Automatic service discovery

Patent metadata

Field	Value
Publication number	US-12184742-B1
Application number	US-202318112860-A
Country	US
Kind code	B1
Filing date	Feb 22, 2023
Priority date	Feb 22, 2023
Publication date	Dec 31, 2024
Grant date	Dec 31, 2024

Abstract

Data communication between a plurality of computer processes are tracked. Relationships between the plurality of computer processes are classified including by analyzing the data communication between the plurality of computer processes using a machine learning model. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered.

First claim

What is claimed is:

1. A method comprising:
tracking data communication between a plurality of computer processes executing on entities of a computer network;
classifying relationships between the plurality of computer processes including by analyzing the data communication between the plurality of computer processes using a machine learning model to identify a subset of connections of the plurality of computer processes that are relevant to service discovery based on connection confidence scores of the connections of the plurality of computer processes, wherein an individual connection confidence score included in the connection confidence scores identifies a likelihood a corresponding connection is relevant to service discovery; and
based at least in part on the classified relationships between the plurality of computer processes including the subset of connections identified as relevant to service discovery, automatically discovering an existence of a service provided by a functional group of computer processes included in the plurality of computer processes executing on the entities of the computer network.

2. The method of claim 1 , wherein the connection confidence scores are determined using the machine learning model.

3. The method of claim 1 , wherein automatically discovering the existence of the service provided by the functional group of computer processes includes automatically identifying an entry point to the automatically discovered service provided by the functional group of computer processes.

4. The method of claim 1 , further comprising creating a set of logical rules associated with the automatically discovered service provided by the functional group of computer processes.

5. The method of claim 1 , further comprising:
determining, using the machine learning model, that at least one computer process of the plurality of computer processes is not utilized by any service;
generating a visual map associated with the service provided by the functional group of computer processes, the visual map indicating the at least one computer process of the plurality of computer processes not utilized by any service; and
transmitting, for display at a user device, the visual map.

6. The method of claim 1 , further comprising automatically generating a visual map associated with the service provided by the functional group of computer processes.

7. The method of claim 6 , wherein the automatically generated visual map includes nodes corresponding to one or more of the plurality of computer processes and connections between the nodes corresponding to network connections between the nodes corresponding to the one or more of the plurality of computer processes.

8. The method of claim 6 , wherein the automatically generated visual map is an interactive map.

9. The method of claim 1 , wherein the machine learning model is trained using properties associated with the tracked data communication between the plurality of computer processes.

10. The method of claim 9 , wherein the properties associated with the tracked data communication include connection properties and process properties.

11. The method of claim 10 , wherein the connection properties include a connection direction, a protocol, an address, or a port, and wherein the process properties include access privileges, a user account, a process type, a process name, or a process priority.

12. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
track data communication between a plurality of computer processes executing on entities of a computer network;
classify relationships between the plurality of computer processes including by analyzing the data communication between the plurality of computer processes using a machine learning model to identify a subset of connections of the plurality of computer processes that are relevant to service discovery based on connection confidence scores of the connections of the plurality of computer processes, wherein an individual connection confidence score included in the connection confidence scores identifies a likelihood a corresponding connection is relevant to service discovery; and
based at least in part on the classified relationships between the plurality of computer processes including the subset of connections identified as relevant to service discovery, automatically discover an existence of a service provided by a functional group of computer processes included in the plurality of computer processes executing on the entities of the computer network.

13. The system of claim 12 , wherein the connection confidence scores are determined using the machine learning model.

14. The system of claim 12 , wherein automatically discovering the existence of the service provided by the functional group of computer processes includes automatically identifying an entry point to the automatically discovered service provided by the functional group of computer processes.

15. The system of claim 12 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to create a set of logical rules associated with the automatically discovered service provided by the functional group of computer processes.

16. The system of claim 12 , wherein tracking the data communication includes identifying one or more network connections between the plurality of computer processes.

17. The system of claim 12 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to automatically generate a visual map associated with the service provided by the functional group of computer processes.

18. The system of claim 17 , wherein the automatically generated visual map includes nodes corresponding to one or more of the plurality of computer processes and connections between the nodes corresponding to network connections between the nodes corresponding to the one or more of the plurality of computer processes.

19. The system of claim 12 , wherein the machine learning model is trained using properties associated with the tracked data communication between the plurality of computer processes, and wherein the properties associated with the tracked data communication include connection properties and process properties.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
tracking data communication between a plurality of computer processes executing on entities of a computer network;
classifying relationships between the plurality of computer processes including by analyzing the data communication between the plurality of computer processes using a machine learning model to identify a subset of connections of the plurality of computer processes that are relevant to service discovery based on connection confidence scores of the connections of the plurality of computer processes, wherein an individual connection confidence score included in the connection confidence scores identifies a likelihood a corresponding connection is relevant to service discovery; and
based at least in part on the classified relationships between the plurality of computer processes including the subset of

Assignees

• Servicenow Inc

Inventors

• Mengel Barel
• Tal Hail
• Bhagat Aakash Umeshbhai
• Sityon Arik
• Bitterfeld Robert
• Shpatz Noy
• Ghanalinga Murthy Darshan
• Gupta Atul
• Goel Priyanka
• Harel Dov
• Epshtein Tal
• Subramaniam Sreenevas
• Jain Shruti

Classifications

• H04L67/51 Primary

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title