Patent ID: 11586521

Abstract:
A method, apparatus and system for providing process-level forensics for a plurality of application containers includes for each of the plurality of application containers; monitoring forensics information of the application container, encoding the monitored forensics information using an encoder of a predetermined encoder/decoder pair to determine a forensics model, decoding the forensics model to determine a reconstructed representation of the forensics information, comparing the reconstructed representation of the forensics information to the monitored forensics information to determine an error and comparing the error to a threshold to determine if an error above the threshold exists. If the error is below the threshold, the forensics model is communicated to a higher-level manager to be used for higher-level management. If the error is above the threshold, the monitored forensics information of the application container is also communicated to the higher-level manager. The predetermined encoder/decoder pair is determined using an autoencoding process.