-relevant data from components in the computer network to a security information plane (SIP) manager via a southbound SIP interface of the SIP manager, wherein at least some of the different types of security-relevant data are uploaded to the SIP manager from a global security endpoint manager in a customized virtual computing instance running on a host computer, wherein the customized virtual computing instance provides isolation from other virtual computing instances running on the host computer and wherein each of the customized the virtual computing instance and the other virtual computing instances includes a virtual central processing unit (CPU), virtual memory and virtual storage;

at the SIP manager, performing at least one aggregation operation on the security-relevant data to produce networkwide aggregated security information;

storing the networkwide aggregated security information in a database accessible by the SIP manager;

downloading the networkwide aggregated security information from the SIP manager via a northbound SIP interface of the SIP manager to a global security controller;

at the global security controller, controlling security applications running in the computer network using the networkwide aggregated security information downloaded from the SIP manager;

downloading the networkwide aggregated security information from the SIP manager via the southbound SIP interface of the SIP manager to at least some of the components in the computer network, including the global security endpoint manager in the customized virtual computing instance running on the host computer; and

at the host computer, executing a security service by a security application running in the customized virtual computing instance of the host computer using the networkwide aggregated security data downloaded from the SIP manager.

9. The computer-readable storage medium of claim 8 , wherein the aggregation operation is a data composition operation, a differential analysis operation or a correlation operation.

10. The computer-readable storage medium of claim 8 , wherein the aggregation operation is a graph generating operation or a machine learning model generating operation.

11. The computer-readable storage medium of claim 8 , wherein the different types of security-relevant data that are uploaded from the components in the computer network include raw security data, security alerts and security polices from the components.

12. The computer-readable storage medium of claim 8 , wherein the global security endpoint manager in the customized virtual computing instance defines (1) the different types of security-relevant data that are uploaded to the SIP manager, (2) an upload handling function, and (3) an exchange mode.

13. The computer-readable storage medium of claim 8 , wherein the global security controller includes a global security manager that manages data exchange between the SIP manager and the global security controller.

14. The computer-readable storage medium of claim 8 , wherein uploading different types of security-relevant data includes using a single exchange, streaming, event-driven or publication/subscription mode to upload the different types of security-relevant data from the components in the computer network to the SIP manager.

15. A system comprising:

a computer network with a plurality of host computers, wherein each of the host computers includes a global security endpoint manager in a customized virtual computing instance running on that host computer, wherein the customized virtual computing instance provides isolation from other virtual computing instances running on that host computer and wherein each of the customized the virtual computing instance and the other virtual computing instances includes a virtual central processing unit (CPU), virtual memory and virtual storage;

a security information plane (SIP) manager coupled to the computer network to receive different types of security-relevant data that are uploaded from components in the computer network via a southbound SIP interface of the SIP manager, including from the global security endpoint manager in the customized virtual computing instance running on each of the host computers, the SIP manager being configured to perform at least one aggregation operation on the security-relevant data to produce networkwide aggregated security information and to store the networkwide aggregated security information in a database accessible by the SIP manager; and

a global security controller coupled to the SIP manager to receive the networkwide aggregated security information that is downloaded via a northbound SIP interface of the SIP manager, the global security controller being configured to control security applications running in the computer network using the networkwide aggregated security information downloaded from the SIP manager;

wherein the networkwide aggregated security information is downloaded from the SIP manager via the southbound SIP interface of the SIP manager to at least some of the host computers in the computer network, including to each global security endpoint manager in the customized virtual computing instance running on those host computers, and wherein, at least one of the host computers in the computer network, a security service is executed by a security application running in the customized virtual computing instance of that host computer using the networkwide aggregated security data downloaded from the SIP manager.

16. The system of claim 15 , wherein the aggregation operation is a data composition operation, a differential analysis operation or a correlation operation.

17. The system of claim 15 , wherein the aggregation operation is a graph generating operation or a machine learning model generating operation.

18. The system of claim 15 , wherein the different types of security-relevant data that are uploaded from the components in the computer network include raw security data, security alerts and security polices from the components.

19. The system of claim 15 , wherein the global security endpoint manager in the customized virtual computing instance defines (1) the different types of security-relevant data that are uploaded to the SIP manager, (2) upload handling function, and (3) exchange mode.

20. The system of claim 15 , wherein the global security controller includes a global security manager that manages data exchange between the SIP manager and the global security controller.