Patent ID: 11860994
Assignee: BRITISH TELECOMMUNICATIONS PUBLIC LIMITED COMPANY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A computer implemented method to detect anomalous behavior of a software container having a software application executing therein, the method comprising:
receiving a sparse data representation of each of:
a first set of container network traffic records,
a first set of application traffic records, and
a first set of container resource records,
and training a first hierarchical temporal memory (HTM) for the first set of container network traffic records, a second HTM for the first set of application traffic records, and a third HTM for the first set of container resource records, wherein the first set of container network traffic records correspond to network traffic communicated with the software container, the first set of application traffic records correspond to network traffic communicated with the software application, and the first set of container resource records correspond to the use of computer resources by the software container;

receiving a sparse data representation of each of:
a second set of container network traffic records,
a second set of application traffic records, and
a second set of container resource records;

executing the trained first HTM based on the second set of container network traffic records, the trained second HTM based on the second set of application traffic records, and the trained third HTM based on the second set of container resource records to determine a degree of recognition of each of the second set of container network traffic records, the second set of application traffic records, and the second set of container resource records; and
responsive to an identification of a coincidence of a degree of recognition of each of the second set of container network traffic records, the second set of application traffic records, and the second set of container resource records being below a threshold degree in each of the trained first HTM, the trained second HTM, and the trained third HTM, identifying anomalous behavior of the software container.