Protection against man-in-the-middle attacks in virtualization environments

1. A method comprising:

monitoring, by a man-in-the-middle protection module associated with a source node comprising a virtual machine, data traffic exchanged between the source node and a destination node over a source-destination link via a network;

utilizing, by the man-in-the-middle protection module, a traffic probe packet to determine a packet delay value associated with the data traffic exchanged between the source node and the destination node over the source-destination link via the network;

storing, by the man-in-the-middle protection module, the packet delay value;

determining, by the man-in-the-middle protection module, that the packet delay value is greater than a normal packet delay value;

in response to determining that the packet delay value is greater than the normal packet delay value, determining, by the man-in-the-middle protection module, that a man-in-the-middle attacker has compromised the source-destination link;

commanding, by the man-in-the-middle protection module, the virtual machine to be decommissioned;

instructing, by the man-in-the-middle protection module, a virtualization orchestrator to create a new source node, a new virtual machine, and a new man-in-the-middle protection module, wherein the data traffic is rerouted to be exchanged between the new source node and the destination node over a new source-destination link via the network;

creating, by the man-in-the-middle protection module, fake data traffic comprising replica data packets of data packets contained in the data traffic; and

sending, by the man-in-the-middle protection module, the fake data traffic towards the man-in-the-middle attacker over the source-destination link via the network.

2. The method of claim 1 , wherein storing, by the man-in-the-middle protection module, the packet delay value comprises storing, by the man-in-the-middle protection module, the packet delay value in a distributed ledger.

3. The method of claim 2 , wherein the packet delay value comprises an average packet delay value.

4. The method of claim 2 , further comprising mapping, by the man-in-the-middle protection module, the network with a most recent packet delay value for each link in the network; and wherein determining, by the man-in-the-middle protection module, that the packet delay value is greater than the normal packet delay value comprises determining that the most recent packet delay value for the source-destination link is greater than the normal packet delay value.

5. The method of claim 1 , wherein creating, by the man-in-the-middle protection module, the fake data traffic comprises creating, by the man-in-the-middle protection module, the fake data traffic based upon a characteristic of the data traffic.

6. The method of claim 5 , wherein the characteristic of the data traffic comprises a same payload size or a same header datum.

7. The method of claim 6 , wherein the fake data traffic comprises raw data having the same payload size; and wherein the raw data is randomly generated, pseudo-randomly generated, expired, or otherwise no longer relevant to the data traffic.

8. A computer-readable storage medium having computer-executable instructions of a man-in-the-middle protection module stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

monitoring data traffic exchanged between a source node and a destination node over a source-destination link via a network, wherein the source node comprises a virtual machine;

utilizing a traffic probe packet to determine a packet delay value associated with the data traffic exchanged between the source node and the destination node over the source-destination link via the network;

storing the packet delay value;

determining that the packet delay value is greater than a normal packet delay value;

in response to determining that the packet delay value is greater than the normal packet delay value, determining that a man-in-the-middle attacker has compromised the source-destination link;

commanding the virtual machine to be decommissioned;

instructing a virtualization orchestrator to create a new source node, a new virtual machine, and a new man-in-the-middle protection module, wherein the data traffic is rerouted to be exchanged between the new source node and the destination node over a new source-destination link via the network;

creating fake data traffic comprising replica data packets of data packets contained in the data traffic; and

sending the fake data traffic towards the man-in-the-middle attacker over the source-destination link via the network.

9. The computer-readable storage medium of claim 8 , wherein storing the packet delay value comprises storing the packet delay value in a distributed ledger.

10. The computer-readable storage medium of claim 9 , wherein the packet delay value comprises an average packet delay value.

11. The computer-readable storage medium of claim 9 , wherein the operations further comprise mapping the network with a most recent packet delay value for each link in the network; and wherein determining that the packet delay value is greater than the normal packet delay value comprises determining that the most recent packet delay value for the source-destination link is greater than the normal packet delay value.

12. The computer-readable storage medium of claim 8 , wherein creating the fake data traffic comprises creating the fake data traffic based upon a characteristic of the data traffic.

13. The computer-readable storage medium of claim 12 , wherein the characteristic of the data traffic comprises a same payload size or a same header datum.

14. The computer-readable storage medium of claim 13 , wherein the fake data traffic comprises raw data having the same payload size; and wherein the raw data is randomly generated, pseudo-randomly generated, expired, or otherwise no longer relevant to the data traffic.

15. A distributed man-in-the-middle protection system comprising:

a plurality of nodes operating in a network provided, at least in part, via a virtualization environment, wherein the plurality of nodes comprises a source node and a destination node;

wherein the source node comprises a virtual machine and a man-in-the-middle protection module, wherein the man-in-the-middle protection module comprises computer-executable instructions that, when executed, perform operations comprising

monitoring data traffic exchanged between the source node and the destination node over a source-destination link via the network,

utilizing a traffic probe packet to determine a packet delay value associated with the data traffic exchanged between the source node and the destination node over the source-destination link via the network,

storing the packet delay value,

determining that the packet delay value is greater than a normal packet delay value,

in response to determining that the packet delay value is greater than the normal packet delay value, determining that a man-in-the-middle attacker has compromised the source-destination link,

commanding the virtual machine to be decommissioned,

instructing a virtualization orchestrator to create a new source node, a new virtual machine, and a new man-in-the-middle protection module, wherein the data traffic is rerouted to be exchanged between the new source node and the destination node over a new source-destination link via the network,

creating fake data traffic comprising replica data packets of data packets contained in the data traffic, and

sending the fake data traffic towards the man-in-the-middle attacker over the source-destination link via the network.

16. The distributed man-in-the-middle protection system of claim 15 , wherein storing the packet delay value comprises storing the packet delay value in a distributed ledger.

17. The distributed man-in-the-middle protection system of claim 16 , wherein the packet delay value comprises an average packet delay value.

18. The distributed man-in-the-middle protection system of claim 16 , wherein the operations further comprise mapping the network with a most recent packet delay value for each link in the network; and wherein determining that the packet delay value is greater than the normal packet delay value comprises determining that the most recent packet delay value for the source-destination link is greater than the normal packet delay value.

19. The distributed man-in-the-middle protection system of claim 15 , wherein creating the fake data traffic comprises creating the fake data traffic based upon a characteristic of the data traffic.

20. The distributed man-in-the-middle protection system of claim 19 , wherein the characteristic of the data traffic comprises a same payload size; wherein the fake data traffic comprises raw data having the same payload size; and wherein the raw data is randomly generated, pseudo-randomly generated, expired, or otherwise no longer relevant to the data traffic.