Method, apparatus, and system for discovering application topology relationship

A topology discovery server, comprising:

• a processor;
• and
• a memory coupled to the processor,
• wherein the memory has a plurality of instructions stored thereon, that when executed by the processor, cause the processor to perform operations comprising:
• collecting at least two sets of application programming interface (API) calling information comprising a first set of API calling information and a second set of API calling information, wherein each set of API calling information corresponds to one API call and comprises an identifier of a virtual machine corresponding to the API call, an occurrence time of the API call, and a packet flow direction of the API call;
• and
• determining that the first API calling information and the second API calling information meet a first condition, wherein that the first API calling information and the second API calling information meet the first condition when a packet flow direction in the first API calling information and a packet flow direction in the second API calling information are mutually opposite, and a difference between an occurrence time of an API call in the first API calling information and an occurrence time of an API call in the second API calling information satisfies a first threshold, wherein
• determining that an interaction frequency of a first virtual machine indicated by the first API calling information and a second virtual machine indicated by the second API calling information meets a second condition;
• and
• determining that an application topology relationship exists between the first virtual machine and the second virtual machine based on the first and second conditions being met.

A system for discovering an application topology relationship, wherein the system comprises a topology discovery server and at least one host having a plurality of virtual machines;

• the host is configured to generate application programming interface API calling information when a virtual machine of the plurality of virtual machines sends a packet or when a virtual machine monitor (VMM) of the at least one host forwards a packet to a virtual machine of the plurality of virtual machines;
• the topology discovery server is configured to collect at least two sets of API calling information, wherein each set of API calling information corresponds to one API call, and each set of API calling information comprises an identifier of a virtual machine corresponding to the API call, an occurrence time of the API call, and a packet flow direction of the API call;
• the topology discovery server is further configured to analyze the at least two sets of API calling information comprising a first set of API calling information and a second set of API calling information, and determine that the first API calling information and the second API calling information meet a first condition when a packet flow direction in the first API calling information and a packet flow direction in the second API calling information are mutually opposite, and a difference between an occurrence time of an API call in the first API calling information and an occurrence time of an API call in the second API calling information satisfies a first threshold;
• and
• the topology discovery server is further configured to determine that an interaction frequency of a first virtual machine indicated by the first API calling information and a second virtual machine indicated by the second API calling information meets a second condition, and determine that an application topology relationship exists between the first virtual machine and the second virtual machine based on the first and second conditions being met.