Abstract: Example embodiments relate to work conserving bandwidth guarantees using priority, and a method for determining VM-to-VM bandwidth guarantees between a source virtual machine (VM) and at least one destination VM, including a particular VM-toVM bandwidth guarantee between the source VM and a particular destination VM. The method includes monitoring outbound network traffic flow from the source VM to the particular destination VM. The method includes comparing the outbound network traffic flow to the particular VM-to-VM bandwidth guarantee. When the outbound network traffic flow is less than the particular VM-to-VM bandwidth guarantee, packets of the flow are directed according to a first priority. When the outbound network traffic flow is greater than the particular VM-to-VM bandwidth guarantee, packets of the flow are directed according to a second priority.

Abstract: A system, method, and non-transitory computer readable medium for virtualizing battery in a personal mobile device or across a group of personal mobile devices controlled by a user are provided. The user specifies a set of power management policies for applications running in the personal mobile device(s). Battery usage per application is monitored and resources for the applications are scheduled based on the monitored battery usage and the power management policies.

Abstract: Identifying a component within an application executed in a network includes obtaining a traffic matrix, the traffic matrix defining a rate for which packets of data are exchanged between VMs corresponding to an application, analyzing the traffic matrix to identify VMs within a component, modifying the traffic matrix to create a modified traffic matrix, and defining, for the application, a tenant application graph (TAG) model based on the modified traffic matrix.

Abstract: Distributed data structures in a software defined networking (SDN) environment is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to access a tree data structure located at a central node in the SDN environment, retrieve, at a local node of the network, a sub-tree of the data structure, the sub-tree determined based on a management policy associated with the local node or the central node, and cache sub-trees of the data structure at respective local nodes to generate a distributed data structure in the environment.

Abstract: An example method for allocating resources in accordance with aspects of the present disclosure includes collecting proposals from a plurality of modules, the proposals assigning the resources to the plurality of modules and resulting in topology changes in a computer network environment, identifying a set of proposals in the proposals, the set of proposals complying with policies associated with the plurality of modules, instructing the plurality of modules to evaluate the set of proposals, selecting a proposal from the set of proposals, and instructing at least one module associated with the selected proposal to instantiate the selected proposal.

Abstract: Each network policy of network policies specifies at least one characteristic of communications allowed between endpoint groups, each endpoint group of the endpoint groups including at least one endpoint. The network policies are merged according to composition constraints included in the network policies.

Abstract: In some examples, a method includes parsing, by a network device, a section of source code associated with a network function provided by a middlebox in a network; extracting, by the network device, a packet processing slice and a state transition slice from the section of source code; generating, by the network device, a plurality of execution paths from the packet processing slice and the state transition slice; and modeling the middlebox by inserting, by the network device, the plurality of execution paths to a match-action table that describes a packet processing model for the middlebox.

Abstract: In some examples, a method includes parsing, by a network device, a set of flow rules and network function configurations to identify an equivalent class of packets passing through network function chains; identifying, by the network device, a plurality of paths that packets belonging to the equivalent class pass through; computing, by the network device, a first set of Service Level Agreement (SLA) performance metrics for the equivalent class; constructing, by the network device, a set of stateful forwarding criteria comprising the first set of SLA performance metrics; and verifying, by the network device, whether the network function chains comply with a SLA based on the stateful forwarding criteria.

Abstract: In some implementations, a method includes conducting, by a network device, a query associated with a network function chain comprising a plurality of switches and middleboxes to verify whether a service performed by the network function chain complies with a Service Level Agreement (SLA); computing, by the network device, based on a result of the query, a difference in metric value between an actual performance metric of a packet passing through a path in the network function chain and an expected performance metric of the packet passing through the path; deriving, by the network device, a probability of SLA violation associated with the path based on the difference in metric value; and selectively monitoring, by the network device, a network of network function chains by monitoring the path for passive performance measurements based on the probability of SLA violation.

Abstract: In some examples, a system can verify a network function by inquiring a model using a query language is described. In some examples, the system can include at least a memory and a processor coupled to the memory. The processor can execute instructions stored in the memory to transmit a plurality of packets into at least one network function that is unverifiable; describe the at least one network function using a model comprising a set of match action rules and a state machine; inquire the model using a query language comprising a temporal logic to obtain a query result indicating an expected behavior of the plurality of packets; and verify the at least one network function based on the query result and the expected behavior of the plurality of packets.

Abstract: According to an example, a method for bandwidth guarantee and work conservation includes determining virtual machine (VM) bandwidth guarantees assigned to VMs in a network including a source VM that communicates with destination VMs. The method further includes assigning minimum bandwidth guarantees to communications between the source VM with the destination VMs by dividing a VM bandwidth guarantee assigned to the source VM between the destination VMs based on active VM-to-VM communications between the source VM and the destination VMs. The method also includes allocating, by a processor, spare bandwidth capacity in the network to a communication between the source VM and a destination VM based on the assigned minimum bandwidth guarantees.

Abstract: Example implementations disclosed herein can be used to generate composite network policy graphs based on multiple network policy graphs input by network users that may have different goals for the network. The resulting composite network policy graph can be used to program a network so that it meets the requirements necessary to achieve the goals of at least some of the network users. In one example implementation, a method can include receiving multiple network policy graphs, generating composite endpoint groups based on relationships between endpoint groups and policy graph sources, generating composite paths based on the relationships between the endpoints and the network policy graphs, generating a composite network policy graph based on the composite endpoint groups and the composite paths, and analyzing the composite network policy graph to determine conflicts or errors.

Abstract: Example implementations disclosed herein can be used to allocate network resources in a software defined network (SDN). In one example implementation, a method can include receiving a plurality of resource allocation proposals from a plurality of controller modules, instructing the controller modules to generate votes for the plurality of resource allocation proposals, and selecting one of the plurality of resource allocation proposals based on the votes to instantiate the selected resource allocation proposal in the SDN.

Abstract: A system, method, and non-transitory computer readable medium for virtualizing battery in a personal mobile device or across a group of personal mobile devices controlled by a user are provided. The user specifies a set of power management policies for applications running in the personal mobile device(s). Battery usage per application is monitored and resources for the applications are scheduled based on the monitored battery usage and the power management policies.

Abstract: Placing virtual machines (VMs) on physical hardware to guarantee bandwidth includes obtaining a Tenant Application Graph (TAG) model, the TAG model representing a network abstraction model based on an application communication structure between VMs of components, determining bandwidths for the components based on the TAG model, and placing the VMs of the components on physical hardware based on the bandwidths for the components.

Abstract: Identifying a component within an application executed in a network includes obtaining a traffic matrix, the traffic matrix defining a rate for which packets of data are exchanged between VMs corresponding to an application, analyzing the traffic matrix to identify VMs within a component, modifying the traffic matrix to create a modified traffic matrix, and defining, for the application, a tenant application graph (TAG) model based on the modified traffic matrix.

Abstract: A system, method, and non-transitory computer readable medium for virtualizing battery in a personal mobile device or across a group of personal mobile devices controlled by a user are provided. The user specifies a set of power management policies for applications running in the personal mobile device(s). Battery usage per application is monitored and resources for the applications are scheduled based on the monitored battery usage and the power management policies.

Abstract: A clustering-based method of estimating a network metric between a first node and a second node includes determining source clusters of nodes and destination clusters of nodes for each node. Cluster heads are selected for each cluster. Measurements of the network metric between each node and each cluster head for the source clusters and destination clusters are performed, and the network metric for a pair of nodes is estimated based on the measurements for the pair of nodes.

Abstract: An example method for allocating resources in accordance with aspects of the present disclosure includes collecting proposals from a plurality of modules, the proposals assigning the resources to the plurality of modules and resulting in topology changes in a computer network environment, identifying a set of proposals in the proposals, the set of proposals complying with policies associated with the plurality of modules, instructing the plurality of modules to evaluate the set of proposals, selecting a proposal from the set of proposals, and instructing at least one module associated with the selected proposal to instantiate the selected proposal.

Abstract: Example embodiments relate to work conserving bandwidth guarantees using priority. In some examples, a method may include determining VM-to-VM bandwidth guarantees between a source virtual machine (VM) and at least one destination VM, including a particular VM-to-VM bandwidth guarantee between the source VM and a particular destination VM. The method may include monitoring outbound network traffic flow from the source VM to the particular destination VM. The method may include comparing the outbound network traffic flow to the particular VM-to-VM bandwidth guarantee. When the outbound network traffic flow is less than the particular VM-to-VM bandwidth guarantee, packets of the flow may be directed according to a first priority. When the outbound network traffic flow is greater than the particular VM-to-VM bandwidth guarantee, packets of the flow may be directed according to a second priority.