Patent ID: 11921885
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 6:
7. An apparatus to schedule placement of containers in association with a set of hosts, comprising:
one or more hardware processors;
computer memory holding computer program instructions executed by the hardware processors and configured to:
compute a host interface risk score for a container that quantifies a potential exploitation of the host interface, wherein the host interface is a system call interface comprising a set of system calls, and wherein the host interface risk score is based on system call usage of the container is-relative to system call usage of other containers running on a host;
associate a data sensitivity score to the container that quantifies a degree to which sensitive data accesses are associated to the container; and
based at least in part on the host interface risk scores and the data sensitivity scores, automatically schedule one or more containers for placement on the set of hosts to minimize security risk among a set of containers for the set of hosts.