# US 10,484,410 B2 · Anomaly detection for micro-service communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,410 B2 - Document ID: US10484410B2 - Status: Granted - Kind: B2 - Application number: 15/653,689 - Filed: 2017-07-19 - Published: 2019-01-24 - Granted: 2019-11-19 - Earliest claimed: 2017-07-19 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Enzo Fenoglio; Jérôme Tollet; Syed Muhammad Mohsin Kazmi; Hugo M. Latapie - Web page: https://patentgrep.com/patent/US10484410B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 43/026: using flow identification - H04L 43/12: Network monitoring probes - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Presented herein are techniques for detecting anomalies in micro-service communications that are indicative of security issues/problems for the application. More specifically, a computing device receives a plurality of micro-service communication records each associated with traffic sent between pairs of executables (nodes) that are related to a micro-services application. Each of the micro-service communication records includes a time series entry and an associated trace sequence identifier and each of the micro-service communication records are generated during a time period. The computing device analyzes the plurality of micro-service communications to detect possible anomalous communication patterns associated with the micro-services application during the time period. ## Claims ### Claim 1 A method comprising: at a computing device: obtaining a plurality of micro-service communication records that are each associated with traffic sent between pairs of executables that are related to a micro-services application, wherein each of the micro-service communication records includes a time series entry and an associated trace sequence identifier; determining, from the plurality of micro-service communication records, one or more typical communication patterns for the executables related to the micro-services application; obtaining one or more micro-service communication records that are associated with traffic sent between pairs of the executables related to the micro-services application, wherein the one or more micro-service communication records each include a time series entry and an associated trace sequence identifier, wherein the one or more micro-service communication records are different from the plurality of micro-service communication records, and wherein each of the one or more micro-service communication records is generated during a first time period; and analyzing the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns associated with the micro-services application during the first time period. ### Claim 2 (depends on 1) The method of claim 1, wherein analyzing the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns comprises: inferring, from the one or more micro-service communication records, at least a first pattern of communications during the first time period for the executables related to the micro-services application; and determining deviations between the at least first pattern of communication and at least one of the one or more typical communication patterns for the executables associated with the micro-services application. ### Claim 3 (depends on 1) The method of claim 1, wherein the traffic sent between pairs of executables that are related to the micro-services application comprise at least one of: traffic sent between pairs of micro-services forming the micro-services application, or traffic sent between a micro-service forming part of the micro-services application and a device that is not part of the micro-services application. ### Claim 4 (depends on 1) The method of claim 1, wherein analyzing the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns comprises: identifying a dynamical system that generated the one or more micro-service communication records; inferring a grammar for a target language associated with the one or more micro-service communication records; extending the inferred grammar with source and destination cryptographic signature identifiers included within the one or more micro-service communication records; and computing a similarity metric between a sequence of symbols generated by the dynamical system and a sequence of symbols generated by the extended grammar. ### Claim 5 (depends on 4) The method of claim 4, further comprising: pre-learning a plurality of dynamical systems associated with the micro-services application, and wherein identifying a dynamical system that generated the one or more micro-service communication records comprises selecting one of the pre-learned plurality of dynamical systems. ### Claim 6 (depends on 1) The method of claim 1, wherein each of the time series entries in the plurality of micro-service communication records and the one or more micro-service communication records comprises: a flow volume indicating a number of packets and bytes sent between a source executable and destination executable of the associated traffic; and a flow duration indicating a time duration of the communication exchange between the source executable and the destination executable. ### Claim 7 (depends on 1) The method of claim 1, wherein each of the trace sequence identifiers in the plurality of micro-service communication records and the one or more micro-service communication records comprises: a time stamp, a cryptographic signature identifier of a source executable that sent the associated traffic, and a cryptographic signature identifier of a destination executable that received the associated traffic. ### Claim 8 A computing device comprising: a network interface configured to enable connectivity to a network; a memory; and one or more processors coupled to the network interface and the memory, and configured to: obtain a plurality of micro-service communication records that are each associated with traffic sent between pairs of executables that are related to a micro-services application, wherein each of the micro-service communication records includes a time series entry and an associated trace sequence identifier; determine, from the plurality of micro-service communication records, one or more typical communication patterns for the executables related to the micro-services application; obtain one or more micro-service communication records that are associated with traffic sent between pairs of the executables related to the micro-services application, wherein the one or more service communication records each include a time series entry and an associated trace sequence identifier, wherein the one or more micro-service communication records are different from the plurality of micro-service communication records, and wherein each of the one or more micro-service communication records is generated during a first time period; and analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns associated with the micro-services application during the first time period. ### Claim 9 (depends on 8) The computing device of claim 8, wherein to analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns, the one or more processors are configured to: infer, from the one or more micro-service communication records, at least a first pattern of communications during the first time period for executables related to the micro-services application; and determine deviations between the at least first pattern of communication and at least one of the one or more typical communication patterns for the executables associated with the micro-services application. ### Claim 10 (depends on 8) The computing device of claim 8, wherein the traffic sent between pairs of executables that are related to the micro-services application comprise at least one of: traffic sent between pairs of micro-services forming the micro-services application, or traffic sent between a micro-service forming part of the micro-services application and a device that is not part of the micro-services application. ### Claim 11 (depends on 8) The computing device of claim 8, wherein to analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns, the one or more processors are configured to: identify a dynamical system that generated the one or more micro-service communication records; infer a grammar for a target language associated with the one or more micro-service communication records; extend the inferred grammar with source and destination cryptographic signature identifiers included within the one or more micro-service communication records; and compute a similarity metric between a sequence of symbols generated by the dynamical system and a sequence of symbols generated by the extended grammar. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the one or more processors are configured to: pre-learn a plurality of dynamical systems associated with the micro-services application, and wherein identifying a dynamical system that generated the one or more micro-service communication records comprises selecting one of the pre-learned plurality of dynamical systems. ### Claim 13 (depends on 8) The computing device of claim 8, wherein each of the time series entries in the plurality of micro-service communication records and the one or more micro-service communication records comprises: a flow volume indicating a number of packets and bytes sent between a source executable and a destination executable of the associated traffic; and a flow duration indicating a time duration of the communication exchange between the source executable and the destination executable. ### Claim 14 (depends on 8) The computing device of claim 8, wherein each of the trace sequence identifiers in the plurality of micro-service communication records and the one or more micro-service communication records comprises: a time stamp, a cryptographic signature identifier of a source executable that sent the associated traffic, and a cryptographic signature identifier of a destination executable that received the associated traffic. ### Claim 15 One or more non-transitory computer readable storage media at a computing device, wherein the non-transitory computer readable storage media are encoded with instructions that, when executed by a processor, cause the processor to: obtain a plurality of micro-service communication records that are each associated with traffic sent between pairs of executables that are related to a micro-services application, wherein each of the micro-service communication records includes a time series entry and an associated trace sequence identifier; determine, from the plurality of micro-service communication records, one or more typical communication patterns for the executables related to the micro-services application; obtain one or more micro-service communication records that are associated with traffic sent between pairs of the executables related to the micro-services application, wherein the one or more micro-service communication records are different from the plurality of micro-service communication records, and wherein each of the one or more micro-service communication records is generated during a first time period; and analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns associated with the micro-services application during the first time period. ### Claim 16 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein the instructions operable to analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns comprise instructions operable to: infer, from the one or more micro-service communication records, at least a first pattern of communications during the first time period for the executables related to the micro-services application; and determine deviations between the at least first pattern of communication and at least one of the one or more typical communication patterns for the executables associated with the micro-services application. ### Claim 17 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein the traffic sent between pairs of executables that are related to the micro-services application comprise at least one of: traffic sent between pairs of micro-services forming the micro-services application, or traffic sent between a micro-service forming part of the micro-services application and a device that is not part of the micro-services application. ### Claim 18 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein the instructions operable to analyze the one or more micro-service communication records relative to the one or more typical communication patterns to detect possible anomalous communication patterns comprise instructions operable to: identify a dynamical system that generated the one or more micro-service communication records; infer a grammar for a target language associated with the one or more micro-service communication records; extend the inferred grammar with source and destination cryptographic signature identifiers included within the one or more micro-service communication records; and compute a similarity metric between a sequence of symbols generated by the dynamical system and a sequence of symbols generated by the extended grammar. ### Claim 19 (depends on 18) The non-transitory computer readable storage media of claim 18, further comprising instructions operable to: pre-learn a plurality of dynamical systems associated with the micro-services application, and wherein identifying a dynamical system that generated the one or more micro-service communication records comprises selecting one of the pre-learned plurality of dynamical systems. ### Claim 20 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein each of the time series entries in the plurality of micro-service communication records and the one or more micro-service communication records comprises a flow volume indicating a number of packets and bytes sent between a source executable and a destination executable of the associated traffic, and a flow duration indicating a time duration of the communication exchange between the source executable and the destination executable; and wherein each of the trace sequence identifiers in the plurality of micro-service communication records and the one or more micro-service communication records comprises a time stamp, a cryptographic signature identifier of a source executable that sent the associated traffic, and a cryptographic signature identifier of a destination executable that received the associated traffic.