Shared machine learning model for application discovery

Patent metadata

Field	Value
Publication number	US-11461673-B2
Application number	US-201916594748-A
Country	US
Kind code	B2
Filing date	Oct 7, 2019
Priority date	Oct 7, 2019
Publication date	Oct 4, 2022
Grant date	Oct 4, 2022

Abstract

A system may include persistent storage configured to store: a shared classification model including a plurality of classifiers based on training data from a plurality of managed networks, and a representation of a plurality of software applications executable computing devices within a particular managed network. The system may also include a discovery application configured to perform operations including obtaining attributes of a software process. The operations may also include determining, by way of the shared classification model and based on the attributes, a suggested classifier of the plurality of classifiers and determining, by way of the suggested classifier and based on the attributes, a suggested classification for the software process. The operations may further include receiving an indication that the suggested classification has been accepted, based on receiving the indication, updating the representation to indicate the suggested classification, and storing, in the persistent storage, the representation as updated.

First claim

What is claimed is:

1. A computing system comprising:
persistent storage disposed within a remote network management platform and configured to store:
a shared classification model comprising a plurality of classifiers configured to classify software applications among a plurality of predetermined categories, wherein the plurality of classifiers are based on training data acquired from a plurality of managed networks associated with the remote network management platform; and
a representation of a plurality of software applications executable on one or more computing devices within a particular managed network; and

a discovery application configured to perform operations comprising:
obtaining one or more attributes of a software process corresponding to a software application of the plurality of software applications;
determining, by way of the shared classification model and based on the one or more attributes, a suggested classifier of the plurality of classifiers;
determining, by way of the suggested classifier and based on the one or more attributes, a suggested classification for the software process;
receiving an indication that the suggested classification has been accepted;
based on receiving the indication, updating the representation to indicate the suggested classification for the software application; and
storing, in the persistent storage, the representation as updated.

2. The computing system of claim 1 , wherein the plurality of classifiers comprises:
a rule-based classifier based on first training data obtained from a first managed network of the plurality of managed networks, wherein the first training data comprises a rule-based discovery pattern; and
a machine learning classifier based on second training data obtained from a second managed network of the plurality of managed networks, wherein the second training data comprises one or more pairs of (i) data indicating a respective software process and one or more attributes corresponding to the respective software process and (ii) a classification for the respective software process.

3. The computing system of claim 1 , wherein the operations further comprise:
obtaining one or more additional attributes of an additional software process corresponding to an additional software application of the plurality of software applications;
determining, by way of the shared classification model and based on the one or more additional attributes, an additional suggested classifier of the plurality of classifiers;
determining, by way of the additional suggested classifier and based on the one or more additional attributes, an additional suggested classification for the additional software process;
receiving an additional indication that the additional suggested classification does not match a preferred classification associated by the particular managed network with the additional software application;
based on the additional indication, obtaining, from the particular managed network, a revised classifier configured to generate the preferred classification based on the one or more additional attributes;
updating the shared classification model by (i) incorporating into the shared classification model the revised classifier and (ii) reconfiguring the shared classification model to suggest the revised classifier for software processes associated with the one or more additional attributes; and
storing the shared classification model as updated in the persistent storage.

4. The computing system of claim 3 , wherein the revised classifier comprises a modified version of the additional suggested classifier that reconfigures the additional suggested classifier to generate the preferred classification based on the one or more additional attributes.

5. The computing system of claim 3 , wherein the revised classifier is generated independently of the additional suggested classifier.

6. The computing system of claim 3 , wherein the suggested classifier is a rule-based classifier, and wherein the revised classifier comprises a rule-based discovery pattern that implements logic configured to generate the preferred classification based on the one or more additional attributes.

7. The computing system of claim 3 , wherein the suggested classifier is a machine learning (ML) classifier, and wherein the revised classifier comprises training data for the ML classifier, wherein the training data comprises (i) data indicating the additional software process and the one or more additional attributes and (ii) the preferred classification.

8. The computing system of claim 3 , wherein the revised classifier comprises a rule-based discovery pattern that implements logic configured to generate the preferred classification based on the one or more additional attributes, and wherein updating the shared classification model comprises:
obtaining, from one or more managed networks of the plurality of managed networks, a plurality of data indicating (i) a plurality of software processes and (ii), for each respective software process of the plurality of software processes, one or more attributes corresponding to the respective software process;
applying the rule-based discovery pattern to the plurality of data to identify therein a subset of the plurality of software processes having the preferred classification; and
training a machine learning classifier based on the subset of the plurality of software processes and the one or more attributes corresponding to each software process of the subset to (i) generate the preferred classification based on the one or more additional attributes and (ii) suggest the revised classifier for software processes associated with the one or more additional attributes.

9. The computing system of claim 1 , wherein the shared classification model comprises a machine learning (ML) model trained to determine a respective suggested classifier of the plurality of classifiers for a respective software process based on one or more corresponding attributes of the respective software process, and wherein determining the suggested classifier for the software process comprises:
providing the one or more attributes as input to the ML model; and
receiving as output from the ML model the suggested classifier.

10. The computing system of claim 1 , wherein the one or more attributes comprise one or more of: (i) a name of the software process, (ii) a command used to invoke execution of the software process, (iii) parameters provided to the software process as input, or (iv) content of a directory associated with the software process.

11. The computing system of claim 1 , wherein obtaining the one or more attributes of the software process comprises:
identifying a plurality of unclassified software processes detected within the particular managed network, wherein each respective unclassified software process of the plurality of unclassified software processes is associated with one or more corresponding attributes determined by a discovery process, and wherein the respective unclassified software process and the one or more corresponding attributes are stored in the persistent storage as part of the representation; and
selecting a particular unclassified software process of the plurality of unclassified software processes for classification by way of the shared classification model; and
retrieving, from the persistent storage, the one or more corresponding attributes associated with the particular unclassified software process.

12. The computing system of claim 1 , wherein the software process is associated with a first classification generated by a discovery process that is not part of the shared classification

Assignees

• Servicenow Inc

Inventors

• Bitterfeld Robert
• Aron Aviya
• Garty Asaf
• Solomon Bary

Classifications

• G06N20/00

  Machine learning · CPC title

• G06N20/20

  Ensemble learning · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L41/0853

  by actively collecting configuration information or by backing up configuration information · CPC title