Identifying applications with machine learning

A computing system comprising:

• a database disposed within a computational instance of a remote network management platform, wherein the database is stored on a memory, wherein the computational instance is associated with a managed network, and wherein the managed network comprises software applications installed on computing devices;
• and
• a discovery application configured to:
• initiate discovery of the software applications within the managed network by probing the computing devices for applications configured to execute thereon;
• execute one or more predetermined discovery patterns in an attempt to classify a discovered application of the software applications, wherein the discovered application is a web container executing on a server device within the managed network, wherein the web container is configured to execute therein web applications each configured to provide dynamic web content by way of a corresponding servlet;
• determine that the discovered application is unclassified after executing the one or more predetermined discovery patterns;
• in response to determining that the discovered application is unclassified, (i) generate a configuration item representing the discovered application without classification and (ii) select, from within a directory corresponding to the discovered application, a characteristic file containing attributes of the discovered application, wherein the characteristic file comprises a plurality of application files corresponding to the web applications;
• provide the characteristic file to a machine learning (ML) classifier, wherein the ML classifier has been trained using a plurality of characteristic files corresponding to different software applications to classify the different software applications among a plurality of predetermined categories, wherein the ML classifier is configured to classify the web container based on the plurality of application files;
• receive, from the ML classifier, a classification of the discovered application;
• modify the configuration item to include the classification of the discovered application;
• and
• store, in the database, the configuration item as modified.

A method comprising:

• initiating, by a computing system associated with a remote network management platform that is associated with a managed network, discovery of software applications within the managed network by probing computing devices within the managed network for applications installed thereon;
• executing, by the computing system, one or more predetermined discovery patterns in an attempt to classify a discovered application of the software applications;
• determining, by the computing system, that the discovered application is unclassified after executing the one or more predetermined discovery patterns;
• in response to determining that the discovered application is unclassified, (i) generating, by the computing system, a configuration item representing the discovered application without classification and (ii) selecting, by the computing system and from within a directory corresponding to the discovered application, a characteristic file containing attributes of the discovered application;
• determining, by the computing system, a command used to invoke execution of the discovered application based on one or more executing software processes corresponding to the discovered application;
• providing, by the computing system, the characteristic file and the command to a machine learning (ML) classifier, wherein the ML classifier has been trained using:
• a plurality of characteristic files corresponding to different software applications to classify software applications among a plurality of predetermined categories;
• and
• a plurality of commands used to invoke execution of the different software applications to classify the different software applications among the plurality of predetermined categories;
• receiving, by the computing system and from the ML classifier, a classification of the discovered application, wherein the classification is based on the characteristic file and the command;
• modifying, by the computing system, the configuration item to include the classification of the discovered application;
• and
• storing, in a database disposed within the remote network management platform, the configuration item as modified.

An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:

• initiating discovery of software applications within a managed network that is associated with a remote network management platform by probing computing devices within the managed network for applications installed thereon;
• executing one or more predetermined discovery patterns in an attempt to classify a discovered application of the software applications;
• determining that the discovered application is unclassified after executing the one or more predetermined discovery patterns;
• in response to determining that the discovered application is unclassified, (i) generating a configuration item representing the discovered application without classification and (ii) selecting, from within a directory corresponding to the discovered application, a characteristic file containing attributes of the discovered application;
• determining a command used to invoke execution of the discovered application based on one or more executing software processes corresponding to the discovered application;
• providing the characteristic file and the command to a machine learning (ML) classifier, wherein the ML classifier has been trained using:
• a plurality of characteristic files corresponding to different software applications to classify software applications among a plurality of predetermined categories;
• and
• a plurality of commands used to invoke execution of the different software applications to classify the different software applications among the plurality of predetermined categories;
• receiving, from the ML classifier, a classification of the discovered application, wherein the classification is based on the characteristic file and the command;
• modifying the configuration item to include the classification of the discovered application;
• and
• storing, in a database disposed within the remote network management platform, the configuration item as modified.