# US 12,008,392 B2 · Application component identification and analysis in a virtualized computing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,392 B2 - Document ID: US12008392B2 - Status: Granted - Kind: B2 - Application number: 17/383,603 - Filed: 2021-07-23 - Published: 2023-01-26 - Granted: 2024-06-11 - Earliest claimed: 2021-07-23 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Padmaja Vrudhula; Timothy Michael Jones; Matthew David Conger-Eldeen; Nicholas Seemiller - Web page: https://patentgrep.com/patent/US12008392B2 ## CPC - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/45545: {Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example method of application identification in a virtualized computing system having a cluster of hosts, the hosts including virtualization layers supporting virtual machines (VMs), is described. The method includes: executing, by application analysis software, process discovery agents for the VMs; receiving, at the application analysis software from the process discovery agents, process metadata describing processes executing on the VMs; generating signatures for the processes based on the process metadata; and determining components of an application based on the signatures. ## Claims ### Claim 1 A method of application identification in a virtualized computing system having a cluster of hosts, the hosts including virtualization layers supporting virtual machines (VMs), the method comprising: executing, by application analysis software, process discovery agents for the VMs, the process discovery agents installed in the VMs by the application analysis software; receiving, at the application analysis software from the process discovery agents, process metadata describing processes executing on the VMs, the process discovery agents obtaining the process metadata by reading process data structures maintained by guest operating systems of the VMs; generating signatures for the processes based on the process metadata; and determining components of an application based on a comparison of the signatures against known signatures in a signature database. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining, in cooperation with a network analyzer executing in the virtualized computing system, a topology of the components of the application. ### Claim 3 (depends on 1) The method of claim 1, wherein the process discovery agents are configured to obtain the process metadata from process data structures maintained by guest operating systems of the VMs. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the signatures comprises at least one regular expression for a respective one of the processes derived from the process metadata. ### Claim 5 (depends on 1) The method of claim 1, wherein the step of determining the components comprises: identifying each component from a match between a respective signature and a respective known signature. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining first network connections among the components; and determining second network connections between at least one of the components and at least one external service. ### Claim 7 (depends on 1) The method of claim 1, further comprising: persisting the process metadata and information describing the application and the components in a database. ### Claim 8 A non-transitory computer readable medium comprising instructions to be executed in a computing device to cause the computing device to carry out a method of application identification in a virtualized computing system having a cluster of hosts, the hosts including virtualization layers supporting virtual machines (VMs), the method comprising: executing, by application analysis software, process discovery agents for the VMs, the process discovery agents installed in the VMs by the application analysis software; receiving, at the application analysis software from the process discovery agents, process metadata describing processes executing on the VMs, the process discovery agents obtaining the process metadata by reading process data structures maintained by guest operating systems of the VMs; generating signatures for the processes based on the process metadata; and determining components of an application based on a comparison of the signatures against known signatures in a signature database. ### Claim 9 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: determining, in cooperation with a network analyzer executing in the virtualized computing system, a topology of the components of the application. ### Claim 10 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the process discovery agents are configured to obtain the process metadata from process data structures maintained by guest operating systems of the VMs. ### Claim 11 (depends on 8) The non-transitory computer readable medium of claim 8, wherein each of the signatures comprises at least one regular expression for a respective one of the processes derived from the process metadata. ### Claim 12 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the step of determining the components comprises: identifying each component from a match between a respective signature and a respective known signature. ### Claim 13 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: determining first network connections among the components; and determining second network connections between at least one of the components and at least one external service. ### Claim 14 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: persisting the process metadata and information describing the application and the components in a database. ### Claim 15 A virtualized computing system having a cluster comprising hosts connected to a network, the hosts including virtualization layers, the virtualized computing system comprising: virtual machines (VMs) executing on the virtualization layers; and a server configured to execute application analysis software, the application analysis software configured to: execute process discovery agents for the VMs, the process discovery agents installed in the VMs by the application analysis software; receive, from the process discovery agents, process metadata describing processes executing on the VMs, the process discovery agents obtaining the process metadata by reading process data structures maintained by guest operating systems of the VMs; generate signatures for the processes based on the process metadata; and determine components of an application based on a comparison of the signatures against known signatures in a signature database. ### Claim 16 (depends on 15) The virtualized computing system of claim 15, wherein the application analysis software is further configured to: determine, in cooperation with a network analyzer executing in the virtualized computing system, a topology of the components of the application. ### Claim 17 (depends on 15) The virtualized computing system of claim 15, wherein the process discovery agents are configured to obtain the process metadata from process data structures maintained by guest operating systems of the VMs. ### Claim 18 (depends on 15) The virtualized computing system of claim 15, wherein each of the signatures comprises at least one regular expression for a respective one of the processes derived from the process metadata. ### Claim 19 (depends on 15) The virtualized computing system of claim 15, wherein the application analysis software is configured to determine the components by: identifying each component from a match between a respective signature and a respective known signature. ### Claim 20 (depends on 15) The virtualized computing system of claim 15, wherein the application analysis software is configured to: determining first network connections among the components; and determining second network connections between at least one of the components and at least one external service.