Inferring application inventory

• US 9,473,355 B2
• Filed: 03/14/2013
• Issued: 10/18/2016
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Stickle, Thomas Charles
• Primary Examiner(s): Bates, Kevin
• Assistant Examiner(s): Mahmud, Golam
• Application Number:
  US13/827,728
• Publication Number:
  US 20140280873A1
• Time in Patent Office: 1,314 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 11/006 Identification G06F11/2289 takes precedence
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3017 where the computing system is implementing multitasking multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3096 wherein the means or processing minimize the use of computing system or of computing system component resources, e.g. non-intrusive monitoring which minimizes the probe effect: sniffing, intercepting, indirectly deriving the monitored data from other directly available data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Disclosed are various embodiments for an application inventory application. Computing resource usage data and configuration data is obtained for machine instances executed in a cloud computing architecture. The usage data and configuration data are used as factors to identify applications executed in the machine instance. Reports embodying the application identifications are generated.

Claims

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, the program, when executed, causing the at least one computing device to at least:

obtain a disk configuration of one of a plurality of machine instances executing a plurality of applications;

obtain a network traffic permissions configuration of the one of machine instances, the network traffic permissions configuration defining at least one of an open port, a set of network addresses, or a networking protocol for which the one of the machine instances is configured to accept network traffic;

obtain a network traffic routing configuration associated with one of the machine instances, the network traffic routing configuration defining a network traffic flow between the one of the machine instances and a distinct one of the machine instances;

identify, without an internal inspection of the machine instance, a first one of the applications based at least in part on the disk configuration, the network traffic routing configuration, the network traffic permissions configuration, and an identification of a second one of the applications;

store an identification of the first one of the applications as one of a plurality of identifications stored in a data store;

generate an analytics report embodying the identifications.

2. The non-transitory computer-readable medium of claim 1, wherein the program further causes the at least one computing device to:

determine whether the one of the machine instances is connected to a load balancing service; and

wherein the at least one application is identified based at least in part on the determination.

3. The non-transitory computer-readable medium of claim 1, wherein the program further causes the at least one computing device to determine at least one of a central processing unit (CPU) usage, a graphics processing unit (GPU) usage, a disk usage, or a memory usage associated with the one of the machine instances;

and

wherein the at least one application is identified based at least in part on the central processing unit (CPU) usage, the graphics processing unit (GPU) usage, the disk usage, or the memory usage.

4. A system, comprising:

at least one computing device configured to at least;

obtain data embodying an interoperability between at least a subset of a plurality of machine instances, the data comprising a disk configuration, a network traffic routing configuration, a network traffic permissions configuration, and an identification of a first application;

generate an identification for at least one second application executed in one of the machine instances based at least in part on the data without an internal inspection of the machine instance.

5. The system of claim 4, wherein generating the identification further comprises:

calculating a probability that the identification corresponds to the at least one second application based at least in part on the data; and

associating the identification with the at least one second application responsive to the probability exceeding a threshold.

6. The system of claim 4, wherein the data further comprises network traffic permissions define at least one of a set of network addresses or a networking protocol for which the one of the machine instances accepts network traffic.

7. The system of claim 4, wherein the network traffic routing configuration defines a network traffic flow between the one of the machine instances and a distinct one of the machine instances and the identification is generated based at least in part on the network traffic routing configuration.

8. The system of claim 4, wherein the network traffic permissions indicate an open network port, and identification is generated based at least in part on the open network port being a default open network port for the at least one second application.

9. The system of claim 4, wherein the disk configuration comprises a redundant array of independent disks (RAID) configuration for the one of the machine instances;

and

wherein the identification is generated based at least in part on the RAID configuration.

10. The system of claim 4, wherein the data comprises a load balancing configuration.

11. The system of claim 4, wherein the at least one computing device is further configured to at least:

determine at least one of a central processing unit (CPU) usage, a graphics processing unit (GPU) usage, a disk usage, or a memory usage associated with the one of the machine instances; and

wherein the identification is generated based at least in part on the CPU usage, the GPU usage, the disk usage, or the memory usage.

12. The system of claim 4, wherein the identification is generated based at least in part on a disk size of the machine instance.

13. The system of claim 4, wherein the one of the machine instances is associated with an instance type defining at least one of a memory usage threshold, input/output (I/O) threshold, CPU usage threshold, or GPU usage threshold, and the identification is generated based at least in part on the instance type.

14. The system of claim 4, wherein the network traffic permissions are defined with respect to the subset of the machine instances.

15. The system of claim 4, wherein the at least one computing device is further configured to at least:

store the identification as one of a plurality of identifications; and

generate an analytics report based at least in part on the identifications.

16. A method, comprising:

obtaining, in one or more computing devices, data embodying operational interoperability between a subset of a plurality of machine instances executing at least one application, the data comprising a disk configuration, a network traffic routing configuration, a network traffic permissions configuration, and an identification of another application; and

identifying, in the computing device, the at least one application based at least in part on the data without an internal inspection of the plurality of machine instances.

17. The method of claim 16, wherein identifying the at least one application comprises:

calculating, in the computing device, a plurality of scores each corresponding to one of a plurality of potential application identities; and

identifying, in the computing device, the at least one application as a one of the potential application identities having the highest score.

18. The method of claim 16, wherein the disk configuration comprises at least one of a RAID configuration, a disk size, or a disk partitioning.

19. The method of claim 16, wherein the one of the machine instances is associated with an instance type defining at least one of a memory usage threshold, input/output (I/O) threshold, CPU usage threshold, or GPU usage threshold, and the identification is generated based at least in part on the instance type.

20. The method of claim 16, wherein the network traffic permissions configuration defines at least one of a set of network addresses or a networking protocol for which the one of the machine instances accepts network traffic.

21. The method of claim 16, further comprising:

identifying, in the computing device, a network traffic pattern embodying network communications between the subset of the machine instances; and

wherein identifying the at least one application is performed based at least in part on the network traffic pattern.

22. The method of claim 16, further comprising:

storing, in the computing device, an identifier of the at least one application in a data store; and

generating, in the computing device, an analytics report embodying the identifier and a plurality of previously stored identifiers.

23. The method of claim 16, wherein the network traffic routing configuration defines a network traffic flow between the subset of the machine instances.

24. The method of claim 16, wherein the traffic permissions are defined with respect to the subset of the machine instances.