Back to results
US 12,596,627 B2Granted
Agentless system and method for discovering and inspecting applications and services in compute environments
AssigneeCrowdStrike, Inc.
InventorsSaar Mano, Amir Sidis, Eyal Mamo
Life of this patent
Estimating the term…
Abstract
A system method for application discovery in a computing environment utilize static analysis. The method includes receiving data of an application, the application deployed on a workload in a first computing environment; detecting a plurality of anchor points in the data; and generating an application graph, including a plurality of first nodes, based on the plurality of anchor points, wherein each anchor point corresponds to a first node, and wherein at least a first node of the plurality of nodes is connected to at least another node of the plurality of nodes.
Claims20
A method, comprising:
- installing a collector computer code in a workload;
- receiving, from the collector computer code, data of an application that is deployed on the workload in a first computing environment;
- detecting a plurality of code objects in the data of the application;
- determining that a first set of code objects in the plurality of code objects corresponds to anchor points of the application, the anchor points are functions indicating how the application communicates with one or more resources;
- determining a second set of code objects of the plurality of code objects that have a direct relationship with the first set of code objects corresponding to anchor points;
- generating, by processing circuitry, an application graph, including a plurality of first nodes, based on the first set of code objects corresponding to the anchor points, a plurality of second nodes based on the second subset of code objects, and a plurality of third nodes based on the second subset of code objects, wherein an initial second node of the plurality of first second nodes is exclusively connected to an initial first node of the plurality of first nodes that and is upstream relative to the second initial first node, and an initial third node of the plurality of third nodes is exclusively connected to the initial second node of the plurality of second nodes and is upstream relative to the initial second node, the application graph comprising a first portion of executable code associated with a first function and a second portion of executable code associated with a second function;
- determining that the first portion of executable code in the application graph executes to perform the first function when traversing the application graph, wherein the first portion corresponds to the first initial second node;
- determining that the second portion of the executable code in the application graph does not execute to perform the second function when traversing the application graph from the first node to the second node, wherein the second portion corresponds to the second initial third node;
- in response to determining that the second portion of the executable code in the application graph does not execute to perform the second function, reducing an amount of computing resources to traverse the application graph by removing the second portion of the executable code from the application graph;
- and
- traversing the application graph using the amount of computing resource responsive to removing the second portion of the executable code from the application graph.
8 more elements
A non-transitory computer readable medium storing instructions that, when executed by a processing device, cause the processing circuitry to:
- install a collector computer code in a workload;
- receive, from the collector computer code, data of an application that is deployed on the workload in a first computing environment;
- detect a plurality of anchor points in the data of the application;
- determine that a first set of code objects in the plurality of code objects corresponds to anchor points of the application, the anchor points are functions indicating how the application communicates with one or more resources;
- determine a second set of code objects of the plurality of code objects that have a direct relationship with the first set of code objects corresponding to anchor points;
- generate, by the processing circuitry, an application graph, including a plurality of first nodes, based on the first set of code objects corresponding to the anchor points, a plurality of second nodes based on the second subset of code objects, and a plurality of third nodes based on the second subset of code objects, wherein an initial second node of the plurality of first second nodes is connected to an initial first node of the plurality of first nodes that and is upstream relative to the second initial first node, and an initial third node of the plurality of third nodes is exclusively connected to the initial second node of the plurality of second nodes and is upstream relative to the initial second node, the application graph comprising a first portion of executable code associated with a first function and a second portion of executable code associated with a second function;
- determine that the first portion of executable code in the application graph executes to perform the first function when traversing the application graph, wherein first portion corresponds to the first initial second node;
- determine that the second portion of the executable code in the application graph does not execute to perform the second function when traversing the application graph from the first node to the second node, wherein the second portion corresponds to the second initial third node;
- in response to determining that the second portion of the executable code in the application graph does not execute to perform the second function, reducing an amount of computing resources to traverse the application graph by removing the second portion of the executable code from the application graph;
- and
- traverse the application graph using the amount of computing resource responsive to removing the second portion of the executable code from the application graph.
8 more elements
A system, comprising:
- a memory;
- and
- a processing circuitry that is operatively coupled to the memory, to:
- install a collector computer code in a workload;
- receive, from the collector computer code, data of an application that is deployed on the workload in a first computing environment;
- detect a plurality of anchor points in the data of the application;
- determine that a first set of code objects in the plurality of code objects corresponds to anchor points of the application, the anchor points indicating how the application communicates with one or more resources;
- determine a second set of code objects of the plurality of code objects that have a direct relationship with the first set of code objects corresponding to anchor points;
- generate an application graph, including a plurality of first nodes, based on the first set of code objects corresponding to the anchor points, a plurality of second nodes based on the second subset of code objects, and a plurality of third nodes based on the second subset of code objects, wherein an initial second node of the plurality of first second nodes is connected to an initial first node of the plurality of first nodes that and is upstream relative to the second initial first node, and an initial third node of the plurality of third nodes is exclusively connected to the initial second node of the plurality of second nodes and is upstream relative to the initial second node, the application graph comprising a first portion of executable code associated with a first function and a second portion of executable code associated with a second function;
- determine that the first portion of executable code in the application graph executes to perform the first function when traversing the application graph, wherein the first portion corresponds to the first initial second node;
- determine that the second portion of the executable code in the application graph does not execute to perform the second function when traversing the application graph from the first node to the second node, wherein the second portion corresponds to the second initial third node;
- in response to determining that the second portion of the executable code in the application graph does not execute to perform the second function, reduce an amount of computing resources to process the application graph by removing the second portion of the executable code from the application graph;
- and
- traverse the application graph using the amount of computing resource responsive to removing the second portion of the executable code from the application graph.
11 more elements
Dependencies are inferred from the claim text.