INTELLIGENT GARBAGE COLLECTOR FOR CONTAINERS

• US 20190310935A1
• Filed: 04/10/2018
• Published: 10/10/2019
• Est. Priority Date: 04/10/2018
• Status: Active Grant

• Current Assignee: Red Hat Israel Ltd. (International Business Machines Corporation)
• Original Assignee: Red Hat Israel Ltd. (International Business Machines Corporation)
• Inventors: Shuster, Boaz, Ramraz, Oded
• Granted Patent: US 11,132,293 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/0253 Garbage collection, i.e. reclamation of unreferenced memory
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2212/1041 Resource optimization
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/163 Server or database system
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound

Abstract

Methods, systems, and computer program products are included for the intelligent garbage collection of containers. An example method includes providing a garbage collection data structure, the garbage collection data structure including metadata and one or more resource consumption parameters corresponding to the container. The one or more resource consumption parameters are analyzed by a machine-learning function. Based on the analyzing, the container is classified into one or more classes, the one or more classes including at least one of a suspicious container class, a malicious container class, or a normal container class. Based on the classifying, one or more garbage collection actions are performed on the container, including at least one of generating an alert corresponding to the container or reducing the resource consumption of the container.

Claims

1. A method for performing garbage collection comprising:

providing a garbage collection data structure, the garbage collection data structure including metadata and one or more resource consumption parameters corresponding to a container;

analyzing, by a machine-learning function, the metadata and the one or more resource consumption parameters;

classifying, based on the analyzing, the container into one or more classes, the one or more classes including at least one of a suspicious container class, a malicious container class, or a normal container class; and

performing, based on the classifying, one or more garbage collection actions on the container, including at least one of generating an alert corresponding to the container, reducing a resource consumption of the container, or marking the container as safe.

2. The method of claim 1, wherein the machine-learning function includes a decision tree, and wherein a first attribute of the decision tree includes a first one of the one or more resource consumption parameters, and a second attribute of the decision tree includes a second one of the one or more resource consumption parameters.

3. The method of claim 1, wherein the one or more garbage collection actions for reducing the resource consumption of the container includes stopping execution of the container.

4. The method of claim 1, wherein the one or more garbage collection actions for reducing the resource consumption of the container includes deleting the container.

5. The method of claim 1, wherein the one or more resource consumption parameters include a processor usage, a memory usage, or a duration corresponding to the container.

6. The method of claim 1, wherein the metadata include one or more of name or an identifier.

7. The method of claim 1, wherein the garbage collection data structure includes a comma separated value file.

8. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause at least one machine to perform operations comprising:

providing a garbage collection data structure, the garbage collection data structure including metadata and one or more resource consumption parameters corresponding to a container;

analyzing, by a machine-learning function, the one or more resource consumption parameters;

classifying, based on the analyzing, the container into one or more classes, the one or more classes including at least one of a suspicious container class, a malicious container class, or a normal container class; and

performing, based on the analyzing, one or more garbage collection actions on the container, including at least one of generating an alert corresponding to the container, reducing a resource consumption of the container, or marking the container as safe.

9. The non-transitory machine-readable medium of claim 8, wherein the machine-learning function includes a decision tree, and wherein a first attribute of the decision tree includes a first one of the one or more resource consumption parameters, and a second attribute of the decision tree includes a second one of the one or more resource consumption parameters.

10. The non-transitory machine-readable medium of claim 8, wherein the one or more garbage collection actions for reducing the resource consumption of the container includes stopping execution of the container.

11. The non-transitory machine-readable medium of claim 8, wherein the one or more garbage collection actions for reducing the resource consumption of the container includes deleting the container.

12. The non-transitory machine-readable medium of claim 8, wherein the one or more resource consumption parameters include a processor usage, a memory usage, or a duration corresponding to the container.

13. The non-transitory machine-readable medium of claim 8, wherein the metadata include one or more of a name or an identifier.

14. The non-transitory machine-readable medium of claim 8, wherein the garbage collection data structure includes a comma separated value file.

15. A system comprising:

a non-transitory memory; and

one or more hardware processors coupled to the non-transitory memory to execute instructions from the non-transitory memory to perform operations comprising;

providing a garbage collection data structure, the garbage collection data structure including metadata and a resource consumption parameter corresponding to a container;

analyzing, by a machine-learning function, the metadata and the resource consumption parameter;

based on the analyzing, assigning a class to the container; and

based on the assigning, performing a garbage collection action on the container.

16. The system of claim 15, wherein the machine-learning function includes a decision tree, and wherein a first attribute of the decision tree includes the resource consumption parameter, and a second attribute of the decision tree includes another of the resource consumption parameter.

17. The system of claim 15, wherein the garbage collection action includes generating an alert corresponding to the container, reducing a resource consumption of the container, or marking the container as safe.

18. The system of claim 15, further comprising discretizing, by the machine-learning function, the resource consumption parameter.

19. The system of claim 15, further comprising determining, based on the analyzing, that a new class should be created for the container image, and creating the new class.

20. The system of claim 15, wherein the analyzing includes a comparison of the assigning the container class using different machine-learning functions and selecting a most accurate machine-learning function from among the different machine-learning functions.