Application topology discovery

Abstract

A computer-implemented method for identifying an application topology includes identifying a sandbox environment corresponding to an application of interest, analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicative of a first topology, identifying a production system corresponding to the application of interest, querying the production system to identify a set of structural dependencies indicative of a second topology, and creating a complete topology of the cloud application by combining the first topology and the second topology. Computer program products and computer systems for identifying an application topology are additionally disclosed herein.

Description

Background Technology

[0001] This invention generally relates to the field of cloud computing, and more particularly to the discovery of the topology of existing cloud computing environments.

[0002] The communication topology of a cloud application consists of the set of services used within the application and their external dependencies or components, the API endpoints supported by the components, the source-to-target communication links between them, and the API endpoint(s) of the target component to which the source component connects in each link. Fine-grained topology information can be critical in troubleshooting and optimizing cloud applications running in production. Known solutions for discovering or inferring the topology of an application include using cloud service meshes, service mesh observability tools, and open tracing tools. These types of tools require a certain level of instrumentation within the application, particularly in production environments, which can be considered intrusive. In various cases, the “physical” topology of a production environment may be available or discoverable based on knowledge of the components within the system, but information about services or components in the production environment that are not physically apparent may not be readily available. Production owners / managers may be reluctant to make such connectivity information available, especially in scenarios where the application receives or manages sensitive information. The increasing prevalence of distributed applications increases the need for topology analysis that can be inferred and discovered beyond the physical connections within the application. Summary of the Invention

[0003] As disclosed herein, a computer-implemented method for identifying application topologies includes identifying a sandbox environment corresponding to an application of interest. Once the sandbox environment is identified, the method continues by analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment that indicate a first topology. The method also includes identifying a production system corresponding to the application of interest and querying the production system to identify a set of structural dependencies indicating a second topology. The method concludes by combining the first and second topologies to create a complete topology for the cloud application. This computer-implemented method for identifying application topologies enables topology discovery without requiring invasive instrumentation or extensive analysis of the production environment. The method may further include matching services in the sandbox environment with services in the production system by matching infrastructure information used by services in the sandbox environment with that used by services in the production system. Matching services in the sandbox environment with services in the production system in this manner allows the establishment of correspondences between services present in the sandbox environment accessible to its topology and services in the production system that may be more difficult to analyze, ultimately allowing the corresponding communication links to be identified. The computer-implemented method for identifying application topology may further include using service-to-service communication links in a sandbox environment to establish corresponding links between services in the production system. Matching communication links in the sandbox environment with services existing in the production system enables the inference of links in the production system's topology without requiring instruments in the production system.

[0004] A computer program product for identifying application topologies includes one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media. The program instructions include instructions for identifying a sandbox environment corresponding to an application of interest. The computer program product also includes instructions for analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology. The computer program product further includes instructions for identifying a production system corresponding to the application of interest, and for querying the production system to identify a set of structural dependencies indicating a second topology. The computer program product further includes instructions for creating a complete topology for a cloud application by combining the first and second topologies. The computer program product enables the execution of methods for identifying application topologies without requiring invasive instrumentation or extensive analysis of the production environment. The computer program product may further include instructions for matching services in the sandbox environment to services in the production system by matching infrastructure information used by services in the sandbox environment with that used by services in the production system. The computer program product for identifying application topologies may further include instructions for establishing corresponding links between services in the production system using service-to-service communication links in the sandbox environment.

[0005] As disclosed herein, a computer system for identifying application topologies includes one or more computer processors, one or more computer-readable storage media, and program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors. The program instructions include instructions for identifying a sandbox environment corresponding to an application of interest. The computer system also includes instructions for analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology. The computer system further includes instructions for identifying a production system corresponding to the application of interest and for querying the production system to identify a set of structural dependencies indicating a second topology. The computer program product enables the execution of methods for identifying application topologies without requiring invasive instrumentation or extensive analysis of the production environment. The computer system may further include instructions for matching services in the sandbox environment with services in the production system by matching infrastructure information used by the services. The computer system for identifying application topologies may further include instructions for establishing corresponding links between services in the production system using service-to-service communication links in the sandbox environment. Attached Figure Description

[0006] Figure 1 A cloud computing environment according to an embodiment of the present invention is described;

[0007] Figure 2 An abstract model layer according to an embodiment of the present invention is described;

[0008] Figure 3 This is a block diagram describing a topology analysis system according to at least one embodiment of the present invention;

[0009] Figure 4 This is a flowchart describing a topology discovery method according to at least one embodiment of the present invention;

[0010] Figure 5 A block diagram depicting a horizontal topology according to at least one embodiment of the present invention;

[0011] Figure 6 A block diagram depicting a vertical topology according to an exemplary embodiment of the present invention is provided;

[0012] Figure 7 A complete topology according to an exemplary embodiment of the present invention is depicted; and

[0013] Figure 8 This is a block diagram of the components of a computing system that performs an image analysis system according to an embodiment of the present invention. Detailed Implementation

[0014] Embodiments of the present invention analyze and build existing topologies by passively querying and equipping sandbox environments (such as testing, development, and staging environments) without performing any intrusive analysis of the corresponding production systems.

[0015] The present invention will now be described in detail with reference to the accompanying drawings. Implementations of embodiments of the invention may take various forms, and exemplary implementation details will be discussed subsequently with reference to the drawings.

[0016] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0017] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage devices, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0018] The characteristics are as follows:

[0019] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring manual interaction with the service provider.

[0020] Extensive network access: Capabilities are available on the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0021] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Location independence has significance because consumers typically cannot control or know the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0022] Rapid and flexible: In some situations, capacity can be automatically and flexibly provided to rapidly scale outwards and rapidly release to scale inwards. For consumers, the capacity available for provision often appears unlimited and can be purchased at any time and in any quantity.

[0023] Measurement services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both the providers and consumers of the services being utilized.

[0024] The service model is as follows:

[0025] Software as a Service (SaaS): The capability offered to consumers is the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from various client devices via thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0026] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer onto cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of possible application hosting environments.

[0027] Infrastructure as a Service (IaaS): This provides consumers with the capability to deliver processing, storage, networking, and other basic computing resources that enable them to deploy and run any software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they do have control over the operating system, storage, deployed applications, and possibly limited control over chosen networking components (e.g., host firewalls).

[0028] The deployment model is as follows:

[0029] Private cloud: Cloud infrastructure operated solely by an organization. It can be managed by the organization or a third party, and can exist inside or outside the organization.

[0030] Community cloud: Cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist inside or outside the organization.

[0031] Public cloud: Cloud infrastructure available to the general public or large industrial groups and owned by organizations that sell cloud services.

[0032] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursts for load balancing between clouds).

[0033] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure of a network of interconnected nodes.

[0034] Now for reference Figure 1 The diagram illustrates an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate. These local computing devices include, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or autonomous mobile computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, without requiring cloud consumers to maintain resources on their local computing devices. It should be understood that... Figure 1 The types of computing devices 54A-54N shown are for illustrative purposes only, and computing node 10 and cloud computing environment 50 can communicate with any type of computing device on any type of network and / or network-addressable connection (e.g., using a web browser).

[0035] Now for reference Figure 2 This demonstrates a cloud computing environment of 50 ( Figure 1 This provides a collection of functional abstraction layers. It should be understood beforehand that... Figure 2 The components, layers, and functions shown are for illustrative purposes only, and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0036] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a host 61; a server 62 based on a RISC (Reduced Instruction Set Computer) architecture; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0037] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage device 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0038] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking when utilizing resources in the cloud computing environment, as well as billing or invoicing for consuming these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, and protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources, where future needs are anticipated according to the SLA.

[0039] Workload 90 provides examples of functionalities that can be leveraged in a cloud computing environment. Examples of workloads and functionalities that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics and processing 94; transaction processing 95; and topology discovery 96.

[0040] Figure 3 This is a block diagram illustrating a topology analysis system 300 according to at least one embodiment of the present invention. As depicted, the topology analysis system 300 includes a computing system 310, a sandbox environment 320, a production application 330, and a network 340. The topology analysis system 300 can be configured to perform non-intrusive analysis of the topology of cloud applications.

[0041] The computing system 310 may be a desktop computer, a laptop computer, a dedicated computer server, or any other computer system known in the art. In some embodiments, the computing system 310 represents a computer system that utilizes a cluster of computers as a single, seamless pool of resources. Typically, the computing system 310 represents any electronic device or combination of electronic devices capable of receiving and transmitting data, as per [the relevant documentation / concept]. Figure 8 In more detail, the computing system 310 may include internal and external hardware components, such as those described above. Figure 8 To describe and depict in further detail.

[0042] As depicted, computing system 310 includes analytics application 315. Analytics application 315 may be an application configured to analyze the topology of a cloud production application. In at least one embodiment, analytics application 315 is configured to analyze cloud applications in a non-intrusive manner without requiring access to sensitive data. Typically, analytics application 315 is configured to perform topology discovery methods. Regarding... Figure 4 An example of a suitable topology discovery method is described.

[0043] As depicted, the analysis application 315 includes a horizontal analysis component 316, a vertical analysis component 317, and a topology building component 318. Each of the horizontal analysis component 316, vertical analysis component 317, and topology building component 318 may include its own dedicated memory unit or processing unit, or alternatively may utilize shared memory units and processing units housed within the computing system 310 or the analysis application 315. The horizontal analysis component 316, vertical analysis component 317, and topology building component 318 may be configured in combination to perform certain steps of a topology discovery method, such as regarding... Figure 4 The described topology discovery method.

[0044] Horizontal analysis component 316 is configured to analyze sandbox environment 320 to identify a set of communication links between services, and may include identifying one or more services contained within the sandbox environment. In at least some embodiments, the horizontal analysis component is configured to determine which of the identified one or more services communicate with each other to establish a set of communication links. Horizontal analysis component 316 may also be configured to monitor any instrumentation tools present in the application. In at least some embodiments, horizontal analysis component 316 is also configured to identify existing communication links using static analysis of code elements such as environment variables. The horizontal analysis component may be additionally configured to identify one or more service names corresponding to the identified one or more services contained within the sandbox environment.

[0045] Vertical analysis component 317 can be configured to query production application 330 to identify a set of structural dependencies. In at least one embodiment, vertical analysis component 317 is configured to send queries to one or more components of production application 330 to request information about one or more components of the production application. Vertical analysis component 317 can also be configured to inherit APIs from the corresponding components in sandbox environment 320 and source-to-target links based on the corresponding source-to-target links in the sandbox components for each component. Vertical analysis component 317 can also be configured to query production application 330 for any of the following: services, pods, deployments, daemon sets, replica sets, stateful sets, nodes, or egress network policies. In at least some embodiments, vertical analysis component 317 is configured to request the names of components in production application 330 and the IDS of container images supporting services in the production system.

[0046] Topology building component 318 can be configured to combine horizontal and vertical topologies provided by horizontal analysis application 316 and vertical analysis application 317. In at least one embodiment, topology building component 318 is configured to match the IDs of container images supporting services in sandbox environment 320 with the IDs of container images supporting services in production application 330. Topology building component 318 can be configured to match the names of services in sandbox environment 320 with the names of services in production application 330. In at least one embodiment, topology building component 318 is configured to calculate network fingerprints of traffic originating from services in sandbox environment 320 and production application 330. In such embodiments, topology building component 318 can be further configured to perform a similarity matching algorithm on the network fingerprints. Topology building component 318 can also be configured to request feedback or additional information from the user regarding the constructed topology.

[0047] Sandbox environment 320 may correspond to a test environment designed to represent a cloud application of interest. In at least some embodiments, sandbox environment 320 is an environment in which code for a cloud application can be tested without exposing the active server and its data to potentially corruptible changes or errors. In some embodiments, sandbox environment 320 corresponds to a hierarchical environment designed to represent a cloud application of interest. A hierarchical environment may be a near-perfect replica of a production environment designed to be used for testing code, building, or updating to ensure quality in a production-like environment before deploying the application. In some embodiments, sandbox environment 320 corresponds to a development environment. A development environment corresponds to a set of processes and tools for testing and debugging a cloud application of interest. A development environment is sometimes referred to as an integrated development environment or IDE, and it may include any of a compiler, interpreter, source code editor, build automation toolset, and debugger. In some embodiments, sandbox environment 320 may represent some combination of hierarchical environment, development environment, and test environment.

[0048] Production application 330 corresponds to a functional cloud application. Production application 330 can be the final version of the cloud application represented by sandbox environment 320. (See reference...) Figure 6 and 7 Exemplary embodiments for suitable production applications are described.

[0049] Network 340 may be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of both, and may include wired, wireless, or fiber optic connections. Generally, network 340 may be any combination of connections and protocols that support communication between computing system 310, sandbox environment 320, and production application 330.

[0050] Figure 4This is a flowchart describing a topology discovery method 400 according to at least one embodiment of the present invention. As depicted, the topology discovery method 400 includes identifying (410) a sandbox environment corresponding to a cloud application, analyzing (420) the sandbox environment to identify a set of communication links between services, identifying (430) a production system corresponding to the cloud application, querying (440) the production system to identify a set of structural dependencies, and creating (450) a complete topology of the cloud application by combining horizontal and vertical topologies. The topology discovery method 400 can be used for non-intrusive analysis of the topology of cloud applications.

[0051] The identifier (410) corresponding to the sandbox environment of the cloud application may include receiving or identifying a request to analyze a specified cloud application or a cloud application of interest. In at least some embodiments, the sandbox environment corresponds to a test environment designed to represent the cloud application of interest. A test environment provides an environment in which code can be tested with respect to the cloud application without exposing the active server and its data to potentially harmful changes or errors. In some embodiments, the sandbox environment corresponds to a hierarchical environment designed to represent the cloud application of interest. A hierarchical environment may be a near-perfect replica of a production environment designed to be used for testing code, building, or updating to ensure quality in a production-like environment before deploying the application. In some embodiments, the sandbox environment corresponds to a development environment. A development environment corresponds to a set of processes and tools for testing and debugging the cloud application of interest. A development environment is sometimes referred to as an integrated development environment or IDE, and it may include any of a compiler, interpreter, source code editor, build automation toolset, and debugger. The identifier (410) corresponding to the sandbox environment of the cloud application may additionally include sending a request for access to the appropriate sandbox environment. In such embodiments, a permission request may be sent to the owner / controller of the cloud application and the corresponding sandbox environment. In at least some embodiments, the identifier (410) corresponding to the sandbox environment of the cloud application also includes the sandbox environment that best represents the cloud application. In at least some embodiments, such as regarding Figure 3 The horizontal analysis component 316 described is configured to perform a process associated with the sandbox environment corresponding to the identifier (420) of the cloud application.

[0052] Analyzing the (420) sandbox environment to identify a set of communication links between services may include identifying one or more services contained within the sandbox environment. The set of communication links between services may alternatively be referred to herein as a horizontal topology. In another embodiment, the set of communication links between services may alternatively be referred to as a first topology. It should be understood that the terms horizontal topology or first topology do not indicate the physical direction of the topology or the order in which the topologies appear. The analysis (420) sandbox environment may also include determining which of the identified one or more services communicate with each other to establish a set of communication links. In at least one embodiment, analyzing the (420) sandbox environment includes probing a cloud application for connectivity visibility using existing service mesh observability tools. A service mesh is a dedicated infrastructure layer built into an application that is configured to control how different parts of the application communicate with each other. In embodiments where the cloud application of interest includes a service mesh layer, analyzing the (420) sandbox environment includes analyzing the service mesh to identify the communication infrastructure between one or more services contained within the sandbox environment. Analyzing the (420) sandbox environment to identify a set of communication links between services may include identifying existing communication links using static analysis of code elements such as environment variables. In some embodiments, analyzing (420) the sandbox environment includes analyzing Domain Name System (DNS) queries to identify existing communication links between services. Analyzing (420) the sandbox environment may additionally include identifying one or more service names corresponding to one or more services contained within the sandbox environment. In at least one embodiment, analyzing (420) the sandbox environment includes identifying IDs of container images that back up services within the sandbox environment. In at least some embodiments, such as regarding... Figure 3 The horizontal analysis component 316 described is configured to perform processes associated with the analysis (420) sandbox environment.

[0053] The identifier (430) corresponding to the production system of the cloud application may include querying information about the corresponding production system from the cloud application or the corresponding sandbox environment. In at least one embodiment, the identifier (430) corresponding to the production system of the cloud application includes an identifier connected to or associated with at least one of one or more services contained within the sandbox environment. The identifier (430) corresponding to the production system of the cloud application may include receiving information identifying / indicating the production system associated with the cloud application. In at least some embodiments, the identifier (430) corresponding to the production system of the cloud application includes requesting access to the production system or attempting to establish a connection with the production system, enabling the sending / receiving of queries and query responses. In at least some embodiments, such as regarding Figure 3 The vertical analysis component described, such as 317, is configured to perform processes associated with the production system corresponding to the cloud application and the identifier (430).

[0054] Querying (440) the production system to identify a set of structural dependencies may include sending queries to one or more components of the production system to request information about one or more components of the production system. The set of structural dependencies may also be referred to as a vertical topology. In another embodiment, the set of structural dependencies (or vertical topologies) may be referred to as a second topology. It should be understood that the terms vertical topology or second topology do not indicate the physical direction of the topology or the order in which the topologies appear. In at least one embodiment, querying (440) the production system includes, for each component in the production system, inheriting an API from the corresponding component in the sandbox environment, and inheriting source-target links based on the corresponding source-target links in the sandbox component. In other words, in embodiments where a component in the production system does indeed have a corresponding component existing in the sandbox environment, it is inferred that the component also has the same connection links and API as the corresponding sandbox component. In such embodiments, querying (440) the production system to identify a set of structural dependencies includes updating the set of structural dependencies to reflect the API indicated by the corresponding component in the sandbox environment. In the absence of a corresponding component in the sandbox environment, the component may be marked as missing information or ignored. Querying (440) the production system to identify the vertical topology may also include querying the production system for any of the following: services, pods, deployments, daemon sets, replica sets, stateful sets, node or egress network policies. Querying the production system to identify the vertical topology may additionally include requesting the names of components in the production system. In at least some embodiments, querying (440) the production system also includes requesting the ID of a container image support service in the production system. In at least some embodiments, such as regarding... Figure 3 The vertical analysis component 317 described is configured to perform and query (440) processes associated with the production system to identify a set of structural dependencies.

[0055] Creating a complete topology (450) for a cloud application by combining horizontal and vertical topologies may include combining the set of identified communication links identified in step 420 and the set of structural dependencies identified in step 440 to create a complete topology for the cloud application. Creating a complete topology (450) for the cloud application may include matching the IDs of container images supporting services in the sandbox environment with the IDs of container images supporting services in the production application. In additional embodiments, such as those where container image IDs are unavailable, creating a complete topology (450) for the cloud application may include matching the names of services in the sandbox environment with the names of services in the production application. Creating a complete topology (450) for the cloud application may include calculating network fingerprints of traffic originating from services in the sandbox environment and the production application. Such embodiments may additionally include performing a similarity matching algorithm on the network fingerprints. Creating a complete topology (450) for the cloud application may additionally include transmitting information about communication links in the sandbox environment to the production environment. An example of a process for connecting two topologies could be to discover similar nodes from the structural properties and connectivity of nodes associated with the vertical topology (e.g., using structural similarity of local neighborhoods to derive pairwise similarity scores for nodes in two different graphs), and then infer the properties of production nodes associated with the horizontal topology from similar sandbox nodes. In some embodiments, such as those where some query information is incomplete, the complete topology can be expanded, edited, or adjusted by an expert. In at least some embodiments, such as regarding Figure 3 The topology building component described, such as topology building component 318, is configured to perform the process associated with creating the complete topology of the application (450).

[0056] about Figure 5 , Figure 6 and Figure 7The accompanying drawings depict exemplary embodiments of an application and its corresponding services and service deployments within that application. It should be understood that while the depicted embodiments include various specific services and named deployments, and show connections between these specific services and deployments, any number of applications may be suitable for analysis using the methods discussed herein, and should not be limited to applications containing only a strict combination of the services discussed with respect to these figures. Rather, the depicted and discussed services and service deployments represent any application or service present within an application responsible for sending and / or receiving data within a certain capacity associated with said application. Regarding the described embodiments, each service may perform various operations on the data, or may not operate on the data, or may operate anywhere in between; what will be analyzed, in relation to the methods disclosed herein, is the mere existence of these services / deployments / applications, and their communication with each other. Regarding communication / connections between various services and deployments, the methods disclosed herein do not analyze data within any communication conducted via these connections, but rather detect the existence of these connections to determine which services within the application communicate with each other. Therefore, it should be understood that regarding Figure 5 , Figure 6 and Figure 7 The services, deployments, and other various structures / applications described are intended to represent applications according to a single embodiment of the invention, and are not intended to represent a comprehensive list of services that can be analyzed using the methods herein, nor a list of required components.

[0057] Figure 5 A block diagram of a horizontal topology 500 according to at least one embodiment of the present invention is shown. The described embodiments include a collection of sample services that may exist in a sandbox environment, but should be considered merely one example of a many combinations of services that may exist in other embodiments of the invention. As depicted, the horizontal topology 500 includes a reporting service 510, a statistics service 520, a transaction service 530, a details service 540, a homepage service 550, a rating service 560, and a comment service 570. Figure 5 The data flow between the depicted services is also described. As depicted, reporting service 510 provides report data to statistics service 520. Statistics service 520 processes the received report data and provides statistics and analysis to transaction service 530. Homepage service 550 provides page information to both comment service 570 and detail service 540. Comment service 570 processes the received page information and provides comment information to rating service 560. Detail service 540 processes the received page information and provides detailed information to transaction service 530.

[0058] Figure 6A block diagram of a vertical topology 600 according to an exemplary embodiment of the present invention is shown. The described embodiments include a set of sample structures and dependencies that can exist in production applications, but should only be considered as one example of a many combinations of structures and dependencies that can exist in additional embodiments of the invention. As depicted, the vertical topology 600 includes containers 610, nodes 620, comment deployments 630, rating deployments 640, homepage deployments 650, detail deployments 660, report deployments 670, statistics deployments 680, and transaction deployments 690. Containers 610 (610A, 610B, 610C) may each represent a single instance of a process / microservice running in the cluster. Nodes 620 can communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds or combinations thereof as described above. It is understood that nodes 620 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser). In some embodiments, each depicted node 620 may correspond to a unique node; in other embodiments, some of the depicted nodes 620 may correspond to the same node. It should be understood that deployments are depicted side-by-side with their corresponding nodes and pods, and which deployments are associated with each node may vary depending on the embodiment. Comment deployments 630 (630A, 630B, 630C) correspond to a specific deployment (or multiple deployments) of one or more comment services, such as those related to commenting. Figure 5 The description of the review service, rating deployment 640 corresponds to a specific deployment of the rating service, such as regarding... Figure 5 The described rating service, homepage deployment 650 corresponds to a specific deployment of the homepage service, such as regarding... Figure 5 The homepage service described, with deployment details 660 corresponding to a specific deployment of the detailed service, such as regarding... Figure 5 The described service details, report deployment 670 corresponds to a specific deployment of the reporting service, such as regarding... Figure 5 The described reporting service, statistical deployment 680 corresponds to a specific deployment of the statistical service, such as regarding... Figure 5 The described statistics service, transaction deployment 690 corresponds to a specific implementation of the transaction service, such as regarding Figure 5 The described transaction services. As depicted, Vertical Topology 600 does not include comprehensive information about the connections between services or deployments.

[0059] Figure 7A complete topology 700 according to an exemplary embodiment of the present invention is described. As depicted, the complete topology 700 represents a combination of horizontal topology 500 and vertical topology 600. Dashed lines and corresponding labels around the vertical topology components (various specific deployments) indicate services from their corresponding horizontal topologies, and arrows in the complete topology 700 correspond to communication links between the indicated services. Typical sandboxes are built with minimal configuration and resources to provide a way to train and gain realistic, hands-on experience without accessing product deployments that may also contain sensitive data. As depicted, Figure 5 The services in the horizontal topology are already based on service name and Figure 6 Deployments in the vertical topology are matched, but alternatively, container image IDs can be used for matching.

[0060] Figure 8 A block diagram depicting the components of a computing system 110 according to an illustrative embodiment of the present invention is provided. It should be understood that... Figure 8 This is merely an illustration of an implementation and does not imply any limitation on the environments in which different embodiments may be implemented. Many modifications can be made to the described environment.

[0061] As shown in the figure, computer 800 includes a communication structure 802 that provides communication between (multiple) computer processors 804, memory 806, persistent storage device 808, communication unit 812, and (multiple) input / output (I / O) interfaces 814. The communication structure 802 can be implemented using any architecture designed to transfer data and / or control information between processors (such as microprocessors, communication and network processors, etc.), system memory, peripheral devices, and any other hardware components within the system. For example, the communication structure 802 can be implemented using one or more buses.

[0062] Memory 806 and persistent storage device 808 are computer-readable storage media. In this embodiment, memory 806 includes random access memory (RAM) 816 and cache memory 818. Typically, memory 806 may include any suitable volatile or non-volatile computer-readable storage medium.

[0063] One or more programs may be stored in persistent storage device 808 for access and / or execution by one or more of the respective computer processors 804 via one or more memories of memory 806. In this embodiment, persistent storage device 808 includes a magnetic hard disk drive (MDD). As an alternative to or supplement to a MDD, persistent storage device 808 may include a solid-state drive (SSD), a semiconductor storage device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0064] The media used in persistent storage device 808 can also be removable. For example, a removable hard disk drive can be used in persistent storage device 808. Other examples include optical discs and disks, thumb drives and smart cards, which are inserted into the drive for transfer to another computer-readable storage medium that is also part of persistent storage device 808.

[0065] In these examples, communication unit 812 provides communication with other data processing systems or devices. In these examples, communication unit 812 includes one or more network interface cards. Communication unit 812 can provide communication by using one or both of physical and wireless communication links.

[0066] Multiple I / O interfaces 814 allow data input and output to other devices that can be connected to computer 800. For example, I / O interfaces 814 can provide connectivity to external devices 820 such as keyboards, keypads, touchscreens, and / or other suitable input devices. External devices 820 may also include portable computer-readable storage media, such as thumb drives, portable optical discs or disks, and memory cards. Software and data used to practice embodiments of the invention can be stored on such portable computer-readable storage media and can be loaded onto persistent storage device 808 via multiple I / O interfaces 814. Multiple I / O interfaces 814 are also connected to display 822.

[0067] The display 822 provides a mechanism for displaying data to the user and can be, for example, a computer monitor.

[0068] The programs described herein are identified based on applications that implement them in specific embodiments of the invention. However, it should be understood that any particular program terminology used herein is for convenience only, and therefore the invention should not be limited to use only in any particular application identified and / or implied by such terminology.

[0069] This invention can be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0070] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or recessed structures with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0071] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device, or via a network, such as the Internet, a local area network (LAN), a wide area network (WAN), and / or a wireless network, to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the respective computing / processing device.

[0072] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to perform aspects of this invention, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to personalize the electronic circuits by utilizing the status information of the computer-readable program instructions.

[0073] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0074] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other devices to operate in a particular manner, such that the computer-readable storage medium in which the instructions are stored includes an article of writing comprising instructions for implementing aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0075] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus or other device, perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0076] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a different order than indicated in the figures. For example, two blocks shown consecutively may actually be implemented as a single step, executed simultaneously, substantially simultaneously, with partial or complete time overlap, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0077] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein is chosen to best explain the principles of the embodiments, their practical application, or improvements to existing technologies in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method for identifying application topology, the method comprising: Identify the sandbox environment corresponding to the application of interest; Analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment that indicate a first topology includes using one or more observability tools to probe the sandbox environment; Identify the production system corresponding to the application of interest; Query the production system to identify a set of structural dependencies indicating the second topology; as well as The services in the sandbox environment are matched with the services in the production system by matching the infrastructure information used by the services in the sandbox environment with the services in the production system, and a complete topology for the application of interest is created by combining the first topology and the second topology.

2. The computer-implemented method of claim 1, wherein creating the complete topology of the application of interest comprises: The service-to-service communication links in the sandbox environment are used to establish corresponding links between services in the production system.

3. The computer-implemented method of claim 1, wherein analyzing the sandbox environment to identify the set of communication links comprises: Static analysis is performed on the code and environment variables existing in the sandbox environment.

4. The computer-implemented method of claim 1, wherein analyzing the sandbox environment to identify the set of communication links comprises: Analyze the Domain Name Service (DNS) queries corresponding to the sandbox environment.

5. The computer-implemented method according to any one of claims 1-4, wherein identifying the set of structural dependencies indicating the second topology comprises: The IDs of the container images from the services supporting the sandbox environment are matched with the IDs of the container images from the services supporting the production application.

6. A computer program product for identifying application topology, the computer program product comprising: Program instructions, the program instructions including instructions, the instructions being used for: Identify the sandbox environment corresponding to the application of interest; Analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment that indicate a first topology includes using one or more observability tools to probe the sandbox environment; Identify the production system corresponding to the application of interest; Query the production system to identify a set of structural dependencies indicating the second topology; as well as The services in the sandbox environment are matched with the services in the production system by matching the infrastructure information used by the services in the sandbox environment with the services in the production system, and a complete topology for the application of interest is created by combining the first topology and the second topology.

7. The computer program product of claim 6, wherein the instructions for creating a complete topology for the application of interest comprise: Instructions for establishing corresponding links between services in the production system using service-to-service communication links in the sandbox environment.

8. The computer program product of claim 6, wherein the instructions for analyzing the sandbox environment to identify a set of communication links include: Instructions for performing static analysis on code and environment variables existing in the sandbox environment.

9. The computer program product of claim 6, wherein the instructions for analyzing the sandbox environment to identify a set of communication links include: Instructions used to analyze DNS queries corresponding to the sandbox environment.

10. The computer program product according to any one of claims 6 to 9, wherein the instructions for identifying the set of structural dependencies indicating the second topology comprise: Instructions for matching the ID of a container image from the service supporting the sandbox environment with the ID of a container image from the service supporting a production application.

11. A computer system for identifying application topology, the computer system comprising: One or more computer processors; One or more computer-readable storage media; Program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors, the program instructions including instructions for: Identify the sandbox environment corresponding to the application of interest; Analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment that indicate a first topology includes using one or more observability tools to probe the sandbox environment; Identify the production system corresponding to the application of interest; Query the production system to identify a set of structural dependencies indicating the second topology; as well as The services in the sandbox environment are matched with the services in the production system by matching the infrastructure information used by the services in the sandbox environment with the services in the production system, and a complete topology for the application of interest is created by combining the first topology and the second topology.

12. The computer system of claim 11, wherein the instructions for creating a complete topology for the application of interest comprise: Instructions for establishing corresponding links between services in the production system using service-to-service communication links in the sandbox environment.

13. The computer system of claim 11, wherein the instructions for analyzing the sandbox environment to identify a set of communication links include: Instructions for performing static analysis on code and environment variables existing in the sandbox environment.

14. The computer system according to any one of claims 11 to 13, wherein the instructions for analyzing the sandbox environment to identify a set of communication links include: Instructions used to analyze DNS queries corresponding to the sandbox environment.

Images