Generating a representation of program processes executing on an information technology environment

1. A method, comprising:

receiving identifications of program processes executing on an information technology environment;

clustering the identified program processes into a plurality of different groups, wherein the identified program processes that are clustered are processes of one or more application programs and the plurality of different groups represent different application service groups and each of the different application service groups includes one or more similar program processes;

receiving identifications of interactions between at least a portion of the program processes;

analyzing the identified interactions to determine one or more interaction metrics between different group pairs in the plurality of different groups; and

generating a graph representation that includes at least a portion of the different application service groups as graph nodes in the graph representation and includes one or more graph edges connecting one or more pairs included in the graph nodes, where the one or more graph edges are determined to be included in the graph representation based on the one or more interaction metrics.

2. The method of claim 1 , wherein the identified program processes are clustered into the plurality of different groups including by applying a prediction model configured to utilize a name, a path, and arguments for each of the program processes.

3. The method of claim 2 , wherein the prediction model is generated including by determining similarity metrics using a training dataset to identify unique clusters, and the unique clusters are randomly sampled to extract a threshold number of samples from each unique cluster of the identified unique clusters.

4. The method of claim 3 , wherein the similarity metrics are determined at least in part by determining Levenshtein distances between different entries of the training dataset.

5. The method of claim 2 , wherein the prediction model is based at least in part on the extracted threshold number of samples from each unique cluster of the identified unique clusters.

6. The method of claim 2 , wherein the prediction model is updated by sampling prediction results and adding the sampled prediction results to the prediction model.

7. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining, for at least one of the plurality of different groups, a number of unique source program processes from the at least one of the plurality of different groups with at least one outgoing connection directed to a target program process of the plurality of different groups.

8. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining, for at least one of the plurality of different groups, a number of unique source program processes from the plurality of different groups with connections directed to target program processes of the at least one of the plurality of different groups.

9. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining a total number of unique program processes from a first group of the plurality of different groups with an outgoing connection to a program process of a second group of the plurality of different groups.

10. The method of claim 1 , further comprising:

receiving an application service definition, wherein the application service definition is based on a condition comparing at least one of the one or more interaction metrics to a threshold value; and

identifying one or more of the graph nodes in the graph representation that match the condition of the application service definition.

11. The method of claim 10 , further comprising:

labeling the identified one or more of the graph nodes in the graph representation that match the condition of the application service definition with a category defined by the application service definition.

12. A system, comprising:

one or more processors; and

a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:

receive identifications of program processes executing on an information technology environment;

cluster the identified program processes into a plurality of different groups, wherein the identified program processes that are clustered are processes of one or more application programs and the plurality of different groups represent different application service groups and each of the different application service groups includes one or more similar program processes;

receive identifications of interactions between at least a portion of the program processes;

analyze the identified interactions to determine one or more interaction metrics between different group pairs in the plurality of different groups; and

generate a graph representation that includes at least a portion of the different application service groups as graph nodes in the graph representation and includes one or more graph edges connecting one or more pairs included in the graph nodes, where the one or more graph edges are determined to be included in the graph representation based on the one or more interaction metrics.

13. The system of claim 12 , wherein the identified program processes are clustered into the plurality of different groups including by applying a prediction model configured to utilize a name, a path, and arguments for each of the program processes.

14. The system of claim 13 , wherein the prediction model is generated including by determining similarity metrics using a training dataset to identify unique clusters, and the unique clusters are randomly sampled to extract a threshold number of samples from each unique cluster of the identified unique clusters.

15. The system of claim 13 , wherein the prediction model is updated by sampling prediction results and adding the sampled prediction results to the prediction model.

16. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups including by being caused to determine, for at least one of the plurality of different groups, a number of unique source program processes from the at least one of the plurality of different groups with at least one outgoing connection directed to a target program process of the plurality of different groups.

17. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups including by being caused to determine, for at least one of the plurality of different groups, a number of unique source program processes from the plurality of different groups with connections directed to target program processes of the at least one of the plurality of different groups.

18. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups including by being caused to determine a total number of unique program processes from a first group of the plurality of different groups with an outgoing connection to a program process of a second group of the plurality of different groups.

19. The system of claim 12 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:

receive an application service definition, wherein the application service definition is based on a condition comparing at least one of the one or more interaction metrics to a threshold value; and

identify one or more of the graph nodes in the graph representation that match the condition of the application service definition.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving identifications of program processes executing on an information technology environment;

clustering the identified program processes into a plurality of different groups, wherein the identified program processes that are clustered are processes of one or more application programs and the plurality of different groups represent different application service groups and each of the different application service groups includes one or more similar program processes;

receiving identifications of interactions between at least a portion of the program processes;

analyzing the identified interactions to determine one or more interaction metrics between different group pairs in the plurality of different groups; and

generating a graph representation that includes at least a portion of the different application service groups as graph nodes in the graph representation and includes one or more graph edges connecting one or more pairs included in the graph nodes, where the one or more graph edges are determined to be included in the graph representation based on the one or more interaction metrics.