IP Library › Granted Patent US 10,467,412
Granted Patent B2
US 10,467,412 · App. 15/726,261 · Granted Nov 5, 2019

Software container modeling

Inventors: Cem Gurkok (Coral Gables, FL); Arun Kumar Jagota (Sunnyvale, CA)
Assignee: salesforce.com, inc.
G06F21/566G06F21/56
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,467,412
App. No.
15/726,261
Granted
Nov 5, 2019
Kind
B2
Abstract

A system determines a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period. The system determines a second volume of out-calls of a second out-call type made by the software container. The system determines a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container. The system determines a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container. The system determines a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type. The system identifies any behavior or any application type associated with the application, based on the measure.

Claims (94)

1. A system comprising:

one or more processors; and

a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to:

determine a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period;

determine a second volume of out-calls of a second out-call type made by the software container;

determine a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container;

determine a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container;

determine a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the measure.

2. The system of claim 1 , wherein the third ratio and the fourth ratio are associated with the application during another time period.

3. The system of claim 1 , wherein the first ratio, the second ratio, the third ratio, and the fourth ratio are associated with a first layer of the software container.

4. The system of claim 3 , comprising further instructions, which when executed, cause the one or more processors to:

determine a third volume of out-calls of the first out-call type made by a second layer of the software container that is executing the application during the time period;

determine a fourth volume of out-calls of the second out-call type made by the second layer;

determine a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the second layer;

determine a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the second layer;

determine another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the other measure.

5. The system of claim 4 , comprising further instructions, which when executed, cause the one or more processors to:

determine a fifth volume of out-calls of the first out-call type made by a third layer of the software container that is executing the application during the time period;

determine a sixth volume of out-calls of the second out-call type made by the third layer;

determine a ninth ratio of the fifth volume to a combined volume of out-calls of all out-call types made by the third layer;

determine a tenth ratio of the sixth volume to the combined volume of out-calls of all out-call types made by the third layer;

determine an additional measure by comparing a fifth comparison of the ninth ratio to an eleventh ratio associated with the first out-call type, and by comparing the tenth ratio to a twelfth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the additional measure.

6. The system of claim 1 , comprising further instructions, which when executed, cause the one or more processors to:

determine a third volume of out-calls of the first out-call type made by the software container that is executing the application during another time period;

determine a fourth volume of out-calls of the second out-call type made by the software container during the other time period;

determine a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the software container during the other time period;

determine a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the software container during the other time period;

determine another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the other measure.

7. The system of claim 1 , wherein the measure comprises a relative entropy measure.

8. A computer program product comprising non-transitory computer-readable medium storing computer-readable program code to be executed by one or more processors, the computer-readable program code including instructions to:

determine a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period;

determine a second volume of out-calls of a second out-call type made by the software container;

determine a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container;

determine a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container;

determine a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the measure.

9. The computer program product of claim 8 , wherein the third ratio and the fourth ratio are associated with the application during another time period.

10. The computer program product of claim 8 , wherein the first ratio, the second ratio, the third ratio, and the fourth ratio are associated with a first layer of the software container.

11. The computer program product of claim 10 , wherein the program code comprises further instructions to:

determine a third volume of out-calls of the first out-call type made by a second layer of the software container that is executing the application during the time period;

determine a fourth volume of out-calls of the second out-call type made by the second layer;

determine a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the second layer;

determine a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the second layer;

determine another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the other measure.

12. The computer program product of claim 11 , wherein the program code comprises further instructions to:

determine a fifth volume of out-calls of the first out-call type made by a third layer of the software container that is executing the application during the time period;

determine a sixth volume of out-calls of the second out-call type made by the third layer;

determine a ninth ratio of the fifth volume to a combined volume of out-calls of all out-call types made by the third layer;

determine a tenth ratio of the sixth volume to the combined volume of out-calls of all out-call types made by the third layer;

determine an additional measure by comparing a fifth comparison of the ninth ratio to an eleventh ratio associated with the first out-call type, and by comparing the tenth ratio to a twelfth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the additional measure.

13. The computer program product of claim 8 , wherein the program code comprises further instructions to:

determine a third volume of out-calls of the first out-call type made by the software container that is executing the application during another time period;

determine a fourth volume of out-calls of the second out-call type made by the software container during the other time period;

determine a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the software container during the other time period;

determine a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the software container during the other time period;

determine another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identify one of any behavior and any application type associated with the application, based on the other measure.

14. A method comprising:

determining, by a database system, a first volume of out-calls of a first out-call type made by a software container that is executing an application during a time period;

determining, by the database system, a second volume of out-calls of a second out-call type made by the software container;

determining, by the database system, a first ratio of the first volume to a combined volume of out-calls of all out-call types made by the software container;

determining, by the database system, a second ratio of the second volume to the combined volume of out-calls of all out-call types made by the software container;

determining, by the database system, a measure by comparing the first ratio to a third ratio associated with the first out-call type, and by comparing the second ratio to a fourth ratio associated with the second out-call type; and

identifying, by the database system, one of any behavior and any application type associated with the application, based on the measure.

15. The method of claim 14 , wherein the third ratio and the fourth ratio are associated with the application during another time period.

16. The method of claim 14 , wherein the first ratio, the second ratio, the third ratio, and the fourth ratio are associated with a first layer of the software container.

17. The method of claim 16 , the method further comprising:

determining, by the database system, a third volume of out-calls of the first out-call type made by a second layer of the software container that is executing the application during the time period;

determining, by the database system, a fourth volume of out-calls of the second out-call type made by the second layer;

determining, by the database system, a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the second layer;

determining, by the database system, a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the second layer;

determining, by the database system, another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identifying, by the database system, one of any behavior and any application type associated with the application, based on the other measure.

18. The method of claim 17 , the method further comprising:

determining, by the database system, a fifth volume of out-calls of the first out-call type made by a third layer of the software container that is executing the application during the time period;

determining, by the database system, a sixth volume of out-calls of the second out-call type made by the third layer;

determining, by the database system, a ninth ratio of the fifth volume to a combined volume of out-calls of all out-call types made by the third layer;

determining, by the database system, a tenth ratio of the sixth volume to the combined volume of out-calls of all out-call types made by the third layer;

determining, by the database system, an additional measure by comparing a fifth comparison of the ninth ratio to an eleventh ratio associated with the first out-call type, and by comparing the tenth ratio to a twelfth ratio associated with the second out-call type; and

identifying, by the database system, one of any behavior and any application type associated with the application, based on the additional measure.

19. The method of claim 14 , the method further comprising:

determining, by the database system, a third volume of out-calls of the first out-call type made by the software container that is executing the application during another time period;

determining, by the database system, a fourth volume of out-calls of the second out-call type made by the software container during the other time period;

determining, by the database system, a fifth ratio of the third volume to a combined volume of out-calls of all out-call types made by the software container during the other time period;

determining, by the database system, a sixth ratio of the fourth volume to the combined volume of out-calls of all out-call types made by the software container during the other time period;

determining, by the database system, another measure by comparing the fifth ratio to a seventh ratio associated with the first out-call type, and by comparing the sixth ratio to an eighth ratio associated with the second out-call type; and

identifying, by the database system, one of any behavior and any application type associated with the application, based on the other measure.

20. The method of claim 14 , wherein the measure comprises a relative entropy measure.

Assignments (2)
CHANGE OF NAME Recorded Oct 3, 2023
From: SALESFORCE.COM, INC.
To: SALESFORCE, INC.
Reel/Frame 065114/0983 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 5, 2017
From: GURKOK, CEM; JAGOTA, ARUN KUMAR
To: SALESFORCE.COM, INC.
Reel/Frame 043801/0036 →
Continuity (1)
Related Publication 20190108336A1 · Apr 11, 2019