REPRESENTING VIRTUAL OBJECT PRIORITY BASED ON RELATIONSHIPS

• US 20110035802A1
• Filed: 08/07/2009
• Published: 02/10/2011
• Est. Priority Date: 08/07/2009
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Arajujo, Nelson S. JR., Fries, Robert M.
• Application Number:
  US12/537,426
• Publication Number:
  US 20110035802A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Methods, systems, and computer-readable media are disclosed for representing virtual object priority based on relationships. A particular method determines relationships between a plurality of virtual objects. An abnormal condition is detected at a first virtual object. A second virtual object and a third virtual object are identified based on respective relationships with the first virtual object. The method includes generating an output that identifies the first, second, and third virtual object. The output indicates a priority level for each of the virtual objects, and the priority level for the second virtual object is greater than the priority level for the third virtual object.

Claims

1. A method comprising:

determining relationships between a plurality of virtual objects;

detecting an abnormal condition at a first virtual object of the plurality of virtual objects;

at a computer, identifying a second virtual object based on a relationship between the second virtual object and the first virtual object;

at the computer, identifying a third virtual object based on a relationship between the third virtual object and the first virtual object; and

at the computer, generating an output that identifies the first virtual object, the second virtual object, and the third virtual object, wherein the output indicates a priority level for each of the virtual objects and wherein the priority level for the second virtual object is greater than the priority level for the third virtual object.

2. The method of claim 1, wherein the priority level for at least one of the virtual objects is based at least partially on a likelihood that the abnormal condition has affected the at least one virtual object, an importance of the at least one virtual object, or any combination thereof.

3. The method of claim 1, wherein the plurality of virtual objects includes one or more virtual machines, one or more virtual machine templates, or any combination thereof.

4. The method of claim 3, wherein the relationships include one or more contribution relationships.

5. The method of claim 3, wherein the relationships include one or more inheritance relationships determined based on virtual machine metadata, virtual machine files, virtual machine creation logs, or any combination thereof.

6. The method of claim 5, wherein the one or more inheritance relationships include a deploy relationship between a parent virtual object template and a child virtual object, a clone relationship between a parent virtual object and the child virtual object, a templatize relationship between the parent virtual object and a child virtual object template, or any combination thereof.

7. The method of claim 1, wherein the detected abnormal condition at the first virtual object includes a malware infection, a network intrusion, an incorrect virtual object setting, an error condition, or any combination thereof.

8. The method of claim 1, further comprising taking an action based on the output, wherein the action includes shutting down a virtual object, disconnecting a virtual object from a network, modifying a virtual object, initiating diagnostic tools at a virtual object, performing heuristic analysis at a virtual object, or any combination thereof.

9. The method of claim 1, wherein the output includes a prioritized list of virtual objects to be examined in response to the detected abnormal condition, wherein the prioritized list prioritizes the second virtual object over the third virtual object.

10. The method of claim 1, wherein the output includes a graph comprising a plurality of nodes and a plurality of edges, wherein each node represents a particular virtual object, and wherein each edge connects a pair of nodes and represents a relationship between the pair of nodes.

11. The method of claim 10, wherein a node representing the first virtual object is marked with a first indication corresponding to a first priority level.

12. The method of claim 11, wherein a node representing the second virtual object is marked with a second indication corresponding to a second priority level.

13. The method of claim 12, wherein a node representing the third virtual object is marked with a third indication corresponding to a third priority level.

14. The method of claim 13, further comprising identifying at least one safe virtual object that is not affected by the abnormal condition, wherein at least one node representing the at least one safe virtual object is marked with a fourth indication and wherein the indications include coloring of a particular node, modifying a border of a particular node, modifying a typeface of a particular node, or any combination thereof.

15. A system comprising:

a virtual object creation module configured to create a plurality of virtual objects, each virtual object having a relationship with one or more other virtual objects;

a pedigree controller configured to log the relationships between the plurality of virtual objects;

a database including computer memory configured to store the logged relationships;

a detector configured to detect an abnormal condition; and

an output generator configured to generate an output that identifies each of the plurality of virtual objects, the relationships between the plurality of virtual objects, and a priority level for each of the plurality of virtual objects.

16. The system of claim 15, wherein the output generator includes a display interface configured to:

display a graph based on the logged relationships, the graph comprising a plurality of nodes and a plurality of edges, each particular node representing a particular virtual object and each particular edge connecting a pair of nodes and representing a particular relationship between a pair of virtual objects represented by the pair of nodes; and

mark each node of the graph with an indication corresponding to a priority level based on a likelihood that the abnormal condition has affected the virtual object represented by the node.

17. The system of claim 16, further comprising an input interface configured to receive input regarding whether particular virtual objects have been affected by the abnormal condition, wherein the display interface is further configured to mark one or more nodes of the graph representing the particular virtual objects based on the input, wherein the input is received from a user, via software executed by the system, without user intervention, or any combination thereof.

18. A computer-readable medium comprising instructions, that when executed by a computer, cause the computer to:

determine inheritance relationships between a plurality of virtual objects;

display the plurality of virtual objects in a graph comprising a plurality of nodes and a plurality of edges, wherein each node represents a particular virtual object and wherein each edge between a pair of nodes represents an inheritance relationship between a pair of virtual objects represented by the pair of nodes;

detect a security compromise at a first virtual object;

color a first node representing the first virtual object with a first color used to represent virtual objects associated with a first priority level;

color a second node representing a second virtual object with a second color used to represent virtual objects associated with a second priority level; and

color a third node representing a third virtual object with a third color used to represent virtual objects associated with a third priority level;

wherein the second virtual object is a child of the first virtual object, the third virtual object is a parent of the first virtual object, and the second priority level is higher than the third priority level.

19. The computer-readable medium of claim 18, further comprising instructions, that when executed by the computer, cause the computer to determine that a particular virtual object is not compromised and color a particular node representing the particular virtual object a fourth color associated with a fourth priority level.

20. The computer-readable medium of claim 19, wherein the determination that the particular virtual object is not compromised is made after examining the particular virtual object based on the security compromise, the examination performed by a user, anti-malware software, network security software, or any combination thereof and wherein the relationships are determined based on user input, software specification, or any combination thereof.