# US 12,112,209 B2 · Application anomaly detection using trained infrastructure machine learning models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,112,209 B2 - Document ID: US12112209B2 - Status: Granted - Kind: B2 - Application number: 17/525,863 - Filed: 2021-11-13 - Published: 2022-05-19 - Granted: 2024-10-08 - Earliest claimed: 2020-11-13 - Assignees: Montycloud Inc - Applicants: Montycloud Inc - Inventors: Kannan Parthasarathy; Venkatanathan Krishnamachari - Web page: https://patentgrep.com/patent/US12112209B2 ## CPC - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 9/5055: {considering software capabilities, i.e. software resources associated or available to the machine} - G06F 9/505: {considering the load} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 18/24147: {Distances to closest patterns, e.g. nearest neighbour classification} - G06F 18/24323: {Tree-organised classifiers} - G06N 20/00: Machine learning - G06F 2201/83: the solution involving signatures - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system and method for facilitating management of application infrastructure for plurality of users is disclosed. The method includes identifying a set of infrastructure components corresponding to an application and determining configuration information associated with the application based on the set of infrastructure components. The method further includes identifying a plurality of patterns of the application based on the configuration information of the set of infrastructure components and generating one or more application fingerprints corresponding to the application based on the plurality of patterns. Further, the method includes determining one or more anomalies in the application based on the one or more application fingerprints and generating one or more recommendations for resolving the one or more anomalies based on the one or more application fingerprints and prestored information. Furthermore, the method includes outputting the one or more anomalies and the one or more recommendations to one or more user devices. ## Claims ### Claim 1 A computing system for facilitating management of application infrastructure for plurality of users, the computing system comprising: one or more virtualized hardware processors; and a memory coupled to the one or more virtualized hardware processors, wherein the memory comprises a plurality of modules in the form of programmable instructions executable by the one or more virtualized hardware processors, wherein the plurality of modules comprises: an infrastructure identification module configured to identify a set of infrastructure components corresponding to an application hosted on an application server; a configuration determination module configured to determine configuration information associated with the application based on the identified set of infrastructure components; a pattern identification module configured to identify a plurality of patterns of the application using a dimensionality reduction technique, based on the determined configuration information of the set of infrastructure components; a fingerprint generation module configured to generate one or more application fingerprints corresponding to the application based on the identified plurality of patterns; a model generation module configured to generate a trained infrastructure management based Machine Learning (ML) model, wherein in generating the trained infrastructure management based ML model, the model generation module is configured to: capture behavioral information associated with the application; classify the captured behavioral information into at least one of one or more reactions and one or more observations based on one or more events, wherein the one or more events comprise: patch, task execution, scaling pattern and at least one of: user initiated, environmental and observed lifecycle changes of the set of infrastructure components; correlate the one or more application fingerprints with the classified behavioral information; and generate the trained infrastructure management based ML model based on result of correlation; an anomaly determination module configured to determine one or more anomalies in the application based on the generated one or more application fingerprints by using the trained infrastructure management based ML model; a recommendation generation module configured to generate one or more recommendations for resolving the determined one or more anomalies in the application based on the generated one or more application fingerprints and prestored information by using the trained infrastructure management based ML model; and a data output module configured to output the determined one or more anomalies and the generated one or more recommendations to one or more user devices associated with a plurality of users for managing application infrastructure. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the configuration information comprises: a blueprint configuration, custom application configurations, infrastructure as code data, one or more services used by the plurality of users and one or more activities performed by the plurality of users during workload. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the behavioral information comprises: response to patches, change deployment, performance under load, response latency and correlation of the response latency with server CPU load. ### Claim 4 (depends on 1) The computing system of claim 1, wherein the plurality of patterns comprise: unique machine readable meta data structure representing the set of infrastructure components, inter-dependencies between the set of infrastructure components, one or more layers, cloud services and uniqueness of each application as captured as an expressible structure. ### Claim 5 (depends on 1) The computing system of claim 1, wherein in generating the one or more application fingerprints corresponding to the application based on the identified plurality of patterns, the fingerprint generation module is configured to: abstract the identified plurality of patterns; and generate the one or more application fingerprints based on the abstracted plurality of patterns. ### Claim 6 (depends on 1) The computing system of claim 1, wherein in identifying the plurality of patterns of the application based on the determined configuration information of the set of infrastructure components, the pattern identification module is configured to: classify the set of infrastructure components based on prestored infrastructure information; and identify the plurality of patterns of the application based on the determined configuration information and the classified set of infrastructure components. ### Claim 7 (depends on 1) The computing system of claim 1, wherein in determining the one or more anomalies in the application based on the generated one or more application fingerprints by using the trained infrastructure management based ML model, the anomaly determination module is configured to: capture the behavioral information associated with the application; detect whether there is a change in the behavioral information associated with the application by monitoring the configuration information; and determine the one or more anomalies in the application based on the detected change and the generated one or more application fingerprints by using the trained infrastructure management based ML model. ### Claim 8 (depends on 1) The computing system of claim 1, wherein the data output module is further configured to: detect a set of user devices connected to a network associated with the one or more user devices and running one or more applications similar to the application; and broadcast the generated one or more recommendations to each of the detected set of user devices. ### Claim 9 (depends on 1) The computing system of claim 1, wherein in generating the one or more recommendations for resolving the detected one or more anomalies in the application based on the generated one or more application fingerprints and the prestored information by using the trained infrastructure management based ML model, the recommendation generation module is further configured to: collect one or more user feedbacks corresponding to the determined one or more anomalies from the one or more user devices; and generate the one or more recommendations for resolving the detected one or more anomalies in the application based on the generated one or more application fingerprints, the prestored information and the collected one or more user feedbacks by using the trained infrastructure management based ML model. ### Claim 10 A method for facilitating management of application infrastructure for plurality of users, the method comprising: identifying, by one or more virtualized hardware processors, a set of infrastructure components corresponding to an application hosted on an application server; determining, by the one or more virtualized hardware processors, configuration information associated with the application based on the identified set of infrastructure components; identifying, by the one or more virtualized hardware processors, a plurality of patterns of the application using a dimensionality reduction technique, based on the determined configuration information of the set of infrastructure components; generating, by the one or more virtualized hardware processors, one or more application fingerprints corresponding to the application based on the identified plurality of patterns; generating, by the one or more virtualized hardware processors, a trained infrastructure management based Machine Learning (ML) model, wherein generating the trained infrastructure management based ML model comprises: capturing behavioral information associated with the application; classifying the captured behavioral information into at least one of one or more reactions and one or more observations based on one or more events, wherein the one or more events comprise: patch, task execution, scaling pattern and at least one of: user initiated, environmental and observed lifecycle changes of the set of infrastructure components; correlating the one or more application fingerprints with the classified behavioral information; and generating the trained infrastructure management based ML model based on result of correlation; determining, by the one or more virtualized hardware processors, one or more anomalies in the application based on the generated one or more application fingerprints by using the trained infrastructure management based ML model; generating, by the one or more virtualized hardware processors, one or more recommendations for resolving the determined one or more anomalies in the application based on the generated one or more application fingerprints and prestored information by using the trained infrastructure management based ML model; and outputting, by the one or more virtualized hardware processors, the determined one or more anomalies and the generated one or more recommendations to one or more user devices associated with a plurality of users for managing application infrastructure. ### Claim 11 (depends on 10) The method of claim 10, wherein the configuration information comprises: a blueprint configuration, custom application configurations, infrastructure as code data, one or more services used by the plurality of users and one or more activities performed by the plurality of users during workload. ### Claim 12 (depends on 10) The method of claim 10, wherein the behavioral information comprises: response to patches, change deployment, performance under load, response latency and correlation of the response latency with server CPU load. ### Claim 13 (depends on 10) The method of claim 10, wherein the plurality of patterns comprise: unique machine readable meta data structure representing the set of infrastructure components, inter-dependencies between the set of infrastructure components, one or more layers, cloud services and uniqueness of each application as captured as an expressible structure. ### Claim 14 (depends on 10) The method of claim 10, wherein generating the one or more application fingerprints corresponding to the application based on the identified plurality of patterns comprises: abstracting the identified plurality of patterns; and generating the one or more application fingerprints based on the abstracted plurality of patterns. ### Claim 15 (depends on 10) The method of claim 10, wherein identifying the plurality of patterns of the application based on the determined configuration information of the set of infrastructure components comprises: classifying the set of infrastructure components based on prestored infrastructure information; and identifying the plurality of patterns of the application based on the determined configuration information and the classified set of infrastructure components. ### Claim 16 (depends on 10) The method of claim 10, wherein determining the one or more anomalies in the application based on the generated one or more application fingerprints by using the trained infrastructure management based ML model comprises: capturing the behavioral information associated with the application; detecting whether there is a change in the behavioral information associated with the application by monitoring the configuration information; and determining the one or more anomalies in the application based on the detected change and the generated one or more application fingerprints by using the trained infrastructure management based ML model. ### Claim 17 (depends on 10) The method of claim 10, further comprises: detecting a set of user devices connected to a network associated with the one or more user devices and running one or more applications similar to the application; and broadcasting the generated one or more recommendations to each of the detected set of user devices. ### Claim 18 (depends on 10) The method of claim 10, wherein generating the one or more recommendations for resolving the detected one or more anomalies in the application based on the generated one or more application fingerprints and the prestored information by using the trained infrastructure management based ML model comprises: collecting one or more user feedbacks corresponding to the determined one or more anomalies from the one or more user devices; and generating the one or more recommendations for resolving the detected one or more anomalies in the application based on the generated one or more application fingerprints, the prestored information and the collected one or more user feedbacks by using the trained infrastructure management based ML model.