Abstract: A knowledge base can include a dictionary associated with classes of a model, e.g., an ontology. A text segment that is not found in the dictionary can be received. Feature(s) can be determined for the text segment and, based partly on providing the feature(s) to a classifier, a set of values can be determined. The distribution can include values respectively corresponding to the classes. One of the values can be greater than a predetermined threshold. That value can correspond to a class. An indication identifying the class can be presented via a user interface having functionality to provide input that the text segment is associated with the class, is not associated with the class, or is associated with another class. Based at least partly on adding a new class to the ontology, a precedence table indicating priorities between motifs defining relationships between classes of the ontology can be updated.

Abstract: A system for managing allocation of resources based on service level agreements between application owners and cloud operators. Under some service level agreements, the cloud operator may have responsibility for managing allocation of resources to the software application and may manage the allocation such that the software application executes within an agreed performance level. Operating a cloud computing platform according to such a service level agreement may alleviate for the application owners the complexities of managing allocation of resources and may provide greater flexibility to cloud operators in managing their cloud computing platforms.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: Disclosed herein is a system and method for generating an enhanced index for documents contained in a knowledge base. Documents or configuration snapshots are tokenized and then passed through a number of filters. The filters modify the token stream to generate an enhanced token stream for the document by removing words from the stream and adding domain level knowledge to the tokens in the stream. The token stream is then added to the index for the document so that searches can be completed against the knowledge base when searches are generated from configuration snapshots or from inputted search queries.

Abstract: There is provided a method and system for process migration in a data center network. The method includes selecting processes to be migrated from a number of overloaded servers within a data center network based on an overload status of each overloaded server. Additionally, the method includes selecting, for each selected process, one of a number of underloaded servers to which to migrate the selected process based on an underload status of each underloaded server, and based on a parameter of a network component by which the selected process is to be migrated. The method also includes migrating each selected process to the selected underloaded server such that a migration finishes within a specified budget.

Abstract: Computing systems for efficient incident management in large scale computer systems are described herein. In one embodiment, an incident management system can be configured to, in response to receiving a user input requesting an unidentified incident management service, convert an alphanumerical string of the user input into a pixelated matrix having multiple pixels individually corresponding to a character or number in the alphanumerical string. The incident management system can then feed the converted pixelated matrix into a neural network to identify one or more incident management services corresponding to the received user input with a corresponding probability value. The incident management system can then perform an application programming interface (API) call to execute a computer application to provide one of the identified incident management services to the user.

Abstract: When a computing device has an issue, a detector receives (or retrieves) data associated with the computing device. The data may include parameter key-value pairs. The detector creates queries based on the data and distributes the queries to one or more matching engines, such as an exact matching engine or a proximity matching engine. The one or more matching engines look for matches in an index of database documents. The results from the one or more matching engines are ranked based on relevancy scores. In some cases, users may provide feedback regarding the relevancy of the results and the feedback may be used to recalibrate how the relevancy scores are determined.

Abstract: A performance-based storage service level agreement (SLA) can be established that specifies one or more storage performance parameters. A storage allocation process can include receiving a request for a storage SLA that specifies one or more storage performance parameters, determining, for a virtual machine (VM) and based at least in part on the one or more storage performance parameters in the storage SLA: (i) a storage location among a set of candidate storage locations, and (ii) an amount of storage to allocate. The amount of storage can then be allocated at the storage location for the VM to use in making storage requests. Runtime enforcement of the storage SLA can utilize a scheduling mechanism that buffers individual storage requests into different queues that are used for meeting one or more storage performance requirements specified in storage SLA.

Abstract: User feedback may be analyzed with semantic hierarchies. In some instances, the user feedback includes free-form text. The user feedback may be mapped to one or more semantic hierarchies that include multiple levels of nodes, where each node corresponds to a class. Information of the one or more semantic hierarchies may be mapped to an ontology model. The mapped information of the ontology model may be used to identify an actionable item for the user feedback, such as a problem, suggestion, question, or other issue. Information regarding the actionable item may be made available to an individual for evaluation of the actionable item.

Abstract: A computing device can receive at least one document including text segments. The computing device can determine a characteristic pattern associated with a first text segment of the text segments and determine an association between the first text segment and a first individual class of a model based at least in part on the characteristic pattern. The computing device can determine a collection of classes of the model associated with the at least one document based at least in part on the association, and determine an actionable item associated with the at least one document based at least in part on the collection and at least one grammar pattern. The computing device can present or transmit an indication of the actionable item. In some examples, the computing device can arrange actionable items in an order based at least in part on occurrences of the actionable items from multiple documents.

Abstract: Described herein are various technologies pertaining to providing assistance to an operator in a data center with respect to failures in the data center. An alarm is received, and a failing device is identified based upon content of the alarm. Failure conditions of the alarm are mapped to a failure symptom that may be exhibited by the failing device, and troubleshooting options previously employed to mitigate the failure symptom are retrieved from historical data. Labels are respectively assigned to the troubleshooting options, where a label is indicative of a probability that a troubleshooting option to which the label has been assigned will mitigate the failure symptom.

Abstract: Described herein are various technologies pertaining to providing assistance to an operator in a data center with respect to failures in the data center. An alarm is received, and a failing device is identified based upon content of the alarm. Failure conditions of the alarm are mapped to a failure symptom that may be exhibited by the failing device, and troubleshooting options previously employed to mitigate the failure symptom are retrieved from historical data. Labels are respectively assigned to the troubleshooting options, where a label is indicative of a probability that a troubleshooting option to which the label has been assigned will mitigate the failure symptom.

Abstract: Methods, systems, and apparatuses are provided for enabling an automated handling of information technology incidents in a computing environment. An incident report relating to an incident in a computing environment is received. Based on the incident report, a feature vector is generated and provided as an input to a machine-learning model that may output one or more suggested actions to respond to the incident. For instance, the machine-learning model may be trained based on previous actions performed by a user in response to previous incident reports. A user interface is provided allowing a user to select one or more of the suggested actions. In response to the user's selection, the selected actions may be executed automatically. By orchestrating a set of actions to execute automatically, incident reports may be addressed in a timely and efficient manner.

Abstract: Methods for automatic and intelligent electronic communication support, including using machine learning, are performed by systems and apparatuses. The methods intelligently and automatically route electronic communication support requests and intelligently and automatically provide senders with information related to their support requests. The methods generate feature vectors from cleaned request information via featurization techniques, and utilize machine-learning algorithms/models and algorithm/model outputs based on the input feature vectors. Based on the algorithm/model outputs and personalized to the specific sender, relevant support information is automatically provided to the sender. The methods also determine a set of prior communications related to the support request based on a similarity measure, and provide prior communication information to the sender. The methods also include routing support requests to correct feature owner recipients based on the algorithm/model outputs.

Abstract: Methods for automatic and intelligent incident routing are performed by systems and apparatuses. The methods intelligently optimize routing of incidents to correct owners from a pool of many possible owners by utilizing learning models and algorithms based on feature vectors. Users provide information related to incidents of services or systems. The information is cleaned and featurized to generate a feature vector for the incident. The systems and apparatuses intelligently and automatically determine sets of candidate recipients based on outputs of algorithms, e.g., machine learning algorithms, such as classifiers using the feature vectors as inputs. Classifiers may utilize models or algorithms trained with featurizations used for feature vectors. Sets of candidate recipients are provided to users for selection of a recipient for the information from the set of candidate recipients instead of from all the possible recipients.

Abstract: Bandwidth requirement specifications in a multi-tenant datacenter are implemented using resource-bundle level queues and tenant level queues. Data is transmitted via the resource-bundle level queues and the tenant level queues according to the bandwidth requirement specifications, such that minimum bandwidth requirements are maintained for data being transmitted and for data being received.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: The described implementations relate to computer networking. One implementation is a method performed using one or more computing devices. The method can include obtaining first performance data reflecting performance by first networking components of a first classification and, based at least on the first performance data, determining a first expected service level of a first redundant configuration of the first networking components. The method can also include obtaining second performance data reflecting performance by second networking components of a second classification, and, based at least on the second performance data, determining a second expected service level of a second redundant configuration of the second networking components.