Intent-based policy generation for virtual networks

1. A method comprising:

receiving, by a policy controller for a computer network, traffic statistics for a plurality of traffic flows among first instances of a plurality of application workloads, the first instances of the plurality of application workloads executed by a first set of one or more computing devices of a computer network;

applying, by the policy controller, a clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads;

generating, by the policy controller and from the session records of the traffic statistics for the plurality of application workloads, one or more tags for the plurality of application workloads;

generating, by the policy controller and using relationships between the one or more tags for the plurality of application workloads and the session records of the traffic statistics, one or more application firewall policies for application to the traffic flows between application workloads of the plurality of application workloads, wherein the one or more application firewall policies define whether the traffic flows between the application workloads of the plurality of application workloads are to be allowed or denied; and

distributing, by the policy controller, the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows among second instances of the plurality of application workloads, the second instances of the plurality of application workloads executed by the second set of one or more computing devices, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.

2. The method of claim 1 , wherein applying the clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads comprises:

applying the clustering algorithm to identify at least one relationship between the traffic statistics for the plurality of traffic flows; and

aggregating, based on the identified at least one relationship between the traffic statistics for the plurality of traffic flows, the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads.

3. The method of claim 1 , wherein the clustering algorithm comprises one of:

a K-Means clustering algorithm;

a Mean-Shift clustering algorithm;

a Density-based Spatial Clustering of Applications with Noise (DBSCAN) clustering algorithm;

an Expectation-Maximization (EM) clustering algorithm using Gaussian Mixture Models (GMM); or

an Agglomerative Hierarchical clustering algorithm.

4. The method of claim 1 , wherein the one or more tags specify a plurality of different object levels for the plurality of application workloads.

5. The method of claim 4 , wherein the one or more tags specify one or more of:

a global environment level for the plurality of application workloads;

a project level for the plurality of application workloads;

a virtual network level for the plurality of application workloads;

a virtual machine level for the plurality of application workloads; or

an interface level for the plurality of application workloads.

6. The method of claim 1 , wherein generating, from the session records of traffic statistics for the plurality of application workloads, the one or more tags for the plurality of application workloads comprises generating, from metadata of the session records of traffic statistics for the plurality of application workloads, the one or more tags for the plurality of application workloads.

7. The method of claim 1 , wherein the one or more application firewall policies define whether traffic flows between interfaces of the application workloads of the plurality of application workloads tagged with the one or more tags for the plurality of application workloads are to be allowed or denied.

8. The method of claim 1 ,

wherein receiving the traffic statistics for the plurality of traffic flows among the first instances of the plurality of application workloads comprises receiving, from a first set of virtual router agents for the first set of one or more computing devices, the traffic statistics for the plurality of traffic flows among the first instances of the plurality of application workloads, and

wherein distributing the one or more application firewall policies to the second set of one or more computing devices for application to the traffic flows among the second instances of the plurality of application workloads comprises distributing, to a second set of virtual router agents for the second set of one or more computing devices, the one or more application firewall policies for application to the traffic flows among the second instances of the plurality of application workloads.

9. The method of claim 8 , further comprising applying, by the second set of virtual router agents, the one or more application firewall policies to the traffic flows among the second instances of the plurality of application workloads to at least one of allow or deny at least one traffic flow.

10. The method of claim 1 , further comprising presenting, by the policy controller, the one or more application firewall policies for display to a user.

11. A policy controller for a computer network, the policy controller comprising processing circuitry and configured to:

receive traffic statistics for a plurality of traffic flows among first instances of a plurality of application workloads, the first instances of the plurality of application workloads executed by a first set of one or more computing devices of a computer network;

apply a clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of the traffic statistics for the plurality of application workloads;

generate, from the session records of traffic statistics for the plurality of application workloads, one or more tags for the plurality of application workloads;

generate, using relationships between the one or more tags for the plurality of application workloads and the session records of the traffic statistics, one or more application firewall policies for application to the traffic flows between application workloads of the plurality of application workloads, wherein the one or more application firewall policies define whether the traffic flows between the application workloads of the plurality of application workloads are to be allowed or denied; and

distribute the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows among second instances of the plurality of application workloads, the second instances of the plurality of application workloads executed by the second set of one or more computing devices, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.

12. The policy controller of claim 11 , wherein to apply the clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads, the policy controller is configured to:

apply the clustering algorithm to identify at least one relationship between the traffic statistics for the plurality of traffic flows; and

aggregate, based on the identified at least one relationship between the traffic statistics for the plurality of traffic flows, the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads.

13. The policy controller of claim 11 , wherein the clustering algorithm comprises one of:

a K-Means clustering algorithm;

a Mean-Shift clustering algorithm;

a Density-based Spatial Clustering of Applications with Noise (DBSCAN) clustering algorithm;

an Expectation-Maximization (EM) clustering algorithm using Gaussian Mixture Models (GMM); or

an Agglomerative Hierarchical clustering algorithm.

14. The policy controller of claim 11 , wherein the one or more tags specify a plurality of different object levels for the plurality of application workloads.

15. The policy controller of claim 14 , wherein the one or more tags specify one or more of:

a global environment level for the plurality of application workloads;

a project level for the plurality of application workloads;

a virtual network level for the plurality of application workloads;

a virtual machine level for the plurality of application workloads; or

an interface level for the plurality of application workloads.

16. The policy controller of claim 11 , wherein to generate, from the session records of traffic statistics for the plurality of application workloads, the one or more tags for the plurality of application workloads, the policy controller is configured to generate, from metadata of the session records of traffic statistics for the plurality of application workloads, the one or more tags for the plurality of application workloads.

17. The policy controller of claim 11 , wherein the one or more application firewall policies define whether traffic flows between interfaces of the application workloads of the plurality of application workloads tagged with the one or more tags for the plurality of application workloads are to be allowed or denied.

18. The policy controller of claim 11 ,

wherein to receive the traffic statistics for the plurality of traffic flows among the first instances of the plurality of application workloads, the policy controller is configured to receive, from a first set of virtual router agents for the first set of one or more computing devices, the traffic statistics for the plurality of traffic flows among the first instances of the plurality of application workloads, and

wherein to distribute the one or more application firewall policies to the second set of one or more computing devices for application to the traffic flows among the second instances of the plurality of application workloads, the policy controller is configured to distribute, to a second set of virtual router agents for the second set of one or more computing devices, the one or more application firewall policies for application to the traffic flows among the second instances of the plurality of application workloads.

19. The policy controller of claim 11 , further configured to present the one or more application firewall policies for display to a user.

20. A non-transitory, computer-readable medium comprising instructions that, when executed, are configured to cause processing circuitry to execute a policy controller for a computer network, the policy controller configured to:

receive traffic statistics for a plurality of traffic flows among first instances of a plurality of application workloads, the first instances of the plurality of application workloads executed by a first set of one or more computing devices of a computer network;

apply a clustering algorithm to correlate the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads;

generate, from the session records of traffic statistics for the plurality of application workloads, one or more tags for the plurality of application workloads;

generate, using relationships between the one or more tags for the plurality of application workloads and the session records of the traffic statistics, one or more application firewall policies for application to the traffic flows between application workloads of the plurality of application workloads, wherein the one or more application firewall policies define whether the traffic flows between the application workloads of the plurality of application workloads are to be allowed or denied; and

distribute the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows among second instances of the plurality of application workloads, the second instances of the plurality of application workloads executed by the second set of one or more computing devices, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.