Abstract: Some embodiments of the invention provide a method for identifying and generating visualizations of ingress data traffic flows to a workload cluster in a software-defined network (SDN). From multiple data traffic flows associated with a particular cluster of destination workloads in the SDN, the method identifies a set of ingress data traffic flows destined to the particular cluster of destination workloads. For each identified ingress data traffic flow, the method identifies a service from a set of services through which the ingress data traffic flow reached the particular cluster of destination workloads.

Abstract: A system which includes at least one host, wherein the host is configured to implement at least one container group including a first container, a data communication module, an interface, and a malicious detection module, wherein the data communication module is configured to collect data based on data communication of the container group, and transmit collected data, or data representative thereof, to the interface, the interface being configured to transmit collected data, or data representative thereof, to the malicious detection module, for detecting malicious data.

Abstract: A system which includes at least one host, wherein the host is configured to implement at least one container group including a first container, a data communication module, an interface, and a malicious detection module, wherein the data communication module is configured to collect data based on data communication of the container group, and transmit collected data, or data representative thereof, to the interface, the interface being configured to transmit collected data, or data representative thereof, to the malicious detection module, for detecting malicious data.