Alerting unusual activities in an enterprise production environment

A system for alerting an individual to unusual activities in an enterprise production environment executing a plurality of instances of an application, the system comprising:

• a microprocessor, and a memory coupled to the microprocessor, that together provide:
• a natural language processor configured for identifying a sequence of microservices accessed by each of the plurality of instances of the application, using natural language processing;
• a classifier configured for classifying the sequence of microservices into a sequence of activities;
• a feature vector generator configured for generating feature vectors for each activity in the sequence of activities;
• a graph processor configured for creating from the feature vectors a directed graph having nodes and directed edges, each node of the directed graph representing a microservice and each directed edge of the directed graph representing a transition between microservices during an activity;
• an instance activity database configured for storing heuristic data records pertaining to the instances;
• and
• an unusual activity detector configured for:
• overlaying, on the directed graph, activities executed by a given instance to determine whether the given instance is suspicious, wherein the given instance is determined to be suspicious when both (a) the activities executed by the given instance include a microservice or transition absent from the directed graph, and (b) the microservice or transition is not described in a policy file for the application, and
• adding, to the directed graph, a node representing the microservice or an edge representing the transition when the given instance was not determined to be suspicious, and
• updating the stored heuristic data record for the given instance in the instance activity database accordingly, and
• alerting the individual when the given instance remains suspicious for a given duration of time, as determined from the stored heuristic data record.