Security in microservice architectures
AssigneeSap SE
InventorAhmad Hassan
Life of this patent
Estimating the term…
Abstract
Methods, systems, and computer-readable storage media for inhibiting security threats in microservice architectures hosted on cloud infrastructures, implementations including receiving, by a microservice used in one or more microservice-based applications, a network packet including a set of features, determining, by the microservice, a probability for the set of features with respect to a set of categories, and identifying, by the microservice, that the network packet corresponds to a first category based on probabilities of the set of features, and, in response, executing an action.
Claims20
A computer-implemented method for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the method being executed by one or more processors and comprising:
- receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
- determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
- P
-
- (
- c
- i
- |
- F
- )
- =
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- ∑
- i
- =
- 1
- m
-
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
- determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P;
- and
- in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.
A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the operations comprising:
- receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
- determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
- P
-
- (
- c
- i
- |
- F
- )
- =
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- ∑
- i
- =
- 1
- m
-
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
- determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P;
- and
- in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.
A system, comprising:
- a computing device;
- and
- a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the operations comprising:
- receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
- determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
- P
-
- (
- c
- i
- |
- F
- )
- =
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- ∑
- i
- =
- 1
- m
-
- P
- c
- i
- ×
- P
-
- (
- F
- |
- c
- i
- )
- where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
- determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P;
- and
- in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.
Dependencies are inferred from the claim text.