Automated service-oriented performance management
In an embodiment, a data processing method comprises receiving, from one or more service monitoring processes configured to monitor operations of one or more computer applications instantiated within one or more containers, operation datasets representing operations that have been performed by one or more processes associated with the one or more computer applications; generating a baseline dataset of operations having operation properties from the operation datasets; computing a score for each operation in the baseline dataset, from the operation datasets, the score indicating whether the operation is a candidate for generating a rule that defines one or more expected values for an operation property of the operation; automatically generating a set of baseline operations rules for only those operations in the baseline dataset that score more than a score threshold.
1. A computer-implemented method of automatically determining operation rules for access control related to container operations, comprising:
receiving, from one or more service monitoring processes configured to monitor operations of one or more computer applications instantiated within one or more containers, operation datasets representing operations that have been performed by one or more processes associated with the one or more computer applications;
generating a baseline dataset of operations having operation properties from the operation datasets;
computing a score for each operation in the baseline dataset, from the operation datasets, the score indicating whether the operation is a candidate for generating a rule that defines one or more expected values for an operation property of the operation;
automatically generating a set of baseline operations rules for only those operations in the baseline dataset that score more than a score threshold,
the set of baseline operation rules including a baseline operation rule related to certain input parameters, for networking ports or for definition files, to be used upon initialization of a container of the one or more containers.
2. The computer-implemented method of claim 1 , the operation properties describing a process being an instantiation of a computer application within which the operation was executed, the computer application within which the operation was executed, or a container within which the computer application was instantiated.
3. The computer-implemented method of claim 1 ,
the one or more containers configured to communicate with a kernel module,
the one or more service monitoring processes configured to receive activity information from the kernel module.
4. The computer-implemented method of claim 1 ,
the generating comprising aggregating the operations in the operation datasets into one or more aggregated operations based on identifiers of the one or more containers hosted by a cloud service or instance tags of the cloud service associated with the operations,
the baseline dataset of operations comprising the one or more aggregated operations.
5. The computer-implemented method of claim 1 , the computing comprising determining a degree of consistency in values of an operation property of an operation in the baseline dataset.
6. The computer-implemented method of claim 1 , the computing comprising:
determining the one or more expected values for the operation property of the operation from the operation datasets;
calculating the score using a ratio of a total number of values of the operation property and a number of values of the operation property that do not match the one or more expected values, from the operation datasets.
7. The computer-implemented method of claim 1 , the computing comprising adjusting a calculated score using a smoothing function to avoid a skew from a low total number of values of the operation property or using a protection function to avoid a skew from a high total number of values of the operation property, from the operation datasets.
8. The computer-implemented method of claim 1 , the baseline dataset of operations being for a specific container of the one or more containers.
9. The computer-implemented method of claim 1 , further comprising:
receiving, from the one or more service monitoring processes, a new operation dataset representing a specific operation that has been performed by a process associated with a computer application of the one or more computer applications;
identifying a specific operation in the baseline dataset from the new operation dataset;
determining that the specific operation disagrees with a baseline operation rule of the set of baseline operation rules;
transmitting a notification that the specific operation is likely anomalous.
10. The computer-implemented method of claim 1 , further comprising determining the score threshold based on historical score thresholds or historical values of operation properties of anomalous operations.
11. One or more non-transitory computer-readable storage media storing instructions which when executed cause one or more processors to perform a method of automatically determining operation rules for access control related to container operations, the method comprising:
receiving, from one or more service monitoring processes configured to monitor operations of one or more computer applications instantiated within one or more containers, operation datasets representing operations that have been performed by one or more processes associated with the one or more computer applications;
generating a baseline dataset of operations having operation properties from the operation datasets;
computing a score for each operation in the baseline dataset, from the operation datasets, the score indicating whether the operation is a candidate for generating a rule that defines one or more expected values for an operation property of the operation;
automatically generating a set of baseline operations rules for only those operations in the baseline dataset that score more than a score threshold,
the set of baseline operation rules including a baseline operation rule related to certain input parameters, for networking ports or for definition files, to be used upon initialization of a container of the one or more containers.
12. The one or more non-transitory computer-readable storage media of claim 11 , the operation properties describing a process being an instantiation of a computer application within which the operation was executed, the computer application within which the operation was executed, or a container within which the computer application was instantiated.
13. The one or more non-transitory computer-readable storage media of claim 11 ,
the one or more containers configured to communicate with a kernel module,
the one or more service monitoring processes configured to receive activity information from the kernel module.
14. The one or more non-transitory computer-readable storage media of claim 11 ,
the generating comprising aggregating the operations in the operation datasets into one or more aggregated operations based on identifiers of the one or more containers hosted by a cloud service or instance tags of the cloud service associated with the operations,
the baseline dataset of operations comprising the one or more aggregated operations.
15. The one or more non-transitory computer-readable storage media of claim 11 , the computing comprising determining a degree of consistency in values of an operation property of an operation in the baseline dataset.
16. The one or more non-transitory computer-readable storage media of claim 11 , the computing comprising:
determining the one or more expected values for the operation property of the operation from the operation datasets;
calculating the score using a ratio of a total number of values of the operation property and a number of values of the operation property that do not match the one or more expected values, from the operation datasets.
17. The one or more non-transitory computer-readable storage media of claim 11 , the computing comprising adjusting a calculated score using a smoothing function to avoid a skew from a low total number of values of the operation property or using a protection function to avoid a skew from a high total number of values of the operation property, from the operation datasets.
18. The one or more non-transitory computer-readable storage media of claim 11 , the baseline dataset of operations being for a specific container of the one or more containers.
19. The one or more non-transitory computer-readable storage media of claim 11 , the method further comprising:
receiving, from the one or more service monitoring processes, a new operation dataset representing a specific operation that has been performed by a process associated with a computer application of the one or more computer applications;
identifying a specific operation in the baseline dataset from the new operation dataset;
determining that the specific operation disagrees with a baseline operation rule of the set of baseline operation rules;
transmitting a notification that the specific operation is likely anomalous.
20. The one or more non-transitory computer-readable storage media of claim 11 , the method further comprising determining the score threshold based on historical score thresholds or historical values of operation properties of anomalous operations.