Generating a representation of program processes executing on an information technology environment

Patent metadata

Field	Value
Publication number	US-11316746-B1
Application number	US-202117145690-A
Country	US
Kind code	B1
Filing date	Jan 11, 2021
Priority date	Jan 11, 2021
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

Identifications of program processes executing on an information technology environment are received. The identified program processes are clustered into a plurality of different groups. Identifications of interactions between at least a portion of the program processes are received. The identified interactions are analyzed to determine one or more interaction metrics between different group pairs in the plurality of different groups. A graph representation that includes at least a portion of the plurality of different groups as graph nodes in the graph representation is generated. The graph representation includes one or more graph edges determined to be included based on the one or more interaction metrics.

First claim

What is claimed is:

1. A method, comprising:
receiving identifications of program processes executing on an information technology environment;
clustering the identified program processes into a plurality of different groups, wherein the identified program processes that are clustered are processes of one or more application programs and the plurality of different groups represent different application service groups and each of the different application service groups includes one or more similar program processes;
receiving identifications of interactions between at least a portion of the program processes;
analyzing the identified interactions to determine one or more interaction metrics between different group pairs in the plurality of different groups; and
generating a graph representation that includes at least a portion of the different application service groups as graph nodes in the graph representation and includes one or more graph edges connecting one or more pairs included in the graph nodes, where the one or more graph edges are determined to be included in the graph representation based on the one or more interaction metrics.

2. The method of claim 1 , wherein the identified program processes are clustered into the plurality of different groups including by applying a prediction model configured to utilize a name, a path, and arguments for each of the program processes.

3. The method of claim 2 , wherein the prediction model is generated including by determining similarity metrics using a training dataset to identify unique clusters, and the unique clusters are randomly sampled to extract a threshold number of samples from each unique cluster of the identified unique clusters.

4. The method of claim 3 , wherein the similarity metrics are determined at least in part by determining Levenshtein distances between different entries of the training dataset.

5. The method of claim 2 , wherein the prediction model is based at least in part on the extracted threshold number of samples from each unique cluster of the identified unique clusters.

6. The method of claim 2 , wherein the prediction model is updated by sampling prediction results and adding the sampled prediction results to the prediction model.

7. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining, for at least one of the plurality of different groups, a number of unique source program processes from the at least one of the plurality of different groups with at least one outgoing connection directed to a target program process of the plurality of different groups.

8. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining, for at least one of the plurality of different groups, a number of unique source program processes from the plurality of different groups with connections directed to target program processes of the at least one of the plurality of different groups.

9. The method of claim 1 , wherein analyzing the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups includes determining a total number of unique program processes from a first group of the plurality of different groups with an outgoing connection to a program process of a second group of the plurality of different groups.

10. The method of claim 1 , further comprising:
receiving an application service definition, wherein the application service definition is based on a condition comparing at least one of the one or more interaction metrics to a threshold value; and
identifying one or more of the graph nodes in the graph representation that match the condition of the application service definition.

11. The method of claim 10 , further comprising:
labeling the identified one or more of the graph nodes in the graph representation that match the condition of the application service definition with a category defined by the application service definition.

12. A system, comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive identifications of program processes executing on an information technology environment;
cluster the identified program processes into a plurality of different groups, wherein the identified program processes that are clustered are processes of one or more application programs and the plurality of different groups represent different application service groups and each of the different application service groups includes one or more similar program processes;
receive identifications of interactions between at least a portion of the program processes;
analyze the identified interactions to determine one or more interaction metrics between different group pairs in the plurality of different groups; and
generate a graph representation that includes at least a portion of the different application service groups as graph nodes in the graph representation and includes one or more graph edges connecting one or more pairs included in the graph nodes, where the one or more graph edges are determined to be included in the graph representation based on the one or more interaction metrics.

13. The system of claim 12 , wherein the identified program processes are clustered into the plurality of different groups including by applying a prediction model configured to utilize a name, a path, and arguments for each of the program processes.

14. The system of claim 13 , wherein the prediction model is generated including by determining similarity metrics using a training dataset to identify unique clusters, and the unique clusters are randomly sampled to extract a threshold number of samples from each unique cluster of the identified unique clusters.

15. The system of claim 13 , wherein the prediction model is updated by sampling prediction results and adding the sampled prediction results to the prediction model.

16. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups including by being caused to determine, for at least one of the plurality of different groups, a number of unique source program processes from the at least one of the plurality of different groups with at least one outgoing connection directed to a target program process of the plurality of different groups.

17. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the different group pairs in the plurality of different groups including by being caused to determine, for at least one of the plurality of different groups, a number of unique source program processes from the plurality of different groups with connections directed to target program processes of the at least one of the plurality of different groups.

18. The system of claim 12 , wherein the one or more processors are caused to analyze the identified interactions to determine the one or more interaction metrics between the differ

Assignees

• Servicenow Inc

Inventors

• Bitterfeld Robert
• Surapaneni Dinesh Kumar Kishorkumar
• Garty Asaf
• Jayaraman Baskar

Classifications

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title