INFERRING APPLICATION INVENTORY

• US 20140280873A1
• Filed: 03/14/2013
• Published: 09/18/2014
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Stickle, Thomas Charles
• Granted Patent: US 9,473,355 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/006 Identification G06F11/2289 takes precedence
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3017 where the computing system is implementing multitasking multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3096 wherein the means or processing minimize the use of computing system or of computing system component resources, e.g. non-intrusive monitoring which minimizes the probe effect: sniffing, intercepting, indirectly deriving the monitored data from other directly available data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Disclosed are various embodiments for an application inventory application. Computing resource usage data and configuration data is obtained for machine instances executed in a cloud computing architecture. The usage data and configuration data are used as factors to identify applications executed in the machine instance. Reports embodying the application identifications are generated.

Claims

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, comprising:

code that obtains a disk configuration of one of a plurality of machine instances executing a plurality of applications;

obtaining, in the computing device, a network traffic permissions configuration of the one of machine instances, the network traffic permissions configuration defining at least one of an open port, a set of network addresses, or a networking protocol for which the one of the machine instances is configured to accept network traffic;

code that obtains a network traffic routing configuration associated with one of the machine instances, the network traffic routing configuration defining a network traffic flow between the one of the machine instances and a distinct one of the machine instances;

code that identifies, without an internal inspection of the machine instance, a first one of the applications based at least in part on the disk configuration, the network traffic routing configuration, the network traffic permissions configuration, and an identification of a second one of the identifications;

code that stores an identification of the first one of the applications as one of a plurality of identifications stored in a data store;

code that generates an analytics report embodying the identifications.

2. The non-transitory computer-readable medium of claim 1, wherein the program further comprises:

code that determines whether the one of the machine instances is connected to a load balancing service; and

wherein the at least one application is identified based at least in part on the determination.

3. The non-transitory computer-readable medium of claim 1, wherein the program further comprises code that determines at least one of a central processing unit (CPU) usage, a graphics processing unit (GPU) usage, a disk usage, or a memory usage associated with the one of the machine instances;

and

wherein the at least one application is identified based at least in part on the central processing unit (CPU) usage, the graphics processing unit (GPU) usage, the disk usage, or the memory usage.

4. A system, comprising:

at least one computing device;

an inventory application executable in the at least one computing device, the inventory application comprising;

logic that obtains data embodying an interoperability between at least a subset of a plurality of machine instances;

logic that generates an identification for at least one application executed in the one of the machine instances based at least in part on the data; and

wherein the inventory application is executed external to the machine instances and does not perform an internal inspection of the machine instance.

5. The system of claim 4, wherein the logic that generates the identification further comprises:

logic that calculates a probability that the identification corresponds to the at least one application based at least in part on the data; and

logic that associates the identification with the at least one application responsive to the probability exceeding a threshold.

6. The system of claim 4, wherein the data comprises at least one of the open port, a set of network addresses, or a networking protocol for which the one of the machine instances accepts network traffic.

7. The system of claim 4, wherein the data comprises a network traffic routing configuration associated with the one of the machine instances defining a network traffic flow between the one of the machine instances and a distinct one of the machine instances and the identification is generated based at least in part on the network traffic routing configuration.

8. The system of claim 4, wherein the identification is generated based at least in part on a previously generated identification.

9. The system of claim 4, wherein the data comprises an open network port, and identification is generated based at least in part on the open network port being a default open network port for the at least one application.

10. The system of claim 4, wherein the inventory application further comprises:

logic that obtains a redundant array of independent disks (RAID) configuration for the one of the machine instances; and

wherein the identification is generated based at least in part on the RAID configuration.

11. The system of claim 4, wherein the data comprises a load balancing configuration.

12. The system of claim 4, wherein the inventory application further comprises:

logic that determines at least one of a central processing unit (CPU) usage, a graphics processing unit (GPU) usage, a disk usage, or a memory usage associated with the one of the machine instances; and

wherein the identification is generated based at least in part on the CPU usage, the GPU usage, the disk usage, or the memory usage.

13. The system of claim 4, wherein the identification is generated based at least in part on a disk size of the machine instance.

14. The system of claim 4, wherein the one of the machine instances is associated with an instance type defining at least one of a memory usage threshold, input/output (I/O) threshold, CPU usage threshold, or GPU usage threshold, and the identification is generated based at least in part on the instance type.

15. The system of claim 4, wherein the data comprises network traffic permissions defined with respect to the subset of the machine instances.

16. The system of claim 4, wherein the inventory application further comprises:

logic that stores the identification as one of a plurality of identifications; and

logic that generates an analytics report based at least in part on the identifications.

17. A method, comprising the steps of:

obtaining, in one or more computing devices, data embodying operational interoperability between a subset of a plurality of machine instances executing at least one application; and

identifying, in the computing device, the at least one application based at least in part on the data without an internal inspection of the plurality of machine instances.

18. The method of claim 17, wherein identifying the at least one application comprises:

calculating, in the computing device, a plurality of scores each corresponding to one of a plurality of potential application identities; and

identifying, in the computing device, the at least one of the applications as a one of the potential application identities having the highest score.

19. The method of claim 17, wherein the data comprises at least one of a RAID configuration, a disk size, or a disk partitioning.

20. The method of claim 17, wherein the one of the machine instances is associated with an instance type defining at least one of a memory usage threshold, input/output (I/O) threshold, CPU usage threshold, or GPU usage threshold, and the identification is generated based at least in part on the instance type.

21. The method of claim 17, wherein the data comprises a network traffic permissions configuration defining at least one of an open port, a set of network addresses, or a networking protocol for which the one of the machine instances accepts network traffic.

22. The method of claim 17, further comprising:

generating, in the computing device, a network traffic pattern embodying network communications between the subset of the machine instances; and

wherein identifying the at least one application is performed based at least in part on the network traffic pattern.

23. The method of claim 17, further comprising:

storing, in the computing device, an identifier of the at least one application in a data store; and

generating, in the computing device, an analytics report embodying the identifier and a plurality of previously stored identifiers.

24. The method of claim 17, wherein the data comprises a network traffic routing configuration defining a network traffic flow between the subset of the machine instances.