Granted Patent B1

US 12,505,126 · App. 18/609,488 · Granted Dec 23, 2025

Inventors: Yijou Chen (Cupertino, CA); Harish Kumar Bharat Singh (Pleasanton, CA); Murat Bog (Fremont, CA); Vikram Kapoor (Saratoga, CA)

Assignee: Fortinet, Inc.

G06F16/285G06F16/2246G06F16/9024

Abstract

Claims (38)

1 . A system, comprising:

one or more processors configured to perform a process comprising:

causing a set of agents to collect log data by deploying the set of agents on respective resources of a set of resources of a network environment, in which the log data for a given resource of the set of resources is collected from one or more processes associated with a network connection responsive to detecting network activity on the network connection;

generating, based on the log data, a logical graph comprising a set of nodes and a set of edges, the edges representing communications between nodes in the set of nodes;

detecting, based on the logical graph, anomaly associated with a communication made from a first pod instance to a second pod instance within the network environment,

wherein a pod is a set of one or more containers deployed on a same host; and

generating an alert that the anomaly associated with the communication made from the first pod instance to the second pod instance has occurred; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2 . The system of claim 1 , wherein the set of nodes comprises a first node representative of the first pod instance and a second node representative of the second pod instance, and wherein the process further comprises:

augmenting the logical graph by adding a new edge between the first node representative of the first pod instance and the second node representative of the second pod instance, the new edge representing the communication made from the first pod instance to the second pod instance, wherein the generating the alert is based on the adding the new edge.

3 . The system of claim 2 , wherein the logical graph comprises a process communication graph, wherein the process communication graph clusters processes into nodes based on communications they make with other processes.

4 . The system of claim 3 , wherein the process further comprises using a namespace to assign a persistent cluster name.

5 . The system of claim 2 , wherein augmenting the logical graph includes performing a join.

6 . The system of claim 2 , wherein the augmented logical graph clusters pods together into pod clusters.

7 . The system of claim 6 , wherein the clustering is based at least in part on containers executing inside the pods.

8 . The system of claim 6 , wherein at least two nodes clustered together in a process communication graph are split across two different pod clusters.

9 . The system of claim 6 , wherein at least two nodes clustered into two different clusters in a process communication graph are clustered together in a single pod cluster.

10 . The system of claim 2 , wherein at least a portion of the augmented logical graph is displayed in an interface in response to a user input.

11 . The system of claim 2 , wherein the augmented logical graph comprises a hierarchical topology of pods and containers.

12 . The system of claim 1 , wherein the log data is obtained from one or more agents.

13 . The system of claim 12 , wherein the one or more agents are in one or more containerized environments.

14 . A method, comprising:

causing a set of agents to collect log data by deploying the set of agents on respective resources of a set of resources of a network environment, in which the log data for a given resource of the set of resources is collected from one or more processes associated with a network connection responsive to detecting network activity on the network connection;

generating, based on the log data, a logical graph comprising a set of nodes and a set of edges, the edges representing communications between nodes in the set of nodes;

detecting, based on the logical graph, an anomaly associated with a communication made from a first pod instance to a second pod instance within the network environment,

wherein a pod is a set of one or more containers deployed on a same host; and

generating an alert that the anomaly associated with the communication made from the first pod instance to the second pod instance has occurred.

15 . The method of claim 14 , wherein the set of nodes comprises a first node representative of the first pod instance and a second node representative of the second pod instance, and wherein the method further comprises:

augmenting the logical graph by adding a new edge between the first node representative of the first pod instance and the second node representative of the second pod instance, the new edge representing the communication made from the first pod instance to the second pod instance, wherein the generating the alert is based on the adding the new edge.

16 . The method of claim 15 , wherein the logical graph comprises a process communication graph, wherein the process communication graph clusters processes into nodes based on communications they make with other processes.

17 . The method of claim 16 , further comprising using a namespace to assign a persistent cluster name.

18 . The method of claim 15 , wherein augmenting the logical graph includes performing a join.

19 . The method of claim 15 , wherein the augmented logical graph clusters pods together into pod clusters.

20 . A non-transitory computer readable storage medium having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

causing a set of agents to collect log data by deploying the set of agents on respective resources of a set of resources of a network environment, in which the log data for a given resource of the set of resources is collected from one or more processes associated with a network connection responsive to detecting network activity on the network connection;

generating, based on the log data, a logical graph comprising a set of nodes and a set of edges, the edges representing communications between nodes in the set of nodes; detecting, based on the logical graph, an anomaly associated with a communication made from a first pod instance to a second pod instance within the network environment,

wherein a pod is a set of one or more containers deployed on a same host; and

generating an alert that the anomaly associated with the communication made from the first pod instance to the second pod instance has occurred.

Assignments (2)

Continuity (2)

References Cited (400)