Malicious application detection and prevention system for stream computing applications deployed in cloud computing environments

A computer-implemented system, comprising:

• one or more computers programmed for providing malicious application detection and prevention for a stream computing application deployed in a cloud computing environment, by:
• performing static and run-time analyses of the stream computing application and any files associated therewith to create an expected profile of the stream computing application's behavior, wherein the run-time analysis includes:
• analyzing any sources, sinks or system calls in the stream computing application, performing an estimated mapping of an amount of expected data to be sent from one or more source operators to one or more sink operators in the stream computing application and monitoring the sent data for deviation from the expected value data;
• invoking the stream computing application in an execution environment to compare the stream computing application's behavior to the expected profile as the stream computing application runs in the execution environment;
• and isolating the stream computing application within the cloud computing environment when the stream computing application's behavior deviates significantly from the expected profile.

A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more computers to cause the computers to perform a method, comprising:

• providing malicious application detection and prevention for a stream computing application deployed in a cloud computing environment, by:
• performing static and run-time analyses of the stream computing application and any files associated therewith to create an expected profile of the stream computing application's behavior, wherein the run-time analysis includes:
• analyzing any sources, sinks or system calls in the stream computing application, performing an estimated mapping of an amount of expected data to be sent from one or more source operators to one or more sink operators in the stream computing application and monitoring the sent data for deviation from the expected value data;
• invoking the stream computing application in an execution environment to compare the stream computing application's behavior to the expected profile as the stream computing application runs in the execution environment;
• and isolating the stream computing application within the cloud computing environment when the stream computing application's behavior deviates significantly from the expected profile.