Probe-based virtual network sensitive data traffic detection
The technology disclosed relates to detection of data traffic in computing environments, such as cloud environments. Example systems and methods detect a plurality of workloads in a virtual network in a computing environment and deploy a plurality of probe agents to the plurality of workloads. Each respective probe agent detects network traffic on a respective workload of the plurality of workloads, scans a data packet that is at least one of sent or received by the respective workload, generates a data classification relative to the data packet, and generates a scan result that includes packet payload information and an indication of the data classification. The scan results are received from the plurality of probe agents and a computing action is performed based on scan results.
1 . A method performed by a computing system having one or more processors, the method comprising:
detecting a plurality of workloads in a virtual network in a computing environment;
deploying a plurality of probe agents to the plurality of workloads, wherein each respective probe agent of the plurality of probe agents,
detects a data packet in network traffic on a respective workload of the plurality of workloads, the data packet being at least one of:
sent by the respective workload to another workload in the virtual network, or
received by the respective workload from another workload in the virtual network,
scans the data packet to extract a packet payload from the data packet, and
generates a data classification of the packet payload in response to a determination that the packet payload includes at least one instance of one or more pre-defined data patterns of a target data type, the target data type comprising at least one of a sensitive data type or a private data type;
receiving a scan result from a respective agent of the plurality of probe agents, wherein the scan result includes a representation of the respective packet payload scanned by the respective probe agent and the data classification of the respective packet payload; and
performing a computing action based on the scan result.
2 . The method of claim 1 , wherein the computing environment comprises a cloud environment, and the virtual network comprises a virtual private network comprising a logical grouping of resources that are operationally isolated from one or more other virtual networks in the cloud environment.
3 . The method of claim 2 , wherein the virtual network comprises a virtual private cloud (VPC).
4 . The method of claim 3 , and further comprising identifying traffic paths between the plurality of workloads in the virtual private cloud, wherein performing a computing action comprises generating a graph representation of the traffic paths, wherein the graph representation comprises a first node representing a first workload, a second node representing a second workload, and an edge between the first node and second node, the edge representing the data classification of a respective packet payload.
5 . The method of claim 3 , wherein the data packet comprises at least one of a data copy operation or a data query operation.
6 . The method of claim 1 , wherein each respective probe agent of the plurality of probe agents comprises a program attached to one or more probe points in at least one of a kernel or user-space application in the respective workload.
7 . The method of claim 6 , wherein each respective probe agent of the plurality of probe agents comprises:
kernel probe code that runs in a host kernel space of the respective workload and is configured to intercept data packets transmitted using a transport layer protocol;
user space probe code that runs in a host user space of the respective workload and is configured to intercept the network traffic prior to encryption;
a scanner engine configured to extract the packet payload; and
a telemetry component configured to perform one or more telemetry functions based on the packet payload.
8 . The method of claim 7 , wherein each respective probe agent of the plurality of probe agents comprises an extended Berkeley Packet Filter (eBPF) probe.
9 . The method of claim 1 , wherein deploying the plurality of probe agents comprises at least one of:
invoking, by an orchestration engine in a control plane, a computing service in each respective workload of the plurality of workloads, or
defining a deployment script configured to deploy each probe agent of the plurality of probe agents.
10 . The method of claim 1 , wherein
the respective workload comprises at least one of a virtual machine, a data center, an application, or a computing service, and
the data packet is communicated between the respective workload and another workload.
11 . The method of claim 1 , wherein the scan of the data packet to extract the packet payload and the generation of the data classification are performed by one or more resources on the respective workload.
12 . A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
detect a plurality of workloads in a virtual network in a computing environment, the plurality of workloads being operationally isolated from one or more other virtual networks in the computing environment;
deploy a plurality of probe agents to the plurality of workloads, wherein each respective probe agent of the plurality of probe agents is configured to:
detect a data packet in network traffic on a respective workload of the plurality of workloads, the data packet being at least one of:
sent by the respective workload to another workload in the virtual network, or
received by the respective workload from another workload in the virtual network,
scan the data packet to extract a packet payload from the data packet, and
generate a data classification of the packet payload in response to a determination that the packet payload includes at least one instance of one or more pre-defined data patterns of a target data type, the target data type comprising at least one of a sensitive data type or a private data type;
receive a scan result from a respective agent of the plurality of probe agents, wherein the scan result includes a representation of the respective packet payload scanned by the respective probe agent and the data classification of the respective packet payload; and
perform a computing action based on the scan result.
13 . The computing system of claim 12 , wherein the computing environment comprises a cloud environment, and the virtual network comprises a virtual private cloud.
14 . The computing system of claim 12 , wherein the plurality of workloads comprises a first workload in the virtual network and a second workload in the virtual network, and wherein the network traffic on the second workload comprises data movement between the first workload to the second workload.
15 . The computing system of claim 14 , wherein the instructions, when executed, cause the computing system to:
identify a traffic path from the first workload to the second workload; and
generate a graph representation of the traffic path, wherein the data movement comprises at least one of a data copy operation or a data query operation, wherein the graph representation comprises a first node representing the first workload, a second node representing the second workload, and an edge between the first node and second node, the edge representing the data classification of a respective packet payload.
16 . The computing system of claim 12 , wherein
the target data type comprises one or more of a sensitive data type or a private data type, and
each respective probe agent of the plurality of probe agents comprises a program attached to one or more probe points in at least one of a kernel or user-space application in the respective workload.
17 . The computing system of claim 16 , wherein each respective probe agent of the plurality of probe agents comprises:
kernel probe code that runs in a host kernel space of the respective workload and is configured to intercept data packets transmitted using a transport layer protocol;
user space probe code that runs in a host user space of the respective workload and is configured to intercept the network traffic prior to encryption;
a scanner engine configured to extract the packet payload; and
a telemetry component configured to perform one or more telemetry functions based on the packet payload.
18 . A computing system comprising:
at least one processor;
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
a probe agent deployment component configured to deploy a probe agent to a first workload in a virtual private network in a cloud environment, the probe agent configured to detect network traffic representing data movement between a second workload in the virtual private network and the first workload in the virtual private network;
a result detection component configured to detect a scan result indicative of a data packet in the network traffic detected by the probe agent, wherein the scan result includes packet payload information and an indication of a sensitive data classification relative to the data packet; and
a graph generator component configured to generate a graph representation that shows a traffic path of data movement between the second workload and the first workload, wherein the graph representation comprises a first node representing the first workload, a second node representing the second workload, and an edge between the first node and second node, the edge representing the packet payload information and the sensitive data classification.
19 . The computing system of claim 18 , wherein the probe agent comprises a program attached to one or more probe points in at least one of a kernel or user-space application in the first workload.
20 . The computing system of claim 18 , wherein the probe agent comprises:
kernel probe code that runs in a host kernel space of the first workload and is configured to intercept data packets transmitted using a transport layer protocol;
user space probe code that runs in a host user space of the first workload and is configured to intercept the network traffic prior to encryption;
a scanner engine configured to extract the packet payload information; and
a telemetry component configured to perform one or more telemetry functions based on the packet payload information.