# US 2018/0025160 A1 · Generating containers for applications utilizing reduced sets of libraries based on risk analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025160 A1 - Document ID: US20180025160A1 - Status: Published application - Kind: A1 - Application number: 15/216,190 - Filed: 2016-07-21 - Published: 2018-01-25 - Earliest claimed: 2016-07-21 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Jinho Hwang; Clifford A. Pickover; Maja Vukovic - Web page: https://patentgrep.com/patent/US20180025160A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 8/36: Software reuse - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method includes analyzing a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries, identifying a subset of the plurality of libraries utilized by the given application, determining one or more dependent libraries for each of the identified libraries in the subset, generating a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries, performing risk analysis for the given container including comparing a risk value calculated for the given container to a designated risk threshold, simulating one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold, and determining whether to accept or reject the given container responsive to the risk analysis and simulated actions. ## Claims ### Claim 1 A method comprising: analyzing a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries; identifying a subset of the plurality of libraries utilized by the given application; determining one or more dependent libraries for each of the identified libraries in the sub set; generating a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries; performing risk analysis for the given container, the risk analysis comprising comparing a risk value calculated for the given container to a designated risk threshold; simulating one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold; and determining whether to accept or reject the given container responsive to the risk analysis and simulated actions; wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The method of claim 1, wherein the given container comprises an operating system base image. ### Claim 3 (depends on 1) The method of claim 1, wherein the given container comprises a virtual machine. ### Claim 4 (depends on 1) The method of claim 1, wherein the given container comprises a portable container. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying the subset of the plurality of libraries utilized by the given application comprises analyzing source code of the given application. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying a subset of the plurality of libraries utilized by the given application comprises analyzing a binary of the given application. ### Claim 7 (depends on 1) The method of claim 1, wherein determining the one or more dependent libraries comprises utilizing a pattern database, the pattern database comprising at least one of: one or more dependency graphs for respective ones of a plurality of libraries; and one or more dependency trees for respective ones of the plurality of libraries. ### Claim 8 (depends on 7) The method of claim 7, wherein determining the one or more dependent libraries further comprises: identifying one or more shared objects and one or more static objects utilized by the given application; and utilizing the pattern database to determine dependent libraries for each of the shared objects and static objects. ### Claim 9 (depends on 7) The method of claim 7, further comprising at least one of adding and modifying one or more dependency graphs and one or more dependency trees in the pattern database for at least one of the identified libraries. ### Claim 10 (depends on 1) The method of claim 1, further comprising: obtaining one or more security parameters; and setting the designated risk threshold based on the security parameters. ### Claim 11 (depends on 10) The method of claim 10, wherein the security parameters comprise one of more of: an application type associated with the given application; a criticality associated with the given application; a risk tolerance; and a code complexity associated with the given application. ### Claim 12 (depends on 1) The method of claim 1, wherein simulating the one or more actions comprises determining potential risks associated with running the given application utilizing the given container without one or more of the plurality of libraries not included in the identified subset of libraries. ### Claim 13 (depends on 1) The method of claim 1, further comprising providing one or more visualizations of a risk associated with running the given application using the given container via a risk assessment interface. ### Claim 14 (depends on 1) The method of claim 1, wherein performing the risk analysis comprises assessing a business impact associated with the given application. ### Claim 15 (depends on 1) The method of claim 1, wherein: accepting the given container comprises deploying the given container; and rejecting the given container comprises deploying a default container for the given application that includes the libraries not in the subset. ### Claim 16 (depends on 15) The method of claim 15, wherein deploying the given container comprises deploying the given container as a software-as-a-service in one or more cloud computing environments. ### Claim 17 (depends on 1) The method of claim 1, wherein the given container does not comprise respective ones of the plurality of libraries not in the subset. ### Claim 18 (depends on 1) The method of claim 1, wherein at least one of: the given container has a smaller memory footprint relative to a default container for the given application that includes the plurality of libraries; the given container has a faster boot time relative to the default container; and the given container utilizes less processing power relative to the default container. ### Claim 19 A computer program product comprising a computer readable storage medium for storing computer readable program code which, when executed, causes a computer: to analyze a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries; to identify a subset of the plurality of libraries utilized by the given application; to determine one or more dependent libraries for each of the identified libraries in the sub set; to generate a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries; to perform risk analysis for the given container, the risk analysis comprising comparing a risk value calculated for the given container to a designated risk threshold; to simulate one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold; and to determine whether to accept or reject the given container responsive to the risk analysis and simulated actions. ### Claim 20 An apparatus comprising: a memory; and a processor coupled to the memory and configured: to analyze a given application to determine one or more packages utilized by the given application, the one or more packages comprising a plurality of libraries; to identify a subset of the plurality of libraries utilized by the given application; to determine one or more dependent libraries for each of the identified libraries in the subset; to generate a given container for the given application, the given container comprising the identified libraries in the subset and the dependent libraries for each of the identified libraries; to perform risk analysis for the given container, the risk analysis comprising comparing a risk value calculated for the given container to a designated risk threshold; to simulate one or more actions in the given container responsive to the risk value calculated for the given container exceeding the designated risk threshold; and to determine whether to accept or reject the given container responsive to the risk analysis and simulated actions.