Abstract: A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines. The operating signals characterize container activities. The container activities are isolated processes in user space designated by an operating system kernel. The container activities are ascribed a container lifecycle phase characterized as one of container startup, container steady state and container shutdown. A process anomaly is identified when container lifecycle phase activity deviates from baseline container lifecycle phase activity.

Abstract: A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines. The operating signals characterize establishing or closing a network connection associated with a designated application operating within a designated container. The designated container is an isolated process in user space designated by an operating system kernel. A network security policy that permits network connections based upon the operating signals collected is automatically generated.