# US 12,598,204 B2 · Federated abnormal process detection for kubernetes clusters

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,598,204 B2
- Document ID: US12598204B2
- Status: Granted
- Kind: B2
- Application number: 18/401,589
- Filed: 2023-12-31
- Published: 2025-07-03
- Granted: 2026-04-07
- Earliest claimed: 2023-12-31
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Philip Derbeko; Omer Medan
- Web page: https://patentgrep.com/patent/US12598204B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A baseline of behavior is received for a set of containers utilized by the Kubernetes manager from a cluster agent. The processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline. Subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, anomalous data is sent to the cluster agent including an identification and version of the specific container and a description of abnormal behavior. The cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected.

## Claims

### Claim 1

A computer-implemented method in a Kubernetes node agent on a data communication network, for federated abnormal process detection in Kubernetes clusters, the method comprising:
requesting a baseline of behavior for a set of containers utilized by a Kubernetes manager server from a cluster agent;
monitoring processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline;
configuring container updates received from the Kubernetes manager server that registers containers for distribution to a plurality Kubernetes clusters concerning a new version of the set of containers;
subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, sending anomalous data to the cluster agent including an identification and version of the specific container and a description of the abnormal behavior, wherein the cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected;
receiving the new rule and implementing the new rule with respect to the container updates while running processes; and
taking action based on analysis.

### Claim 2 (depends on 1)

The method of claim 1, further comprising detecting abnormal behavior for a new version of the specific container relative to a previous version of the specific container.

### Claim 3 (depends on 1)

The method of claim 1, wherein the new rule from the cluster agent indicates that abnormal behavior is acceptable for the new version of the specific container.

### Claim 4 (depends on 1)

The method of claim 1, wherein the step of taking the action comprises temporary blocking execution of the new version of the container.

### Claim 5 (depends on 1)

The method of claim 1, wherein a second new rule issued from the cluster agent indicates that the abnormal behavior that was not acceptable is now acceptable, due to surpassing a threshold aggregate count of successful executions from the plurality of nodes.

### Claim 6 (depends on 1)

The method of claim 1, wherein the Kubernetes server notifies the cluster agent of version updates for containers.

### Claim 7

A non-transitory computer-readable medium in a Kubernetes node agent on a data communication network, for federated abnormal process detection in Kubernetes clusters, the method comprising:
requesting a baseline of behavior for a set of containers utilized by a Kubernetes manager server from a cluster agent;
monitoring processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline;
configuring container updates received from the Kubernetes manager server that registers containers for distribution to a plurality Kubernetes managers concerning a new version of the set of containers;
subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, sending anomalous data to the cluster agent including an identification and version of the specific container and a description of abnormal behavior, wherein the cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected;
receiving the new rule and implementing the new rule with respect to the container updates while running processes; and
taking action based on analysis.

### Claim 8

A Kubernetes node agent on a data communication network, for federated abnormal process detection in Kubernetes clusters, the Kubernetes node agent comprising:
a processor;
a network interface communicatively coupled to the processor and to a data communication network; and
a memory, communicatively coupled to the processor and storing:
a baseline module to receive a baseline of behavior for a set of containers utilized by a Kubernetes manager server from a cluster agent;
monitoring processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline;
configuring container updates received from the Kubernetes manager server that that registers containers for distribution to a plurality Kubernetes managers concerning a new version of the set of containers;
subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, sending anomalous data to the cluster agent including an identification and version of the specific container and a description of abnormal behavior, wherein the cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected;
receiving the new rule and implementing the new rule with respect to the container updates while running processes; and
taking action based on analysis.