# US 10,769,274 B2 · Security in microservice architectures

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,274 B2
- Document ID: US10769274B2
- Status: Granted
- Kind: B2
- Application number: 15/677,728
- Filed: 2017-08-15
- Published: 2019-02-21
- Granted: 2020-09-08
- Earliest claimed: 2017-08-15
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Ahmad Hassan
- Web page: https://patentgrep.com/patent/US10769274B2

## CPC

- H04L 67/1031: Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- H04L 41/142: using statistical or mathematical methods
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1458: {Denial of Service}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods, systems, and computer-readable storage media for inhibiting security threats in microservice architectures hosted on cloud infrastructures, implementations including receiving, by a microservice used in one or more microservice-based applications, a network packet including a set of features, determining, by the microservice, a probability for the set of features with respect to a set of categories, and identifying, by the microservice, that the network packet corresponds to a first category based on probabilities of the set of features, and, in response, executing an action.

## Claims

### Claim 1

A computer-implemented method for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the method being executed by one or more processors and comprising:
receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
P
⁡
(
c
i
|
F
)
=
P
c
i
×
P
⁡
(
F
|
c
i
)
∑
i
=
1
m
⁢
P
c
i
×
P
⁡
(
F
|
c
i
)
where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P; and
in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first category comprises an attack category, and the action comprises inhibiting execution of one or more functions of the microservice.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first category comprises a normal category, and the action comprises allowing execution of one or more functions of the microservice.

### Claim 4 (depends on 3)

The method of claim 3, wherein the one or more functions comprise transmitting data to a second microservice.

### Claim 5 (depends on 3)

The method of claim 3, wherein the one or more functions comprise transmitting data to an operating system of the cloud infrastructure.

### Claim 6 (depends on 1)

The method of claim 1, wherein the network packet is received from a client-side computing device.

### Claim 7 (depends on 1)

The method of claim 1, wherein the network packet is received from a second microservice on the cloud infrastructure.

### Claim 8

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the operations comprising:
receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
P
⁡
(
c
i
|
F
)
=
P
c
i
×
P
⁡
(
F
|
c
i
)
∑
i
=
1
m
⁢
P
c
i
×
P
⁡
(
F
|
c
i
)
where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P; and
in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.

### Claim 9 (depends on 8)

The computer-readable storage medium of claim 8, wherein the first category comprises an attack category, and the action comprises inhibiting execution of one or more functions of the microservice.

### Claim 10 (depends on 8)

The computer-readable storage medium of claim 8, wherein the first category comprises a normal category, and the action comprises allowing execution of one or more functions of the microservice.

### Claim 11 (depends on 10)

The computer-readable storage medium of claim 10, wherein the one or more functions comprise transmitting data to a second microservice.

### Claim 12 (depends on 10)

The computer-readable storage medium of claim 10, wherein the one or more functions comprise transmitting data to an operating system of the cloud infrastructure.

### Claim 13 (depends on 8)

The computer-readable storage medium of claim 8, wherein the network packet is received from a client-side computing device.

### Claim 14 (depends on 8)

The computer-readable storage medium of claim 8, wherein the network packet is received from a second microservice on the cloud infrastructure.

### Claim 15

A system, comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for inhibiting security threats in microservice architectures hosted on a cloud infrastructure, the operations comprising:
receiving, by a first microservice used in one or more microservice-based applications hosted on the cloud infrastructure, a network packet comprising a set of features F;
determining, by the first microservice, a probability P that the set of features F corresponds to a category ci in a set of categories C using a probabilistic model, the probabilistic model applying a rule for detecting a maximum probability:
P
⁡
(
c
i
|
F
)
=
P
c
i
×
P
⁡
(
F
|
c
i
)
∑
i
=
1
m
⁢
P
c
i
×
P
⁡
(
F
|
c
i
)
where m is a number of categories in the set of categories and i is a counter that increases from 1 to m;
determining, by the first microservice, substantially in near real time that the network packet corresponds to a first category within the set of categories C based on the probability P; and
in response to determining that the network packet corresponds to the first category, executing, by the first microservice, an action comprising shutting down a defective microservice on the cloud infrastructure and instantiating another instance of the defective microservice on the cloud infrastructure.

### Claim 16 (depends on 15)

The system of claim 15, wherein the first category comprises an attack category, and the action comprises inhibiting execution of one or more functions of the microservice.

### Claim 17 (depends on 15)

The system of claim 15, wherein the first category comprises a normal category, and the action comprises allowing execution of one or more functions of the microservice.

### Claim 18 (depends on 17)

The system of claim 17, wherein the one or more functions comprise transmitting data to a second microservice.

### Claim 19 (depends on 17)

The system of claim 17, wherein the one or more functions comprise transmitting data to an operating system of the cloud infrastructure.

### Claim 20 (depends on 17)

The system of claim 17, wherein the network packet is received from a client-side computing device.