Patent attributes
A method and apparatus are disclosed for malware detection in service function chains. In one embodiment, a method includes receiving data associated with a service function chain, the service function chain comprising a plurality of virtual components organized into a plurality of hierarchical levels and the data indicating interactions between the virtual components when processing at least one packet through the service function chain; filtering the received data based at least in part on a time-between order relation of the interactions between the virtual components and the hierarchical level of the virtual component; and generating a harmony feature vector for the service function chain by applying a featurization function on the filtered data, the harmony feature vector including metrics, the metrics calculated according to the featurization function for each hierarchical level being based at least in part on metrics calculated for at least one lower hierarchical level.
