Self learning firewall policy enforcer
An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain first traffic session metrics data and execute a machine learning model to determine a traffic prediction based on the first traffic session metrics data. The instructions cause the network system to obtain second traffic session metrics data and determine an anomaly in traffic based on a comparison of the traffic prediction and the second traffic session metrics data. The instructions cause the network system to, based on the determination of the anomaly, generate an indication of the anomaly.
1 . A network system comprising:
processing circuitry; and
one or more memories coupled to the processing circuitry and configured to store instructions which, when executed by the processing circuitry, cause the network system to:
obtain first traffic session metrics data;
execute a machine learning model to determine a traffic prediction based on the first traffic session metrics data, wherein the traffic prediction comprises an expected number of expected domain name service (DNS) requests during a period of time;
obtain second traffic session metrics data, wherein the second traffic sessions metrics data comprises a number of DNS requests by a virtual network endpoint of a host device within the period of time;
determine an anomaly in traffic based on a comparison of the traffic prediction and the second traffic session metrics data, wherein the anomaly is indicative of a DNS attack or a transmission control protocol (TCP) flood attack, and wherein as part of determining the anomaly, the instructions cause the processing circuitry to determine the number of DNS requests by the virtual network endpoint of the host device within the period of time is greater than the number of expected DNS requests; and
based on the determination of the anomaly, generate an indication of the anomaly.
2 . The network system of claim 1 , wherein the instructions further cause the network system to send the indication of the anomaly to a controller of a distributed firewall.
3 . The network system of claim 1 , wherein the machine learning model comprises an unsupervised random cut forest machine learning model.
4 . The network system of claim 1 , wherein the first traffic session metrics data and the second traffic session metrics data are indicative of service mesh traffic.
5 . The network system of claim 1 , wherein the first traffic session metrics data and the second traffic session metrics data are associated with one or more network interface cards (NICs).
6 . The network system of claim 5 , wherein the one or more NICs implement a distributed firewall.
7 . The network system of claim 1 , wherein the instructions further cause the network system to generate or select a firewall policy based on the indication of the anomaly.
8 . The network system of claim 7 , wherein the instructions further cause the network system to:
identify a NIC associated with a host device; and
send the firewall policy or an identification of the firewall policy to the NIC.
9 . The network system of claim 1 , wherein the instructions further cause the network system to:
monitor service mesh traffic leaving each network interface card (NIC) of a plurality of NICs, each of the NICs comprising NIC processing circuitry;
monitor service mesh traffic entering each NIC;
determine traffic session metrics data based on the service mesh traffic leaving each NIC and the service mesh traffic entering each NIC;
receive, from a machine learning model and based on the traffic session metrics data, the indication of the anomaly in traffic;
determine a firewall policy based on the indication of the anomaly; and
send an indication of the firewall policy to at least one of the plurality of NICs.
10 . The network system of claim 9 , wherein the indication of the firewall policy comprises at least one of the firewall policy or an identification of the firewall policy.
11 . The network system of claim 9 , wherein the instructions further cause the network system to store the traffic session metrics data in a time series database.
12 . The network system of claim 9 , wherein the traffic sessions metrics data comprises a number of domain name service requests by a virtual network endpoint of a host device within a period of time, wherein the anomaly is indicative of the number of domain name service requests by the virtual network endpoint of the host device within the period of time being greater than a number of expected domain name service requests determined by the machine learning model.
13 . The network system of claim 9 , wherein to determine the firewall policy the instructions cause the network system to select the firewall policy or generate the firewall policy.
14 . The network system of claim 9 , wherein the one or more NICs implement a distributed firewall.
15 . The network system of claim 1 , further comprising:
a network interface card (NIC) comprising processing circuitry; and
wherein the instructions further cause the network system to:
send telemetry data to a controller, the telemetry data comprising traffic session metrics data;
receive, from the controller, an indication of a firewall policy based on the determination of the anomaly in traffic; and
implement the firewall policy.
16 . The network system of claim 15 , wherein the traffic sessions metrics data comprises the second traffic session metrics data, and wherein the anomaly is determined by a machine learning model.
17 . The network system of claim 16 , wherein implementing the firewall policy causes the NIC to cease sending domain name services requests from a virtual endpoint of the host device.
18 . The network system of claim 15 , wherein the NIC implements an instance of a distributed firewall.