Anomaly detection for micro-service communications

A computing device comprising:

• a network interface configured to enable connectivity to a network;
• a memory;
• and
• one or more processors coupled to the network interface and the memory, and configured to:
• obtain a plurality of micro-service communication records that are each associated with traffic sent between pairs of executables that are related to a micro-services application, wherein each of the micro-service communication records includes a time series entry and an associated trace sequence identifier;
• determine, from the plurality of micro-service communication records, one or more typical communication patterns for the executables related to the micro-services application;
• obtain one or more micro-service communication records that are associated with traffic sent between pairs of the executables related to the micro-services application, wherein the one or more service communication records each include a time series entry and an associated trace sequence identifier, wherein the one or more micro-service communication records are different from the plurality of micro-service communication records, and wherein each of the one or more micro-service communication records is generated during a first time period;
• and
• analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns associated with the micro-services application during the first time period.

One or more non-transitory computer readable storage media at a computing device, wherein the non-transitory computer readable storage media are encoded with instructions that, when executed by a processor, cause the processor to:

• obtain a plurality of micro-service communication records that are each associated with traffic sent between pairs of executables that are related to a micro-services application, wherein each of the micro-service communication records includes a time series entry and an associated trace sequence identifier;
• determine, from the plurality of micro-service communication records, one or more typical communication patterns for the executables related to the micro-services application;
• obtain one or more micro-service communication records that are associated with traffic sent between pairs of the executables related to the micro-services application, wherein the one or more micro-service communication records are different from the plurality of micro-service communication records, and wherein each of the one or more micro-service communication records is generated during a first time period;
• and
• analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns associated with the micro-services application during the first time period.