Abstract:
Methods and systems for detecting anomalous communications include simulating a network graph based on community and role labels of each node in the network graph based on one or more linking rules. The community and role labels of each node are adjusted based on differences between the simulated network graph and a true network graph. The simulation and adjustment are repeated until the simulated network graph converges to the true network graph to determine a final set of community and role labels. It is determined whether a network communication is anomalous based on the final set of community and role labels.
Abstract:
Systems and methods are disclosed for detecting error in a cloud infrastructure by running a plurality of training tasks on the cloud infrastructure and generating training execution logs; generating a model miner with the training execution logs to represent one or more correct task executions in the cloud infrastructure; after training, running a plurality of tasks on the cloud infrastructure and capturing live execution logs; and from the live execution logs, if a current task deviates from the correct task execution, indicating an execution error for correction in real-time.
Abstract:
Systems and methods for managing components of physical systems, including decomposing raw time series by extracting an aging trend and a fluctuation term from the time series using an objective function of an optimization problem, the objective function minimizing reconstruction error and ensuring flatness of the fluctuation term over time. The optimization problem is transformed into a Quadratic Programming (QP) formulation including a monotonicity constraint and a non-negativity constraint, the constraints being merged together to reduce computational costs. An aging score and a confidence score are generated for the extracted aging trend to determine a severeness of aging for one or more components of the physical system, and the aging score and confidence score are fused to provide a fused ranking for the extracted aging trend for predicting future failures of the components.
Abstract:
A method and system are provided. The method includes determining from a data matrix having rows and columns, a clustering vector of the rows and a clustering vector of the columns. Each row in the clustering vector of the rows is a row instance and each row in the clustering vector of the columns is a column instance. The method further includes performing correlation of the row and column instances. The method also includes building a normalizing graph using a graph-based manifold regularization that enforces a smooth target function which, in turn, assigns a value on each node of the normalizing graph to obtain a Lapacian matrix. The method additionally includes performing Eigenvalue decomposition on the Lapacian matrix to obtain Eigenvectors. The method further includes providing a canonical co-clustering analysis function by maximizing a coupling between clustering vectors while concurrently enforcing regularization on each clustering vector using the Eigenvectors.
Abstract:
A method implemented in a network apparatus used in a network is disclosed. The method comprises collecting information about network topology from a network controller, collecting information about data movement, deciding routing in the network according to the information about network topology and the information about data movement, and providing information about the routing to the network controller, wherein the network controller enforces the routing in the network. Other methods, apparatuses, and systems also are disclosed.
Abstract:
A computer implemented method for temporal ranking in invariant networks includes considering an invariant network and a set of broken invariants in the invariant network, assuming, for each time point inside a window W, that each metric with broken invariants is affected by a fault at that time point, computing an expected pattern for each invariant of a metric with assumed fault, said pattern indicative of time points at which an invariant will be broken given that its associated metric was affected by a fault at time t, comparing the expected pattern with the pattern observed over the time window W; and determining a temporal score based on a match from the prior comparing.
Abstract:
In a software defined network having switches including first and last switches and intermediate switches, wherein a default routing path exists between the first and last switches, a system and method are provided for computing path latency. The method includes inserting a respective monitoring rule(s) in each switch, mandating for each switch, forwarding a received rule matching packet to a next switch, and further mandating for the first switch and the last switch, sending a PacketIn message to a controller. The method includes inserting, in each switch, a respective monitoring probe(s) matching the respective monitoring rule(s) in a same switch to initiate mandates specified by the respective monitoring rule(s) in the same switch responsive to an arrival of the packet thereat. The method includes time-stamping the PacketIn messages to generate PacketIn timestamps, aggregating the PacketIn timestamps, and estimating the path latency from an aggregation of PacketIn timestamps.
Abstract:
A computer implemented method for maintaining a program's calling context correct even when a monitoring of the program goes out of a scope of a program analysis by validating function call transitions and recovering partial paths before and after the violation of the program's control flow. The method includes detecting a violation of control flow invariants in the software system including validating a source and destination of a function call in the software system, interpreting a pre-violation partial path responsive to a failure of the validating, and interpreting a post violation path after a violation of program flow.
Abstract:
A computer implemented method provides efficient monitoring and analysis of a program's memory objects in the operation stage. The invention can visualize and analyze a monitored program's data status with improved semantic information without requiring source code at runtime. The invention can provide higher quality of system management, performance debugging, and root-cause error analysis of enterprise software in the production stage.
Abstract:
A method implemented in a network apparatus used in a network is disclosed. The method comprises collecting information about network topology from a network controller, collecting information about data movement, deciding routing in the network according to the information about network topology and the information about data movement, and providing information about the routing to the network controller, wherein the network controller enforces the routing in the network. Other methods, apparatuses, and systems also are disclosed.