# US 10,873,592 B1 · Kubernetes launch graph > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,592 B1 - Document ID: US10873592B1 - Status: Granted - Kind: B1 - Application number: 16/775,054 - Filed: 2020-01-28 - Granted: 2020-12-22 - Earliest claimed: 2019-12-23 - Assignees: Lacework Inc. - Applicants: Lacework Inc. - Inventors: Harish Kumar Bharat Singh; Vikram Kapoor - Web page: https://patentgrep.com/patent/US10873592B1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 11/3093: {Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 21/554: {involving event detection and direct action} - G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/323: {Visualisation of programs or trace data} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Log data associated with an environment that includes containers is received. An example of such an environment is one managed by Kubernetes. A logical graph is generated using at least a portion of the received log data. The logical graph is used to detect an anomaly. In response to the anomaly being detected, the anomaly is recorded. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive log data associated with a containerized environment; generate a logical graph using at least a portion of the received log data, wherein the generated logical graph comprises a Kubernetes launch graph that models launching behaviors of components in a containerized network environment and wherein the generated logical graph comprises a set of edges including at least one edge that connects a first node to a second node; use the logical graph to detect an anomaly, at least in part by determining that a change has been made to the set of edges, and wherein the change made to the set of edges is at least one of: (1) an addition of an edge to the set, and (2) a modification to an edge that is already present in the set, and in response to detecting the anomaly, generate an alert; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1 wherein the containerized network environment is a hybridized environment and wherein the Kubernetes launch graph includes nodes corresponding to non-containerized processes. ### Claim 3 (depends on 2) The system of claim 2 wherein operating system information associated with the non-containerized processes is used to define an artificial containerization overlay for the non-containerized processes. ### Claim 4 (depends on 1) The system of claim 1 wherein generating the logical graph includes clustering a plurality of Kubernetes namespaces based on launching behaviors of the Kubernetes namespaces. ### Claim 5 (depends on 1) The system of claim 1 wherein generating the logical graph includes clustering a plurality of pods based at least in part on launching behaviors of the pods. ### Claim 6 (depends on 1) The system of claim 1 wherein generating the logical graph includes clustering a plurality of pods based at least in part on which namespaces launch the pods. ### Claim 7 (depends on 1) The system of claim 1 wherein the log data comprises one or more tags associated with the containerized environment. ### Claim 8 (depends on 1) The system of claim 1 wherein the processor is configured to detect the anomaly at least in part by generating a baseline for a Kubernetes cluster. ### Claim 9 (depends on 1) The system of claim 1 wherein the processor is further configured to determine a pod type for a pod. ### Claim 10 (depends on 1) The system of claim 1 wherein using the generated graph to detect the anomaly includes detecting a new edge in the logical graph. ### Claim 11 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new application or container has been launched in a datacenter. ### Claim 12 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new application or container has been launched in a Kubernetes cluster. ### Claim 13 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new application or container has been launched in a Kubernetes namespace. ### Claim 14 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new application or container has been launched in a pod. ### Claim 15 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new pod has been launched in the datacenter. ### Claim 16 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new namespace has been created in the datacenter. ### Claim 17 (depends on 1) The system of claim 1 wherein detecting the anomaly includes detecting that a new Kubernetes cluster has been created in the datacenter. ### Claim 18 A method, comprising: receiving log data associated with a containerized environment; generating a logical graph using at least a portion of the received log data, wherein the generated logical graph comprises a Kubernetes launch graph that models launching behaviors of components in a containerized environment and wherein the generated logical graph comprises a set of edges including at least one edge that connects a first node to a second node; using the logical graph to detect an anomaly, at least in part by determining that a change has been made to the set of edges, and wherein the change made to the set of edges is at least one of: (1) an addition of an edge to the set, and (2) a modification to an edge that is already present in the set, and in response to detecting the anomaly, generating an alert. ### Claim 19 A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for: receiving log data associated with a containerized environment; generating a logical graph using at least a portion of the received log data, wherein the generated logical graph comprises a Kubernetes launch graph that models launching behaviors of components in a containerized environment and wherein the generated logical graph comprises a set of edges including at least one edge that connects a first node to a second node; using the logical graph to detect an anomaly, at least in part by determining that a change has been made to the set of edges, and wherein the change made to the set of edges is at least one of: (1) an addition of an edge to the set, and (2) a modification to an edge that is already present in the set, and in response to detecting the anomaly, generating an alert. ### Claim 20 (depends on 18) The method of claim 18 wherein the containerized network environment is a hybridized environment and wherein the Kubernetes launch graph includes nodes corresponding to non-containerized processes. ### Claim 21 (depends on 20) The method of claim 20 wherein operating system information associated with the non-containerized processes is used to define an artificial containerization overlay for the non-containerized processes. ### Claim 22 (depends on 18) The method of claim 18 wherein generating the logical graph includes clustering a plurality of Kubernetes namespaces based on launching behaviors of the Kubernetes namespaces. ### Claim 23 (depends on 18) The method of claim 18 wherein generating the logical graph includes clustering a plurality of pods based at least in part on launching behaviors of the pods. ### Claim 24 (depends on 18) The method of claim 18 wherein generating the logical graph includes clustering a plurality of pods based at least in part on which namespaces launch the pods. ### Claim 25 (depends on 18) The method of claim 18 wherein the log data comprises one or more tags associated with the containerized environment. ### Claim 26 (depends on 18) The method of claim 18 wherein detecting the anomaly includes generating a baseline for a Kubernetes cluster. ### Claim 27 (depends on 18) The method of claim 18 further comprising determining a pod type for a pod. ### Claim 28 (depends on 18) The method of claim 18 wherein using the generated graph to detect the anomaly includes detecting a new edge in the logical graph. ### Claim 29 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new application or container has been launched in a datacenter. ### Claim 30 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new application or container has been launched in a Kubernetes cluster. ### Claim 31 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new application or container has been launched in a Kubernetes namespace. ### Claim 32 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new application or container has been launched in a pod. ### Claim 33 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new pod has been launched in the datacenter. ### Claim 34 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new namespace has been created in the datacenter. ### Claim 35 (depends on 18) The method of claim 18 wherein detecting the anomaly includes detecting that a new Kubernetes cluster has been created in the datacenter.