Back to results
US 12,693,922 B2Granted
Tracking virtual processes to identify anomalies
AssigneeMicro Focus LLC
InventorsDouglas Max Grover, Michael F Angelo
Life of this patent
Estimating the term…
Abstract
A virtualization pattern is learned. The learned virtualization pattern comprises information associated with one or more virtualized processes. For example, the virtualization pattern may comprise the creation of a first micro service and the spawning of a second micro service from the first micro service. The learned virtualization pattern is compared to a current virtualization pattern to identify an anomalous virtualization pattern in the current virtualization pattern. In response to identifying the anomalous virtualization pattern in the current virtualization pattern, an action is taken. For example, the action taken may be to quarantine a virtual process, to unload the virtual process, to quarantine a tenant partition, and/or the like.
Claims20
A system comprising:
- a microprocessor;
- and
- a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to:
- monitor temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of virtualized resources, the plurality of virtualized resources being shared by tenant partitions of the plurality of tenants;
- based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learn tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
- compare each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns;
- and
- in response to identifying the anomalous virtualization pattern, take an action.
5 more elements
A method comprising:
- monitoring temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of resources and the plurality of virtualized resources shared by tenant partitions of the plurality of tenants;
- based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learning, by a microprocessor, a tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
- comparing, by the microprocessor, each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns;
- and
- in response to identifying the anomalous virtualization pattern, selecting, by the microprocessor, an action for implementation.
2 more elements
A non-transient computer readable medium having stored thereon instructions that cause a processor to execute a method, the method comprising instructions to:
- monitor temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of virtualized resources, the plurality of virtualized resources being shared by tenant partitions of the plurality of tenants;
- based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learn tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
- compare each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns, wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource impacting an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources;
- and
- in response to identifying the anomalous virtualization pattern in the current tenant and cloud virtualization patterns, select an action for implementation.
2 more elements
Dependencies are inferred from the claim text.