Detecting anomalies in a distributed application

1. A method of detecting anomalies in a distributed application that runs on a plurality of nodes to execute a plurality of workloads, comprising:

collecting first network traffic data of the workloads at a number of different times during a first period of execution of the workloads;

examining metadata of each first network traffic data that is collected to determine a workload ID of a workload that generated the first network traffic data and to determine whether the first network traffic data is egress data, ingress data, or neither;

upon determining that the first network traffic data is egress data, recording egress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is ingress data, recording ingress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is neither egress data nor ingress data, computing a data rate of the first network traffic data that is neither egress data nor ingress data and recording the computed data rate in association with the workload ID;

collecting second network traffic data of the workloads at a number of different times during a second period of execution of the workloads after the first period of execution;

examining metadata of each second network traffic data that is collected to determine a workload ID of a workload that generated the second network traffic data and to determine whether the second network traffic data is egress data, ingress data, or neither; and

detecting one or more anomalies in the distributed application based on a comparison of egress traffic information contained in the metadata of the second network traffic data, ingress traffic information contained in the metadata of the second network traffic data, and a data rate of the second network traffic data that is neither egress data nor ingress data, respectively against the egress traffic information, the ingress traffic information, and the computed data rate that are recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

2. The method of claim 1 , wherein the egress network traffic information includes port, protocol, and domain specified in the egress data.

3. The method of claim 2 , further comprising:

computing a data rate of the egress data and recording the data rate of the egress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is egress data against the data rate of the egress data that is recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

4. The method of claim 1 , wherein the ingress network traffic indicates whether the ingress data originated from a public network or a private network.

5. The method of claim 4 , further comprising:

computing a data rate of the ingress data and recording the data rate of the ingress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is ingress data against the data rate of the ingress data that is recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

6. A computing system for detecting anomalies in a distributed application that runs on a plurality of nodes to execute a plurality of workloads, said computing system comprising:

a storage device; and

an anomaly detection server, wherein the anomaly detection server is configured to:

examine metadata of each first network traffic data that is collected at a number of different times during a first period of execution of the workloads to determine a workload ID of a workload that generated the first network traffic data and to determine whether the first network traffic data is egress data, ingress data, or neither;

upon determining that the first network traffic data is egress data, record in the storage device egress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is ingress data, record in the storage device ingress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is neither egress data nor ingress data, compute a data rate of the first network traffic data that is neither egress data nor ingress data and record in the storage device the computed data rate in association with the workload ID;

examine metadata of each second network traffic data that is collected at a number of different times during a second period of execution of the workloads after the first period of execution to determine a workload ID of a workload that generated the second network traffic data and to determine whether the second network traffic data is egress data, ingress data, or neither; and

detect one or more anomalies in the distributed application based on a comparison of egress traffic information contained in the metadata of the second network traffic data, ingress traffic information contained in the metadata of the second network traffic data, and a data rate of the second network traffic data that is neither egress data nor ingress data, respectively against the egress traffic information, the ingress traffic information, and the computed data rate that are recorded in the storage device in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

7. The computing system of claim 6 , wherein

the distributed application is deployed onto a Kubernetes platform.

8. The computing system of claim 6 , wherein the egress network traffic information includes port, protocol, and domain specified in the egress data.

9. The computing system of claim 6 , wherein the ingress network traffic indicates whether the ingress data originated from a public network or a private network.

10. A non-transitory computer readable medium comprising instructions that are executable in a computer system, wherein the instructions when executed cause the computer system to carry out a method of detecting anomalies in a distributed application that runs on a plurality of nodes to execute a plurality of workloads, said method comprising:

examining metadata of each first network traffic data that is collected at a number of different times during a first period of execution of the workloads to determine a workload ID of a workload that generated the first network traffic data and to determine whether the first network traffic data is egress data, ingress data, or neither;

upon determining that the first network traffic data is egress data, recording egress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is ingress data, recording ingress traffic information contained in the metadata in association with the workload ID;

upon determining that the first network traffic data is neither egress data nor ingress data, computing a data rate of the first network traffic data that is neither egress data nor ingress data and recording the computed data rate in association with the workload ID;

examining metadata of each second network traffic data that is collected at a number of different times during a second period of execution of the workloads after the first period of execution to determine a workload ID of a workload that generated the second network traffic data and to determine whether the second network traffic data is egress data, ingress data, or neither; and

detecting one or more anomalies in the distributed application based on a comparison of egress traffic information contained in the metadata of the second network traffic data, ingress traffic information contained in the metadata of the second network traffic data, and a data rate of the second network traffic data that is neither egress data nor ingress data, respectively against the egress traffic information, the ingress traffic information, and the computed data rate that are recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

11. The non-transitory computer readable medium of claim 10 , wherein the egress network traffic information includes port, protocol, and domain specified in the egress data.

12. The non-transitory computer readable medium of claim 11 , wherein said method further comprises:

computing a data rate of the egress data and recording the data rate of the egress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is egress data against the data rate of the egress data that is recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

13. The non-transitory computer readable medium of claim 10 , wherein the ingress network traffic indicates whether the ingress data originated from a public network or a private network.

14. The non-transitory computer readable medium of claim 13 , wherein said method further comprises:

computing a data rate of the ingress data and recording the data rate of the ingress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is ingress data against the data rate of the ingress data that is recorded in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

15. The computing system of claim 8 , wherein the anomaly detection server is configured to:

compute a data rate of the egress data and record in the storage device the data rate of the egress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is egress data against the data rate of the egress data that is recorded in the storage device in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.

16. The computing system of claim 9 , wherein the anomaly detection server is configured to:

compute a data rate of the ingress data and record in the storage device the data rate of the ingress data in association with the workload ID of the workload that generated the first network traffic data, wherein

an anomaly in the distributed application is detected also based on a comparison of a data rate of the second network traffic data that is ingress data against the data rate of the ingress data that is recorded in the storage device in association with the workload ID corresponding to the workload ID of the workload that generated the second network traffic data.