Microsoft Technology Licensing, LLC

Crowdstrike, Inc.

Amol Kulkarni

Igor Sedukhin

Haoran Andy Wu

Daniel Eshner

Girish Mittur Venkataramanappa

Prasad Sripathi Panditharadhya

Erik B Christensen

Mariusz Gerard Borsa

Sumit Mohanty

Gilles C J A Zunino

Sundeep Sahi

Vladimir Pogrebinsky

Mandyam Kishore

Dharma Kiritkumar Shukla

George Robert Kurtz

Yann Christensen

Stephen T Swartz

Daniel Radu

Chandra Prasad

Nagalinga Durga Prasad Sripathi Panditharadhya

Leo S Vannelli, Iii

Andreas Ulbrich

Karthik Arun Nanjangud Bhaskar

Jan Miller

Kenneth David Wolf

John Anthony Taylor

Dmitri Alperovitch

Gueorgui Chkodrov

Aditya G Bhandarkar

Oliver J Sharp

Udaya Kumar Bhaskara

Vinod Shanbhag

Anubhav Dhoot

Michael Oliver Neary

Uday Bhaskara

Michael Josef Krejcik

Dan Eshner

Steve Swartz

Timothy Glenn MacNary

Aarthi Rajmohan Saravanakumar

A security service can determine a synthetic context based at least in part on context data associated with a first malware sample, and detonate the first malware sample in the synthetic context to provide one or more first event records representing events performed by the first malware sample and detected during detonation. Additionally or alternatively, the security service can detonate the first malware sample and locate a second malware sample in a corpus based at least in part on the one or more first event records. Additionally or alternatively, the security service can receive event records representing events detected during a detonation of a first malware sample, the detonation based at least in part on context data, and locate a second malware sample in the corpus based at least in part on the one or more reference event records.

Analysis of malware

Systems and methods according to various embodiments disclose a worker process manager adapted to spawn one or more worker processes on a server and to load an application on each of the worker processes. The worker process manager is adapted to isolate the one or more worker processes from each other and to control resource usage by the worker processes. A resource manager is adapted to detect applications that overuse system resources. The worker process manager is adapted to isolate worker processes and to control resource usage using one or more of the following techniques: least-privilege execution, messaging isolation, credentials isolation, data isolation, network isolation, fair share resource usage, and managed runtime security. Heuristic algorithms are used to detect applications that frequently overuse system resources that are unchargeable and that cause system unresponsiveness.

Sandboxing for multi-tenancy

In one embodiment, a computer system accesses an event associated with an activity, where the activity has been executed by a runtime as part of a software application. The runtime includes a software hook configured to listen for event stream operation indications from the user. The computer system tags the accessed event with an additional portion of identification information that uniquely identifies the executed activity. The computer system receives an event stream operation indication from the user indicating that event transmission for an identified event stream is to be dynamically enabled or disabled and identifies the user-indicated event stream using the tagged identification information. The computer system also dynamically performs the indicated event stream operation on the identified event stream according to the user's indication.

Dynamic event collection and structured storage

A container service is capable of hosting large numbers of middleware components for multiple tenants. A central container manager controls a plurality of compute nodes. The central container manager receives middleware components from external devices or services and assigns the components to containers on one or more designated compute nodes. Each compute node has a container management agent and one or more containers. The container management agents activate and manage the appropriate number of containers to run the assigned middleware components. The container management agent assigns each container on its compute node a limited set of privileges to control access to shared resources. The central container manager and each node's container management agent monitor container load levels and dynamically adjust the placement of the middleware components to maintain balanced operation. The compute nodes are grouped into clusters based upon the type of middleware components hosted on each compute node.

Multi-tenant, high-density container service for hosting stateful and stateless middleware components

The present invention extends to methods, systems, and computer program products for processing model based commands for distributed applications. Embodiments facilitate execution of model-based commands, including software lifecycle commands, using model-based workflow instances. Data related to command execution is stored in a shared repository such that command processors can understand their status in relationship to workflow instances. Further, since the repository is shared, command execution can be distributed and balanced across a plurality of different executive services. Embodiments also include model-based error handling and error recovery mechanisms.

Processing model-based commands for distributed applications

A system for automatically implementing high-level instructions in a distributed application program, where the high-level instructions reflect the behavior of the distributed application program, includes at least a tools component. The tools component is used to write high-level instructions in the form of declarative models, and place them in a repository. An executive component then receives the declarative models from the repository and refines them (e.g., via progressive elaboration) until there are no ambiguities. A platform-specific driver then translates the commands from the executive component, effectively turning the declarative model instructions into a set of imperative actions to be implemented in one or more application containers. The platform-specific driver also relays one or more event streams to an analytics means, which can result in modifications to the declarative models and corresponding new sets of instructions coming through the platform-specific driver at a later point.

Progressively implementing declarative models in distributed systems

The present invention extends to methods, systems, and computer program products for monitoring distributed applications. Declarative application models are used. Operational data for a deployed application can be compared to an application intent expressed in a corresponding declarative application to provide more effective monitoring of application behavior. Application components can subscribe to an event fabric to receive configurations that indicate what events the application is to emit (i.e., publish into the event fabric) for monitoring. Thus, applications essentially subscribe to produce information (as opposed to subscribing to receive information). Monitoring can be dynamically adjusted in response to environment changes.

Monitoring distributed applications

The present invention extends to methods, systems, and computer program products for managing software lifecycle. Based on declarative models and knowledge of their interpretation, embodiments of the present invention facilitate lifecycle management for model-based software applications. Lifecycle models, such as, for example, lifecycle state machine models are stored in a shared repository such that executive services can determine how software application lifecycles are to be managed and transitioned. Software lifecycle activities can verify that a transition is possible and identify any errors preventing a lifecycle transition. Model-based error handling and error recovery mechanisms can be used to correct any identified errors.

Managing software lifecycle

A system for automatically adjusting operation of a distributed application program includes analytics means having a monitoring component. The monitoring component receives one or more event streams of data corresponding to execution of one or more modules of the distributed application program. The monitoring component joins the received event streams with one or more declarative models to create operational data. A forensics component of the analytics means queries, such as by using data from a declarative model store, the operational data to identify trends or behavior information for the various modules or components of the distributed application program. A planner component then reviews data created by the forensics component to identify any needed changes to the declarative models. The planner component passes any modified declarative models back to the system, so that the distributed application program can operate more efficiently using the changes to the declarative models, as needed.

Tuning and optimizing distributed systems with declarative models

The present invention extends to methods, systems, and computer program products for distributed behavior controlled execution of modeled applications. Embodiments of the invention facilitate the interoperation of a central data store along with various peer-to-peer functionalities. Thus, distributed applications can be executed in an environment that utilizes advantages of both a central data store and peer-to-peer messaging. A read-only portion of a centralized data store can be used to provide some behavior control over various processing systems during execution of a distributed software application. Thus, embodiments of the invention can be used to form a policy-driven collective of nodes forming a distributed, decentralized run-time for model-based applications. Utilizing a cooperating collective of nodes that comply with centralized polices and execute applications over a peer-to-peer fabric permits a distributed application runtime to accommodate distribution and decentralization on a large scale.

Distributed behavior controlled execution of modeled applications

The present invention extends to methods, systems, and computer program products for performing requested commands for model-based applications. Embodiments of the invention permit efficient implementation of operations for model-based applications. Since drivers that are to implement an operation request data for implementing the operation, embodiments significantly reduce the likelihood of superfluous data being exchanged between an executive service and drivers. Further, if an operation is interrupted before implementation is complete, the operation can be resumed without having to re-perform already completed portions of the operation. Additionally, a user can be regularly updated on the progress of their commands.

Performing requested commands for model-based applications

Enabling and processing events. To enable events, an application model correlated to an application is declaratively defined. The application model describes operations of the application. One or more event models correlated to the application model are declaratively defined. The event models describe application execution locations where events are desired to be emitted in the execution of the application. Based on the correlation of the event models to the application models, the applications are instrumented with instrumentation code to cause the application to emit events at the execution locations. To process events an application model is defined. The application model includes one or more observation models. The observation models include a correlation of events to the observation model by defining instrumentation models in the application model. An event is received. The event is applied to the observation model based on the correlation. The event is processed according to the observation model.

Model-driven, repository-based application monitoring system

Growing community of inventors

Bothell, WA, United States of America

Amol Kulkarni