Abstract: A method, apparatus and computer program product for scheduling placement of containers in association with a set of hosts. The technique utilizes metrics that characterize container-specific risks. A first metric is a host interface risk for a container that quantifies how similar or dissimilar the container is relative to other containers running on a host. Preferably, host interface risk is derived with respect to a system call interface comprising a set of system calls, and the metric is based at least in part on a measure of dissimilarity among system calls. A second metric is a data sensitivity score that quantifies a degree to which sensitive data accesses are associated to the container. Based at least in part on the host interface risk scores and the data sensitivity scores, one or more containers are automatically scheduled for placement on the set of hosts to minimize security risk for the set of hosts.

Abstract: The main enabler of the technology is the probabilistic programming based computation strategies that have an outstanding ability to handle uncertainties in discovering anomalous patterns. This new capability to handle uncertainties is particularly relevant for detecting insider threats, as there are usually no clearly defined rules and policies. An insider's behaviors would deviate from normally distributed events and actions in various aspects. The probabilistic model detects this deviation and explains the computational path of the deviation. The result interpretation unit enables organizations to investigate the causes with high accuracy, avoiding costly and embarrassing false alarms. The technology detects and ranks abnormal events. This ranking capability helps prioritize follow-up manual investigation.

Abstract: A method, apparatus and computer program product for scheduling placement of containers in association with a set of hosts. The technique utilizes metrics that characterize container-specific risks. A first metric is a host interface risk for a container that quantifies how similar or dissimilar the container is relative to other containers running on a host. Preferably, host interface risk is derived with respect to a system call interface comprising a set of system calls, and the metric is based at least in part on a measure of dissimilarity among system calls. A second metric is a data sensitivity score that quantifies a degree to which sensitive data accesses are associated to the container. Based at least in part on the host interface risk scores and the data sensitivity scores, one or more containers are automatically scheduled for placement on the set of hosts to minimize security risk for the set of hosts.