# US 2016/0366142 A1 · Data socket descriptor attributes for application discovery in data centers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366142 A1 - Document ID: US20160366142A1 - Status: Published application - Kind: A1 - Application number: 15/182,544 - Filed: 2016-06-14 - Published: 2016-12-15 - Earliest claimed: 2015-06-14 - Assignees: Avocado Systems Inc. - Applicants: Avocado Systems Inc. - Inventors: Keshav Govind Kamble - Web page: https://patentgrep.com/patent/US20160366142A1 ## CPC - H04L 63/101: {Access control lists [ACL]} - G06F 16/2255: {Hash tables} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to collect all data socket descriptor databases from individual servers operating in a data center, each data socket descriptor database storing attributes of a base socket and one or more data socket descriptors used by an application or application instance operating on an individual server. The logic is also configured to cause the processing circuit to store data from the data socket descriptor databases for all applications and application instances operating in the data center in a central data socket descriptor database, the central data socket descriptor database being configured to store attributes of all data socket descriptors used by all applications or application instances operating in the data center. ## Claims ### Claim 1 A system, comprising: a processing circuit and logic integrated with and/or executable by the processing circuit, the logic being configured to cause the processing circuit to: collect all data socket descriptor databases from individual servers operating in a data center, each data socket descriptor database storing attributes of a base socket and one or more data socket descriptors used by an application or application instance operating on an individual server; and store data from the data socket descriptor databases for all applications and application instances operating in the data center in a central data socket descriptor database, the central data socket descriptor database being configured to store attributes of all data socket descriptors used by all applications or application instances operating in the data center. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the logic further causes the processing circuit to: discover a new application or application instance operating in the data center based on collection of attributes of at least one data socket descriptor used by the new application; collect one or more hash scans of the new application or application instance operating in the data center; and generate an application signature for each new application or application instance operating in the data center using the one or more hash scans. ### Claim 3 (depends on 2) The system as recited in claim 2, wherein the logic further causes the processing circuit to: determine whether the new application or application instance discovered operating in the data center is permissible; and cause the new application or application instance to close based on a determination that the new application or application instance is not permissible. ### Claim 4 (depends on 3) The system as recited in claim 3, wherein the determination that the new application or application instance is not permissible is based on at least one decision selected from a group comprising: the new application or application instance does not belong to any group, the new application or application instance is not registered in the central data socket descriptor database, and the new application or application instance is not stored in a central whitelist of applications allowed to operate in the data center based on the one or more hash scans of the new application or application instance operating in the data center. ### Claim 5 (depends on 1) The system as recited in claim 1, wherein the logic further causes the processing circuit to: group a set of application instances together into a single group in response to a determination that attributes of data socket descriptors used by the set of application instances match. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the attributes of data socket descriptors include a security profile for an individual server on which the application or application instance operates. ### Claim 7 (depends on 6) The system as recited in claim 6, wherein the logic further causes the processing circuit to: register each application or application instance operating in the data center based on the security profile included in the attributes of the one or more data socket descriptors used by the application or application instance. ### Claim 8 A method, comprising: collecting all data socket descriptor databases from individual servers operating in a data center, each data socket descriptor database storing attributes of a base socket and one or more data socket descriptors used by an application or application instance operating on an individual server; and storing data from the data socket descriptor databases for all applications and application instances operating in the data center in a central data socket descriptor database, the central data socket descriptor database being configured to store attributes of all data socket descriptors used by all applications or application instances operating in the data center. ### Claim 9 (depends on 8) The method as recited in claim 8, further comprising: discovering a new application or application instance operating in the data center based on collection of attributes of at least one data socket descriptor used by the new application; collecting one or more hash scans of the new application or application instance operating in the data center; and generating an application signature for each new application or application instance operating in the data center using the one or more hash scans. ### Claim 10 (depends on 9) The method as recited in claim 9, further comprising: determining whether the new application or application instance discovered operating in the data center is permissible; and causing the new application or application instance to close based on a determination that the new application or application instance is not permissible. ### Claim 11 (depends on 10) The method as recited in claim 10, wherein the determination that the new application or application instance is not permissible is based on at least one decision selected from a group comprising: the new application or application instance does not belong to any group, the new application or application instance is not registered in the central data socket descriptor database, and the new application or application instance is not stored in a central whitelist of applications allowed to operate in the data center based on the one or more hash scans of the new application or application instance operating in the data center. ### Claim 12 (depends on 8) The method as recited in claim 8, further comprising: grouping a set of application instances together into a single group in response to a determination that attributes of data socket descriptors used by the set of application instances match. ### Claim 13 (depends on 8) The method as recited in claim 8, wherein the attributes of data socket descriptors include a security profile for an individual server on which the application or application instance operates. ### Claim 14 (depends on 13) The method as recited in claim 13, further comprising: registering each application or application instance operating in the data center based on the security profile included in the attributes of the one or more data socket descriptors used by the application or application instance. ### Claim 15 A computer program product, comprising a computer readable storage medium having program instructions stored thereon, the program instructions being executable by a processing circuit to cause the processing circuit to: collect all data socket descriptor databases from individual servers operating in a data center, each data socket descriptor database storing attributes of a base socket and one or more data socket descriptors used by an application or application instance operating on an individual server; and store data from the data socket descriptor databases for all applications and application instances operating in the data center in a central data socket descriptor database, the central data socket descriptor database being configured to store attributes of all data socket descriptors used by all applications or application instances operating in the data center. ### Claim 16 (depends on 15) The computer program product as recited in claim 15, wherein the program instructions further cause the processing circuit to: discover a new application or application instance operating in the data center based on collection of attributes of at least one data socket descriptor used by the new application; collect one or more hash scans of the new application or application instance operating in the data center; and generate an application signature for each new application or application instance operating in the data center using the one or more hash scans. ### Claim 17 (depends on 16) The computer program product as recited in claim 16, wherein the program instructions further cause the processing circuit to: determine whether the new application or application instance discovered operating in the data center is permissible; and cause the new application or application instance to close based on a determination that the new application or application instance is not permissible. ### Claim 18 (depends on 17) The computer program product as recited in claim 17, wherein the determination that the new application or application instance is not permissible is based on at least one decision selected from a group comprising: the new application or application instance does not belong to any group, the new application or application instance is not registered in the central data socket descriptor database, and the new application or application instance is not stored in a central whitelist of applications allowed to operate in the data center based on the one or more hash scans of the new application or application instance operating in the data center. ### Claim 19 (depends on 15) The computer program product as recited in claim 15, wherein the program instructions further cause the processing circuit to: group a set of application instances together into a single group in response to a determination that attributes of data socket descriptors used by the set of application instances match. ### Claim 20 (depends on 15) The computer program product as recited in claim 15, wherein the attributes of data socket descriptors include a security profile for an individual server on which the application or application instance operates, and wherein the program instructions further cause the processing circuit to: register each application or application instance operating in the data center based on the security profile included in the attributes of the one or more data socket descriptors used by the application or application instance, based on data socket descriptors collected for the application or application instance.