Detecting microservice security attacks based on metric sensitive dependencies
AssigneeHewlett Packard Enterprise Development LP
InventorsThomas Golway, Nigel J. Edwards, Shiva R. Dasari
Life of this patent
Estimating the term…
Abstract
A process includes aggregating a time sequence of samples. Each sample has a plurality of dimensions that correspond to respective metrics that are associated with a microservice. Each sample includes, for each dimension, a measurement of the metric that corresponds to the dimension. The process includes identifying a given sample of the time sequence of samples based on measurements of first samples of the time sequence of samples and determining a sensitivity dependency of the metrics based on the measurements of the given sample. The process includes determining whether the microservice has been subjected to a security attack based on the sensitive dependency.
Claims12
A non-transitory machine-readable storage medium that stores machine-readable instructions that, when executed by a hardware processor, cause a peripheral of a computer platform to:
- detect whether a microservice executing on a host of the computer platform has been subjected to a security attack based on an analysis of metric data associated with the microservice, wherein detecting the security attack comprises the peripheral:
- accessing, by a service mesh, measurements of metrics associated with the microservice, wherein the metrics are associated with respective dimensions of a plurality of dimensions;
- time sampling the measurements to provide a time sequence of samples, wherein each sample of the time sequence of samples has the plurality of dimensions, and each sample of the time sequence of samples comprises, for each dimension of the plurality of dimensions, a measurement of the metric that corresponds to the dimension;
- determining statistics of the measurements of first samples of the time sequence of samples;
- based on the statistics, determining that a given sample of the time sequence of samples corresponds to a microburst event;
- determining coefficients of variation for respective measurements of the given sample;
- determining a sensitive dependency based on a range of the coefficients of variation;
- determining that the microservice has been subjected to the security attack based on the sensitive dependency;
- and
- initiate a responsive action responsive to determining that the microservice has been subjected to the security attack.
A computer platform comprising:
- a host processor to execute instructions associated with an application operating environment, and execute instructions to provide a microservice associated with the application operating environment;
- and
- a smart input/output (I/O) peripheral to provide an I/O service and detect whether the microservice has been subjected to a security attack based on an analysis of metric data associated with the microservice, wherein the smart I/O peripheral comprises:
- a service mesh interface to access measurements of metrics associated with the microservice, wherein the metrics are associated with respective dimensions of a plurality of dimensions;
- and
- an observation engine to:
- aggregate a time series of measurement vectors, wherein each measurement vector of the time series of measurement vectors has the plurality of dimensions, and each measurement vector of the time sequence of vectors comprises, for each dimension of the plurality of dimensions, a measurement of the associated metric corresponding to the dimension;
- identify a given measurement vector of the time series of measurement vectors based on statistics derived from other measurement vectors of the time series of measurement vectors;
- determine coefficients of variation of the measurements of the given measurement vector;
- determine a sensitive dependency among the metrics based on the coefficients of variation;
- and
- detect the security attack based on the sensitive dependency.
Dependencies are inferred from the claim text.