Abstract: A universal code editor (UCE) is described that can be used for authoring and editing artifacts associated with multiple different cloud services. A single instance of the UCE and the associated user interface (UI) can be used to select and edit one or more artifacts from different cloud services. The cloud services may be provided by the same cloud service provider or by different cloud service providers. In certain embodiments, the UCE is implemented as part of a cloud-based IDE.

Abstract: Techniques are disclosed for augmenting data sets used for training machine learning models and for generating predictions by trained machine learning models. These techniques may increase a number and diversity of examples within an initial training dataset of sentences by extracting a subset of words from the existing training dataset of sentences. The techniques may conserve scarce sample data in few-shot situations by training a data generation model using general data obtained from a general data source.

Abstract: The present embodiments relate to a CI replication service that can replicate domain data from IDCS control plane to data plane and to all subscribed regions of a domain. For instance, the CI replication service can provide replication of required resources of a domain for AuthN and AuthZ from an IDCS local region to other regions for high availability (e.g., to improve latency). The CI replication service can replicate the resources from a domain's home region to all subscribed regions for local availability of data for workloads running in those regions. Further, when a new region is subscribed for a domain, then the service can bootstrap that domain's data from home region before enabling that region for the domain.

Abstract: The present disclosure relates generally to access control, and more particularly, to techniques (e.g., systems, methods, computer program products storing code or instructions executable by one or more processors) for providing for inline enrollment in multi-level and multi-factor authentication of a user allowing login on a restricted website, or on an enterprise network with single sign-on, or on various other service systems with security restrictions.

Abstract: Techniques are disclosed for automatically inferring software-defined network policies from the observed workload in a computing environment. The disclosed techniques include monitoring network traffic flow originating from network interfaces corresponding to containers that execute components of an application, recording details of a new network connection or a change in the existing network connection, obtaining information concerning the components of the application, identifying metadata for a component involved in the new network connection or the change in an existing network connection based on a comparison of the details of the new network connection or a change in the existing network connection and the information concerning the components of the application, generating a network policy for the component using at least the metadata for the component, and integrating the network policy for the component into a deployment package for the application.

Abstract: Techniques are disclosed for utilizing directed acyclic graphs for deployment instructions. A computer-implemented method can include various operations. Instructions may be executed by a computing device to perform parses of configuration data associated with deploying one or more services to various execution targets. The computing device may cause a first graph to be generated that indicates dependencies between tasks associated with deploying the service(s). A second graph may be generated that specifies dependencies between different deployments of the service(s) to the execution target(s). Services may be deployed based on traversing the first and second graph.

Abstract: A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or service communication proxy (SCP) includes receiving message relating to registering, updating, or deregistering an NF profile in an NF profiles database separate from a platform firewall. The method further includes determining that the registering, updating, or deregistering of the NF profile requires a change to a firewall rules configuration of the platform firewall. The method further includes, in response to determining that the registering, updating, or deregistering of the NF profile requires a change to the firewall rules configuration of the platform firewall, automatically updating, by the NRF or SCP, the firewall rules configuration of the platform firewall.

Abstract: Various embodiments of the present technology generally relate to systems and methods for secure customer data handling. More specifically, some embodiments relate to handling of derivative data as a provider in a manner that supports security and provides a stronger level of control over the data. The solution supports four core principles of customer data handling: no export of customer data, unless authorized; remote operations only via shell access or equivalent; temporary and task-based privileges; and diagnostic data to be ephemeral. The customer data handling system herein includes a central repository for the storage of diagnostic data, an upload tool for uploading to the central repository and automated staging on containers, a diagnostic virtual machine that enables task-based access to diagnostic data and analysis tools hosted on a dedicated container, and an application for handling requests, provisioning and staging containers, and purging.

Abstract: Techniques are disclosed for providing high performant packets processing capabilities in a virtualized cloud environment that enhance the scalability and high availability of the packets processing infrastructure. In certain embodiments disclosed herein, the VNICs functionality performed by network virtualization devices (NVDs) is offloaded from the NVDs to a fleet of computers, referred to as VNIC-as-a-Service System (or VNICaaS system). VNICaaS system is configured to provide Virtual Network Interface Cards (VNICs)-related functionality or service for multiple compute instances belonging to multiple tenants or customers of the CSPI. The VNICaaS system is capable of hosting multiple VNICs to process and transmit traffic in a distributed virtualized cloud networks environment. A single VNIC executed by the VNICaaS system can be used to process packets received from multiple compute instances.

Abstract: The present embodiments relate to a cloud shell extension framework. A cloud infrastructure (CI) service can invoke a cloud shell from a console to the CI. The service may request that context data to be added for use in a terminal session. The cloud shell extension can include a tool or script that can be used to obtain context data or sample code for preparing an environment specific to the service prior to the user interaction with the environment. The cloud shell extension can allow for a service to register an extension in the cloud shell framework, and their extension can be invoked when a client initiates the cloud shell with the service. The extension can allow for the invoked service to forward context data, such as environment variables, to be set in the terminal session for the client.

Abstract: Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and/or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.

Abstract: Example embodiments facilitate efficient comparison operations of tree structures, resulting in comparison metrics (e.g., similarity or distance metrics or scores) used enhance software systems, such as search algorithms, code optimization software, enterprise database applications, and so on. Trees to be compared are converted into sets, i.e., serialized using a novel enumeration method. Metric functions can then be efficiently applied to the sets to facilitate the comparison operations. In an illustrative embodiment, subtrees of larger trees can be compared individually, pairwise, where the comparison results of the subtree comparisons can be selectively weighted and summed to yield an aggregated comparison metric that is tailored for a specific application or comparison priority.

Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a proxying sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the proxying sidecar node. The proxying sidecar node can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and send the bootstrapping data to nodes in the secure data center to provision one or more services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a static sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the static sidecar node. The static sidecar node can receive bootstrapping data from the host data center and store the bootstrapping data. The bootstrapping data can include software resources for provisioning services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system and a cluster of edge devices. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the cluster of edge devices. The cross domain system can include a cluster configuration node that can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and use the bootstrapping data to generate a virtual bootstrapping environment on the cluster of edge devices.

Abstract: A type restriction contextually modifies an existing type descriptor. The type restriction is imposed on a data structure to restrict the values that are assumable by the data structure. The type restriction does not cancel or otherwise override the effect of the existing type descriptor on the data structure. Rather the type restriction may declare that a value of the data structure's type is forbidden for the data structure. Additionally or alternatively, the type restriction may declare that an element count allowable for a data structure's type is forbidden for the data structure. Type restriction allows optionality (where only a singleton value for a data structure is allowed), empty sets (where no value for a data structure is allowed), and multiplicity (where only a limited element count for a data structure) to be injected into a code set independent of data type. Type restriction allows certain optimizations to be performed.

Abstract: A degree of fragmentation is determined based on a number of holes present in a storage system layout or a portion of a layout. Edges between the holes and used portions of the storage system are tabulated by scanning a storage space. The occurrences of a pattern of used/available allocation units and/or the occurrences of another pattern available/used allocation units are recognized. A fragmentation value is calculated based on occurrences of the patterns in view of the total storage space. The present fragmentation measurement system utilizes the number of occurrences of the holes in assessing fragmentation.

Abstract: Method includes generating a base model by training a pretrained model using a base training dataset including first training datapoints identifying tables in historical document images that include the tables and text, where the generated base model is configured to extract the tables as objects; and generating a table extraction model by training the base model using an enhanced training dataset including second training datapoints that are different from the first training datapoints and identify a plurality of cells disposed in each of the tables in a row direction and a column direction. The table extraction model is trained to output content of the tables and table information in an XML format, the table information including cell level information of the plurality of cells that is searchable via a query configured to provide target content that corresponds to one or more cells.

Abstract: Techniques are disclosed for generating a database schema using trained machine learning models that, in some embodiments, may include graph neural networks (GNN). A GNN may identify source to target database schema mappings using, among other features of the graph, context data associated with each node in a graph. Context data describes relationships between a particular node and some (or all) of the other nodes in the graph. The system may use this context data (and other graph data) in combination with a trained GNN model to identify a mapping between one or more source database entities to corresponding target database entities.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal, where the noise signal includes a plurality of sparse features from the set of time series data and the dense signal includes a plurality of dense features from the set of time series data. A set of one or more sparse features from the noise signal is selected for retention. After selecting the sparse features, a modified set of time series data is generated by combining the set of one or more sparse features with a set of one or more dense features from the plurality of dense features. At least one seasonal pattern is identified from the modified set of time series data. A summary for the seasonal pattern may then be generated and stored.

Abstract: A method of marshalling existing software applications to automatically execute a task in a cloud environment includes generating actions that together execute the task; passing the actions to code generation services, where each of the code generation services is associated with a corresponding software application. Each of the code generation services is configured to select a subset of the actions that can be executed by the corresponding software application, and to generate second actions to be executed by the corresponding software application that implement the subset of the actions. The method also includes providing a job definition for the task including each of the second actions for each of the software applications.

Abstract: Systems and methods for supporting target groups for congestion control in a private fabric in a high performance computing environment. An exemplary method can provide, at one or more microprocessors, a first subnet, the first subnet comprising a plurality of switches, a plurality of host channel adapters, and a plurality of end nodes, including a plurality of virtual machines. The method can define a target group on one of an inter-switch link or at a port of a switch of the plurality of switches, wherein the target group defines a bandwidth limit on the at least one of an inter-switch link between two switches of the plurality of switches or at a port of a switch of the plurality of switches. The method can provide a target group repository stored in a memory of the host channel adapter where the defined target group in the target group repository is recorded.

Abstract: Log data that includes a plurality of log records is asynchronously processed to validate a configuration of each log record and data included in each log record. It is determined that one or more attributes of a particular subset of log records of the plurality of log records corresponds to one or more errors. Using the particular subset, one or more enriched log records are generated by augmenting each log record of the particular subset of log records with error information that indicates one or more categories corresponding to the one or more errors. A user interface is generated to facilitate correction of the one or more errors, the user interface comprising a plurality of interactive elements corresponding to a plurality of error metrics of different categories of errors, wherein the one or more categories of the one or more errors are included in the different categories of errors.

Abstract: Techniques are disclosed for using a multi-tenant framework for microservices in a microservices-based application to handle tenant-specific circuit breaking. The microservices-based application can include at least one microservice that incorporates the multi-tenant framework. The multi-tenant framework includes software components configured to provide multi-tenant functionality for the microservice. A first microservice may receive an indication associated with a tenant that a second microservice is overloaded. The first microservice can then receive a request containing tenant context data at an interface. A first software component of the multi-tenant framework can extract the tenant context data from the request. The first microservice may determine whether the tenant context data corresponds to the tenant. The first microservice can then trigger a circuit breaker for the second microservice.

Abstract: A time series forecasting system is disclosed that obtains a time series forecast request requesting a forecast for a particular time point. The forecast request identifies a primary time series dataset for generating the requested forecast and a set of features related to the primary time series dataset. The system provides the primary time series dataset and the set of features to a model to be used for generating the forecast. The model computes a feature importance score for one or more features and selects a subset of features based on their feature importance scores. The model determines attention scores for a set of data points in the primary time series dataset based on the selected subset of features. The system predicts an actual forecast for the particular time point based on the attention scores and outputs the actual forecast and explanation information associated with the actual forecast.

Abstract: A system and technique for a Request Forwarder as for a computer network architecture is disclosed to provide selective access to one or more cloud services. In some implementations, a computer system may receive a request for access to a cloud service, the request including a container credential. The computer system may determine an identification of the container using the container credential. The computer system may verify that the container requesting access to the cloud service is authorized based at least in part on stored policies. Based at least in part on the determination that the container requesting access to the cloud service is authorized: receiving instance credential from a metadata service. The computer system may include the instance credential with the request. The computer system may send the request to the cloud service. In various examples, the Request Forwarder can be provided as a service.

Abstract: Example embodiments facilitate prioritizing the recycling of computing resources, e.g., server-side computing systems and accompanying resources (e.g., non-volatile memory, accompanying firmware, data, etc.) leased by customers in a cloud-based computing environment, whereby computing resources (e.g., non-volatile memory) to be forensically analyzed/inspected, sanitized, and/or updated are prioritized for recycling based on estimates of when the computing resources are most likely to require recycling, e.g., via background sanitizing and updating. Computing resources that are likely to be recycled first are given priority over computing resources that are more likely to be recycled later. By prioritizing the recycling of computing resources according to embodiments discussed herein, other cloud-based computing resources that are used to implement computing resource recycling can be efficiently allocated and preserved.

Abstract: The present disclosure relates to systems and methods that enhance log data processing by asynchronously processing log data for detecting log messages that include errors and enriching the log messages with annotations that identify the errors. More particularly, log data that includes log records can be received. The log data can be asynchronously processed to validate a configuration of each log record and to validate data included in each log record. An attribute of a particular log record can be determined to correspond to an error. A category of the error can be determined. An enriched log record can be generated by augmenting the particular log record with error information indicating the category. The enriched log record can be transmitted via a user interface to facilitate correction of the error.

Abstract: A computer program product, system, and computer implemented method for scalable specification and self-governance for autonomous databases, cluster databases, and multi-tenant databases in cloud and on-prem environments. The approach disclosed herein enables management of a consolidated databases using a template-based process that allows for the consolidated databases (CDBs) and pluggable databases (PBDs) to be reconfigured automatically. In some embodiments, the approach instantiates one or more monitoring modules and one or more CDB/PDB configuration managers. These elements can detect relevant changes in the conditions in which CDB instances and open PDBs operate and adjust the configurations thereof in response.

Abstract: Techniques discussed herein manage backups of a service cell (SC). Each SC may include a data plane that is isolated from other SCs and comprises a distributed computing cluster (a cluster). A manifest that specifies one or more backup policies may be used to generate a full backup or a partial backup of a data set stored by the cluster. In accordance with the manifest, a signal may be sent to nodes of the cluster. In response, the nodes may transmit locally-stored data (e.g., data segments) to specified locations at a remote storage. The system may maintain a mapping of which segments correspond to data that was stored in the cluster at a time corresponding to a full or partial backup.

Abstract: Techniques for displaying a stage-specific pipeline view with a prediction engine are disclosed. A system displays a plurality of regions representing various stages of completion for a plurality of transactions. The system determines a stage of completion for each of the plurality of transactions at a first point-in-time, and generates and displays visualizations representing each of the plurality of transactions in one of the plurality of regions based on the respective current stage of completion. Generating a visualization representing a first transaction includes determining a likelihood of the first transaction completing a stage associated with the first transaction. The likelihood may be determined by selecting attributes associated with the first transaction and identifying prior transactions with similar attributes.

Abstract: Systems, methods, and other embodiments associated with secure firmware update in a bare metal cloud environment are described. In one embodiment, a trusted device for causing a component of a computing device to accept a firmware update is presented. The device includes a management interface configured to receive a command that authorizes a firmware update to the component. The device further includes a recovery device logic that is configured to generate a signal configured to cause the component to enter a recovery mode. The recovery mode configures the component to accept the firmware update. The device also includes an interface of the device that is configured to pass the signal to the component to cause the component to enter the recovery mode and accept the firmware update.

Abstract: A method for mitigating spoofing attacks on an SEPP inter-PLMN forwarding interface includes obtaining, by a responding SEPP, a first SEPP identifier and/or a first PLMN identifier from at least one message received over an inter-PLMN control interface. The method further includes storing the first SEPP identifier and/or the first PLMN identifier in an identity cross-validation database. The method further includes obtaining, from at least one message received over an inter-PLMN forwarding interface a second SEPP identifier and/or a second PLMN identifier and performing a lookup in the identity cross-validation database using a lookup key comprising at least one of the second SEPP identifier and the second PLMN identifier, determining that a record corresponding to the lookup key is not present in the identity cross-validation database, and, in response, preventing the at least one message received over the inter-PLMN forwarding interface from entering a PLMN protected by the responding SEPP.

Abstract: Systems, methods, and other embodiments associated with assessing and adaptively managing query loads are described. In one embodiment, a method includes determining that a query invoked by a client terminal against an application object has a duration that exceeds a completion threshold. In response to receiving a subsequent invocation of the query, statistics for the query are obtained. The obtained statistics are analyzed to determine whether the query causes the unacceptable negative impact on the application object. A data structure is modified to include a classification of the query into one of a plurality of different query classes based on a result of the analysis, and execution of the query in response to a future invocation is controlled based on the classification of the query in the modified data structure.

Abstract: A configuration helper system (CHS) is described that simplifies the task of generating configuration information for a customer premises equipment (CPE) in a customer's on-premise network to enable the CPE to communicate with the customer's cloud network over a particular communication channel. The CHS is configured to generate configuration information that is customized for the particular CPE and communication channel. Given information about the CPE and the communication channel, the CHS automatically identifies a particular set of configuration parameters to be included in the customized configuration information and determines values for the set of parameters, where some of the values may be provided by the customer. A particular CPE-specific format is determined for the configuration information.

Abstract: A database is stored as a plurality of database shards in a distributed database grid comprising a plurality of grid elements, each including a mid-tier database system. A first grid element receives, from an application executing in the same memory as a mid-tier database system of the first grid element, a first database transaction including at least one database operation on specific data stored in a first database shard that belongs to the first grid element. The first grid element performs and commits the first database transaction without participation of another grid element of the plurality of grid elements. The first grid element receives a second database transaction that requires access to another database shard that does not belong to the first grid element. Multiple grid elements of the plurality of grid elements perform the second database transaction and commit the second database transaction using a two-phase commit protocol.

Abstract: Various embodiments provide for obtaining snapshots of a displayable form. User specified information is received from a process modeler user interface. The process that includes the displayable form is created based on the user specified information. Snapshot instructions is associated, based on the user specified information, with a point in the process that can occur anytime while displaying the form during the execution of the process. The form is displayed as part of the execution of the process. When the point is encountered during execution of the process, the snapshot of the displayed form is obtained based on execution of the snapshot instructions.

Abstract: Systems and methods for a virtual layer-2 network are described herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Embodiments validate representational state transfer (“REST”) application program interfaces (“API”). Embodiments receive a REST API specification that provides information for a plurality of REST APIs and parse the REST API specification to extract, for each REST API, a corresponding Uniform Resource Locator (“URL”), and corresponding parameter names response codes and payloads. Embodiments convert the parsed REST API specification into a converted text file, the converting including parameter constraints and parameter default values. Embodiments then generate all possible combinations of test data for each REST API from the converted text file and perform one or more test operations on each of the combinations of test data.

Abstract: Providing selective peer-to-peer monitoring using MBeans by providing a federation of peer-to-peer network servers based on the MBeans, and enabling each of the peer-to-peer networks servers to selectively monitor data associated with at least a subset of the peer-to-peer network servers using at least one of the MBeans.

Abstract: A method for generating, conveying, and using attempted producer network function (NF) instance communication information includes, at a first service communication proxy (SCP), receiving, from a sender, a first service based interface (SBI) request message. The method further includes attempting to obtain a service requested by the first SBI request message from at least one producer NF instance. The method further includes receiving at least one error response or failing to receive a response from the at least one producer NF instance. The method further includes generating, from the at least one error response or the failing to receive a response from the at least one producer NF instance, attempted producer NF instance communication information. The method further includes communicating, to the sender, the attempted producer NF instance communication information.

Abstract: A system for loading graph data from an external store in response to a graph query is disclosed. In some embodiment, given a graph database where all vertices are stored in memory and some but not all edges are stored in the external store, the system performs one of two methods. In the first method, the system iteratively expands a set of vertices that is initially specified in the graph query and collects all edges connected to the set of vertices, including edges stored in the external store, that satisfy a vertex constraint also specified in the query. In the second method, the system finds a set of vertices that satisfy the vertex constraint and collects all edges connected to the set of vertices, including edges stored in an external store.

Abstract: Systems, devices, and methods discussed herein provide improved autonomous agent applications that are configured to generate automated answers to a question using summarized logical forms (SLFs). A myriad of techniques may be utilized to manually or automatically generate one or more summarized logical forms for an answer, where the summarized logical form(s) identifies the main entities/informative portions of the answer. Instead of indexing the whole of the answer as in conventional methods, an answer can be indexed using the summarized logical forms. A subsequent query may be matched to the SLF and the answer may be provided in response to the question. By indexing the answer with its informative portions, the speed and accuracy of identifying the answer is improved.

Abstract: The present disclosure relates to techniques for identifying out-of-domain utterances.

Abstract: Techniques described herein relate to systems and methods of data storage, and more particularly to providing layering of file system functionality on an object interface. In certain embodiments, file system functionality may be layered on cloud object interfaces to provide cloud-based storage while allowing for functionality expected from a legacy applications. For instance, POSIX interfaces and semantics may be layered on cloud-based storage, while providing access to data in a manner consistent with file-based access with data organization in name hierarchies. Various embodiments also may provide for memory mapping of data so that memory map changes are reflected in persistent storage while ensuring consistency between memory map changes and writes. For example, by transforming a ZFS file system disk-based storage into ZFS cloud-based storage, the ZFS file system gains the elastic nature of cloud storage.

Abstract: A network virtualization device receives a storage request from a compute instance executed by a host machine separate from the network virtualization device, the storage request comprising data to be stored. Responsive to receiving the storage request, the network virtualization device divides the data to be stored into a set of one or more data stripes. For a first data stripe in the set of data stripes, the network virtualization device determines, from a plurality of extent servers, a first extent server to which the first data stripe is to be sent for storing the first data stripe, transmits the first data stripe to the first extent server, wherein the first extent server stores the first data stipe to a first physical storage device, and receives, from the first extent server, an acknowledgement confirming that the first data stripe was stored.

Abstract: Domain specific inlining for interpreters includes obtaining an interpreter source code including compiler directives. A host compilation is performed on the interpreter source code to obtain a compiled interpreter. Performing host compilation includes inlining code blocks based on the plurality of compiler directives. The compiled interpreter is outputted.

Abstract: The disclosed systems, methods, and computer readable media relate to managing persistent memory within a smart network interface card (smartNIC) of a cloud-computing environment, or at storage device of the host instance on which the smartNIC operates and to which the smartNIC has access. The smartNIC may be configured with various modes that enable passthrough of input/output operations to or from non-volatile remote storage (e.g., a block storage data plane volume) or storage of at least some of the data corresponding to the input/output operations within the persistent memory managed by the smartNIC. The smartNIC may be configured to select a storage location for data between a pool of candidate storage including the persistent storage managed by the smartNIC or the non-volatile remote storage. These techniques improve communications between the smartNIC and the non-volatile remote storage and reduce the risk of network jitters and overall network latency.

Abstract: Techniques are provided for generating training data to facilitate fine-tuning embedding models. Training data including anchor utterances is obtained. Positive utterances and negative utterances are generated from the anchor utterances. Tuples including the anchor utterances, the positive utterances, and the negative utterances are formed. Embeddings for the tuples are generated and a pre-trained embedding model is fine-tuned based on the embeddings. The fine-tuned model can be deployed to a system.

Abstract: Techniques disclosed herein include receiving a request to perform an upgrade. The upgrade can comprise changes to firmware or software of the network interface card. Input/Output (I/O) traffic can be monitored on one or more paths between the network interface card and a storage device. The paths can have a path capacity comprising a bandwidth of Input/Output traffic. The spare Input/Output traffic capacity can be calculated based at least in part on the Input/Output traffic and the path capacity. Whether to remove a path can be determined based at least in part on the spare Input/Output traffic capacity. The upgrade can be performed with the path halted in accordance with a determination to remove the path. The upgrade can be performed with the path included in accordance with a determination to not remove the path.