Service labeling using semi-supervised learning

Abstract

The disclosure provides an approach for workload labeling and identification of known or custom applications. Embodiments include determining a plurality of sets of features comprising a respective set of features for each respective workload of a first subset of a plurality of workloads. Embodiments include identifying a group of workloads based on similarities among the plurality of sets of features. Embodiments include receiving label data from a user comprising a label for the group of workloads. Embodiments include associating the label with each workload of the group of workloads to produce a training data set. Embodiments include using the training data set to train a model to output labels for input workloads. Embodiments include determining a label for a given workload of the plurality of workloads by inputting features of the given workload to the model.

We claim: 
     
         1 . A method of managing workloads, comprising:
 from a plurality of workloads each comprising a virtual computing instance (VCI) running a plurality of processes, identifying a group of workloads that have similar respective values associated with a set of respective features;   displaying information about one of the workloads via a user interface, wherein the information comprises one or more of the respective values associated with the set of respective features;   receiving a label via the user interface in response to the displaying of the information about the one of the workloads;   associating the label with each workload of the group of workloads;   producing a training data set comprising the respective values associated with the respective features of each workload in the group of workloads and the associated label;   training a machine learning model using the training data set;   generating, using the machine learning model, a predicted label for a new workload of the plurality of workloads by inputting values associated with the respective features of the new workload to the machine learning model, wherein the new workload is not a member of the group of workloads;   assigning the predicted label to the new workload; and   performing, based on the assigned predicted label, one or more of:
 generating a visualization; 
 performing statistical analysis with respect to a plurality of workloads that are associated with the assigned predicted label; or 
 segmenting a network. 
   
     
     
         2 . The method of  claim 1 , wherein the set of features comprises one or more of:
 a number of connections between the respective workload and a particular port;   a number of local or remote processes for the respective workload;   the respective workload does or does not listen on a given port;   the respective workload does or does not connect to a given port;   the respective workload does or does not run a given local process; or   the respective workload does or does not connect to a given remote process.   
     
     
         3 . The method of  claim 1 , wherein identifying the group of workloads that have similar respective values associated with the set of respective features comprises calculating cosine similarity among a plurality of sets of features. 
     
     
         4 . The method of  claim 1 , further comprising receiving input via the user interface indicating that a certain workload should be removed from the group of workloads. 
     
     
         5 . The method of  claim 1 , wherein the machine learning model comprises a classification model, a tree-based model, or a linear regression model. 
     
     
         6 . The method of  claim 1 , further comprising adding the new workload to a security group based on the predicted label for the new workload. 
     
     
         7 . The method of  claim 1 , further comprising re-training the machine learning model based on the predicted label for the new workload. 
     
     
         8 . The method of  claim 1 , wherein the generating of the visualization comprises grouping, within the visualization, the plurality of workloads that are associated with the assigned predicted label. 
     
     
         9 . The method of  claim 1 , wherein the performing of the statistical analysis with respect to the plurality of workloads that are associated with the assigned predicted label comprises generating statistics related to performance of the plurality of workloads that are associated with the assigned predicted label. 
     
     
         10 . A system for training a machine learning model, comprising:
 at least one memory; and   at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
 from a plurality of workloads each comprising a virtual computing instance (VCI) running a plurality of processes, identify a group of workloads that have similar respective values associated with a set of respective features; 
 display information about one of the workloads via a user interface, wherein the information comprises one or more of the respective values associated with the set of respective features; 
 receive a label via the user interface in response to the displaying of the information about the one of the workloads; 
 associate the label with each workload of the group of workloads; 
 produce a training data set comprising the respective values associated with the respective features of each workload in the group of workloads and the associated label; 
 train a machine learning model using the training data set; 
 generate, using the machine learning model, a predicted label for a new workload of the plurality of workloads by inputting values associated with the respective features of the new workload to the machine learning model, wherein the new workload is not a member of the group of workloads; 
 assign the predicted label to the new workload; and 
 perform, based on the assigned predicted label, one or more of:
 generating a visualization; 
 performing statistical analysis with respect to a plurality of workloads that are associated with the assigned predicted label; or 
 segmenting a network. 
 
   
     
     
         11 . The system of  claim 10 , wherein the set of features comprises one or more of:
 a number of connections between the respective workload and a particular port;   a number of local or remote processes for the respective workload;   the respective workload does or does not listen on a given port;   the respective workload does or does not connect to a given port;   the respective workload does or does not run a given local process; or   the respective workload does or does not connect to a given remote process.   
     
     
         12 . The system of  claim 10 , wherein identifying the group of workloads that have similar respective values associated with the set of respective features comprises calculating cosine similarity among a plurality of sets of features. 
     
     
         13 . The system of  claim 10 , wherein the at least one processor and the at least one memory are further configured to receive input via the user interface indicating that a certain workload should be removed from the group of workloads. 
     
     
         14 . The system of  claim 10 , wherein the machine learning model comprises a classification model, a tree-based model, or a linear regression model. 
     
     
         15 . The system of  claim 10 , wherein the at least one processor and the at least one memory are further configured to add the new workload to a security group based on the predicted label for the new workload. 
     
     
         16 . The system of  claim 10 , wherein the at least one processor and the at least one memory are further configured to re-train the machine learning model based on the predicted label for the new workload. 
     
     
         17 . The system of  claim 10 , wherein the generating of the visualization comprises grouping, within the visualization, the plurality of workloads that are associated with the assigned predicted label. 
     
     
         18 . The system of  claim 10 , wherein the performing of the statistical analysis with respect to the plurality of workloads that are associated with the assigned predicted label comprises generating statistics related to performance of the plurality of workloads that are associated with the assigned predicted label. 
     
     
         19 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
 from a plurality of workloads each comprising a virtual computing instance (VCI) running a plurality of processes, identify a group of workloads that have similar respective values associated with a set of respective features;   display information about one of the workloads via a user interface, wherein the information comprises one or more of the respective values associated with the set of respective features;   receive a label via the user interface in response to the displaying of the information about the one of the workloads;   associate the label with each workload of the group of workloads;   produce a training data set comprising the respective values associated with the respective features of each workload in the group of workloads and the associated label;   train a machine learning model using the training data set;   generate, using the machine learning model, a predicted label for a new workload of the plurality of workloads by inputting values associated with the respective features of the new workload to the machine learning model, wherein the new workload is not a member of the group of workloads;   assign the predicted label to the new workload; and   perform, based on the assigned predicted label, one or more of:
 generating a visualization; 
 performing statistical analysis with respect to a plurality of workloads that are associated with the assigned predicted label; or 
 segmenting a network. 
   
     
     
         20 . The non-transitory computer-readable medium of  claim 19 , wherein the generating of the visualization comprises grouping, within the visualization, the plurality of workloads that are associated with the assigned predicted label. 
     
     
         21 . The non-transitory computer-readable medium of  claim 19 , wherein the performing of the statistical analysis with respect to the plurality of workloads that are associated with the assigned predicted label comprises generating statistics related to performance of the plurality of workloads that are associated with the assigned predicted label.