System and method for detecting process anomalies in a distributed computation system utilizing containers
A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines. The operating signals characterize container activities. The container activities are isolated processes in user space designated by an operating system kernel. The container activities are ascribed a container lifecycle phase characterized as one of container startup, container steady state and container shutdown. A process anomaly is identified when container lifecycle phase activity deviates from baseline container lifecycle phase activity.
1. A server, comprising:
a processor; and
a memory connected to the processor, the memory storing instructions executed by the processor to:
collect operating signals from machines, wherein the operating signals characterize processes running in containers and each operating signal includes a process lineage and an executed file path for a process running in a container,
ascribe a container lifecycle phase to the processes, wherein the container lifecycle phase is characterized as one of container startup, container steady state and container shutdown,
identify a process anomaly when a process running in a container during the container lifecycle phase deviates from a baseline for the container during the container lifecycle phase, wherein the process anomaly corresponds to the process, and
present, on a display device, a user interface that lists processes running in the container and identifies the process anomaly.
2. The server of claim 1 wherein the instructions executed by the processor to identify the process anomaly include instructions executed by the processor to evaluate the process lineage.
3. The server of claim 2 wherein the instructions executed by the processor to evaluate the process lineage evaluate whether there is a deviation from a typical parent process for a child process.
4. The server of claim 1 wherein the instructions executed by the processor to identify the process anomaly include instructions executed by the processor to evaluate process replicas for anomalous behavior.
5. The server of claim 1 further comprising instructions executed by the processor to provide an interface for adding and deleting processes to the baseline for the container.
6. The server of claim 1 further comprising instructions executed by the processor to:
identify a new deployment identifier and container name for a container, wherein the container is within a deployment identified by the deployment identifier, and
create a baseline for the container, wherein the baseline includes an executed file path for a process running in the container.
7. The server of claim 1 wherein the container lifecycle phase is based on a timestamp of a process running in a container, the container start time, and the container end time.
8. A method, comprising:
collecting, by a server comprising a processor and a memory connected to the processor, operating signals from machines, wherein the operating signals characterize processes running in containers and each operating signal includes a process lineage and an executed file path for a process running in a container,
ascribing, by the server, a container lifecycle phase to the processes, wherein the container lifecycle phase is characterized as one of container startup, container steady state and container shutdown,
identifying, by the server, a process anomaly when a process running in a container during the container lifecycle phase deviates from a baseline for the container during the container lifecycle phase, wherein the process anomaly corresponds to the process, and
presenting, on a display device, a user interface that lists processes running in the container and identifies the process anomaly.
9. The method of claim 8 , wherein identifying the process anomaly comprises evaluating the process lineage.
10. The method of claim 9 , wherein evaluating the process lineage comprises evaluating whether there is a deviation from a typical parent process for a child process.
11. The method of claim 8 , wherein identifying the process anomaly comprises evaluating process replicas for anomalous behavior.
12. The method of claim 8 , further comprising:
providing an interface for adding and deleting processes to the baseline for the container.
13. The method of claim 8 , further comprising:
identifying a new deployment identifier and container name for a container, wherein the container is within a deployment identified by the deployment identifier, and
creating a baseline for the container, wherein the baseline includes an executed file path for a process running in the container.
14. The method of claim 8 , wherein the container lifecycle phase is based on a timestamp of a process running in a container, the container start time, and the container end time.
15. A non-transitory computer-readable storage medium that includes computer-executable instructions that, when executed, cause one or more processor devices to:
collect operating signals from machines, wherein the operating signals characterize processes running in containers and each operating signal includes a process lineage and an executed file path for a process running in a container,
ascribe a container lifecycle phase to the processes, wherein the container lifecycle phase is characterized as one of container startup, container steady state and container shutdown,
identify a process anomaly when a process running in a container during the container lifecycle phase deviates from a baseline for the container during the container lifecycle phase, wherein the process anomaly corresponds to the process, and
present, on a display device, a user interface that lists processes running in the container and identifies the process anomaly.
16. The non-transitory computer-readable storage medium of claim 15 , wherein to identify the process anomaly, the instructions are further to cause the processor device to evaluate the process lineage.
17. The non-transitory computer-readable storage medium of claim 16 , wherein to evaluate the process lineage, the instructions are further to cause the processor device to evaluate whether there is a deviation from a typical parent process for a child process.
18. The non-transitory computer-readable storage medium of claim 15 , wherein to identify the process anomaly, the instructions are further to cause the processor device to evaluate process replicas for anomalous behavior.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions are further to cause the processor device to:
provide an interface for adding and deleting processes to the baseline for the container.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions are further to cause the processor device to:
identify a new deployment identifier and container name for a container, wherein the container is within a deployment identified by the deployment identifier, and
create a baseline for the container, wherein the baseline includes an executed file path for a process running in the container.