A computer-implemented method to determine which port in a container is a service port. The method includes identifying, a first container, wherein the first container comprises a plurality of ports. The method further includes, training a neural network, wherein the neural network is configured to identify at least one service port from the plurality of ports. The method further includes, monitoring, by a network monitor, a set of data sent to the first container comprising a first parameter. The method includes, identifying a first service port of the plurality of ports. The method further includes, marking the first service port.