Abstract: Methods and systems for a multiple domain quality of service software-defined networking (SDN) controller are described. A method includes discovering network devices in a network, collecting traffic flow data from each of the discovered network devices, collecting configuration and operational data from each of the discovered network devices, categorizing the traffic flow data into traffic flow types for presentation as a first level view, determining source and destination pairs for each traffic flow in each of the traffic flow types for presentation as a second level view, generating network device micro-topologies for each of the source and destination pairs for presentation as a third level view, mapping at least one network device characteristic for each network device in each network device micro-topology for presentation as a fourth level view, and performing corrective measures on network devices identified for issues from the presented network device characteristics.

Abstract: A multi-cloud service mesh orchestration platform can receive a request to deploy an application as a service mesh application. The platform can tag the application with governance information (e.g., TCO, SLA, provisioning, deployment, and operational criteria). The platform can partition the application into its constituent components, and tag each component with individual governance information. For first time steps, the platform can select and perform a first set of actions for deploying each component to obtain individual rewards, state transitions, and expected returns. The platform can determine a reinforcement learning policy for each component that maximizes a total reward for the application based on the individual rewards, state transitions, and expected returns of each first set of actions selected and performed for each component. For second time steps, the platform can select and perform a second set of actions for each component based on the reinforcement learning policy for the component.

Abstract: Systems and methods are disclosed for managing workload among server clusters is disclosed. According to certain embodiments, the system may include a memory storing instructions and a processor. The processor may be configured to execute the instructions to determine historical behaviors of the server clusters in processing a workload. The processor may also be configured to execute the instructions to construct cost models for the server clusters based at least in part on the historical behaviors. The cost model is configured to predict a processor utilization demand of a workload. The processor may further be configured to execute the instructions to receive a workload and determine efficiencies of processing the workload by the server clusters based at least in part on at least one of the cost models or an execution plan of the workload.

Abstract: Concepts and technologies are disclosed herein for providing and using a software defined network controller. A software defined network controller can be provided by a computing system that includes a processor. A service model that represents a service can be obtained. A network model that represents network resources that support the service can be obtained. Resources that support the service can be determined. Templates can be accessed to identify templates that relate to the resources. The templates identified can be assembled to obtain a template-based representation of the service. The template-based representation can be executed to determine if the service is ready for deployment.

Abstract: Image transformation for use in a hybrid distribution architecture with improved performance characteristics is provided herein. The hybrid distribution architecture provides content to clients via a dual source system using a central cloud service and a Content Distribution Network, which uses the cloud service as its source. A client that requests a new rendition of an image provided by a chosen source of the hybrid distribution architecture will have that request handled by the source, and the source may maintain that rendition for future provision. By allowing the client to choose the source and letting that source handle the request, rather than requiring a central service hand the request, the amount of data needed to be transmitted is reduced and the speed of provision of content, modified or not, is improved for the client.

Abstract: A method, system and apparatus for protecting from out of bounds memory references, including establishing a threshold number of active objects for examination for an out of bounds memory reference, determining whether a number of active objects for an application exceeds the threshold, and when the number of active objects exceeds the threshold, storing at least part of information about the active objects in an overflow table in a memory.

Abstract: Provided is a virtual machine (VM) management method of simulating a change in deployment of VMs deployed on physical servers including a first physical server and a second physical server physically separated from the first physical server and scheduling deployment of VMs and predicting workload of VMs.

Abstract: A multimedia player downloads chunks (parts of the segment file) during the download of a segment of a stream of segments of a low-latency stream. The first chunks of a segment may be downloaded while the segment is still being written to the CDN server. A chunk-based prediction adaptation logic uses throughput measurements on a chunk instead of a segment and specifically looks at bursts in a sliding window. This data is used to build a prediction of future throughput by applying linear adaptive filter algorithms that may rely on recursive least squares. This adaptation logic leads to very accurate bandwidth predictions and as a consequence, better user experience, compared to existing adaptation algorithms.

Abstract: A computer system hosting (micro)services that uses a service mesh to govern communication between the services. The services include consumer services and an event stream service, the latter directing an event stream from a producer service to the individual consumer services. The control plane of the service mesh has the role of creating and removing service instances. Based on a specified event capacity that is to be provided by the consumer services collectively, the control plane manages service provisioning by estimating the current event capacity of the system. This is done by measuring the event capacities of each consumer service instance and summing them, from which any shortfall or excess of the current event capacity in relation to the specified event capacity can be determined. Consumer service instances are then added in case of a shortfall or removed in case of an excess as needed to avoid over or under-provisioning.

Abstract: A fog service layer architecture is disclosed using hierarchical fog node deployment including the co-existence and interactions of the fog node with a cloud node. The architecture also includes a list of functions, capabilities or services that are hosted in each fog node. One or more fog management procedures may be run between fog nodes (or between fogs and the cloud) and may comprise a fog capability discovery procedure, a fog connection verification procedure, and a fog capability status report procedure. In addition, fog nodes may be configured to interact with each other to get particular services using one or more fog service procedures described herein.

Abstract: In one embodiment of the present invention, a sticky canary router routes each request associated with a service to either a canary cluster of servers that implement a modification to the service or a baseline cluster of servers that do not implement the modification. The sticky canary router implements a mapping algorithm that determines the routing of each request based on a current time, a time window for the routing, and a characteristic of the request. Notably, the mapping algorithm may be implemented such that, for time segments with duration equal to the time window, the sticky canary router routes all requests received from a particular device in a consistent fashion—either to the canary cluster or to a baseline cluster. Configured thusly, the sticky canary router enables the analysis of approximately full sections of client interactions with the canary servers, thereby facilitating identification of client-side effects of the changes.

Abstract: Technologies for predicting computer hardware performance with machine learning are disclosed. Analysis of telemetry data through machine learning and statistical modeling is used to determine whether various components of a compute device such as a fan or memory are failing or are otherwise potentially impacting performance of the compute device. For example, machine-learning-based algorithms may be used to determine an impact of a latency of memory accesses may have on time to execute workloads.

Abstract: A method includes identifying a quality of service (QoS) policy associated with a tenant in view of a tenant identifier. The QoS policy includes a threshold value of a performance parameter. The method also includes receiving a service request from the tenant, estimating, in view of a subset of a plurality of historical records, an impact value indicating an impact of the service request on the performance parameter of the distributed storage system, determining, in view of the impact value, an estimated value of the performance parameter to result from servicing the service request of the tenant, and responsive to an evaluation of the estimated value of the performance parameter in view of the threshold value of the performance parameter, allocating computing resources of the multi-tenant distributed storage system to execute an operation associated with the service request.

Abstract: When a client certificate is required to connect to a client according to a predetermined communication protocol, a server receives a connection request that is a message associated with specific information from the client in a handshake for connection with the client. The server makes a client judgement as to whether or not a cache hit occurs, which is to find a summary client certificate in a cache area using the specific information associated with the connection request. When the result of the client judgement is true, the server returns to the client a connection response including hit information indicating that a cache hit occurs.

Abstract: Systems, devices, and methods discussed herein are directed to intelligently adjusting the set of worker nodes within a computing cluster. By way of example, a computing device (or service) may monitor performance metrics of a set of worker nodes of a computing cluster. When a performance metric is detected that is below a performance threshold, the computing device may perform a first adjustment (e.g., an increase or decrease) to the number of nodes in the cluster. Training data may be obtained based at least in part on the first adjustment and utilized with supervised learning techniques to train a machine-learning model to predict future performance changes in the cluster. Subsequent performance metrics and/or cluster metadata may be provided to the machine-learning model to obtain output indicating a predicted performance change. An additional adjustment to the number of worker nodes may be performed based at least in part on the output.

Abstract: A method of performing transaction processing operations at computing apparatus is provided, together with computing apparatus adapted to manage these operations. The computing apparatus includes a programmed processor adapted to provide the following functional elements. A agent manager node is adapted to install and deinstall transaction processing nodes. A transaction operation rules database holds transaction operation rules. An interface to a transaction processing infrastructure receives transaction data for the transaction processing operations. The transaction processing nodes are adapted to perform the transaction processing operation on the transaction data using the transaction operation rules under control of the agent manager node.

Abstract: This disclosure describes selecting the best hosting server(s) in a particular geographical location for the majority of participants in an interactive electronic activity. A request for an electronic interactive activity involving a plurality of nodes is received. At least one factor related to a plurality of potential servers is evaluated with respect to the plurality of nodes, where at least two of the plurality of potential servers are located in different geographical locations. Based at least in part on evaluating the factors, one or more of the potential servers is selected to host the electronic interactive activity, where the one or more of the potential servers selected are located in the same geographical location.

Abstract: Bandwidth throttling in a browser isolation environment is disclosed. A request is received from a client browser executing on a client device to connect with a remote resource. The browser isolation system provides a surrogate browser to facilitate communications between the client browser and the remote resource. A throttle is applied to a portion of content delivered to the client browser in response to the received request.

Abstract: Disclosed herein are a method for operating a relation server and a system using the method. The method for operating the relation server for managing relations between machines includes generating, by the relation server, a capability set required to execute a command by analyzing the command, and grouping, by the relation server, machines that are to execute the command, among the machines, based on the generated capability set, and capability parameters and status parameters of respective machines that have been previously registered in the relation server or that are extractable by the relation server.

Abstract: Methods, systems, and devices for providing computer implemented services using managed systems are disclosed. To provide the computer implemented services, the managed systems and/or communication devices may need to operate in a predetermined manner conducive to, for example, execution of applications that provide the computer implemented services. To manage communications in such systems, a highly available service may, upon changes in topology of a deployment including managed system and communication devices, initiate a cooperative process for determining how to communicate in the deployment. The process may be performed to select a new global maximum transmission unit (MTU). Once selected, the deployment may be reconfigured based on the selected global MTU to limit the size of network data units. The global MTU may be selected to limit network data unit fragmentation, network data unit dropping, and unused space in data transmissions.

Abstract: An illustrative embodiment disclosed herein is a non-transitory computer readable medium. In some embodiments, the medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to capture a first message transmitted over a packet forwarding control protocol (PFCP) interface, extract a permanent ID and a first user plane tunnel endpoint identifier (TEID) from the first message, store the permanent ID and the first user plane TEID in a PFCP protocol data unit (PDU) session record, store the permanent ID in a session details record, capture a second message transmitted over a user plane interface after the first message is transmitted, extract a second user plane TEID from the second message, wherein the second user plane TEID matches the first user plane TEID, and retrieve the session details record using the second user plane TEID.

Abstract: A universal device identifier (UDID) service with adjusted attribute distances. In one embodiment, a server includes an electronic processor and a memory storing the UDID service. The electronic processor is configured to receive an identification request regarding a currently-observed device having a first set of device attributes, retrieve any previously-observed devices, determine whether one or more devices are found from retrieving the any of the previously-observed devices, determine all changed device attributes for each device of the one or more devices that are found relative to the first set of device attributes, generate an adjusted attribute distance corresponding to the all changed device attributes for the each device, retrieve a universal device identifier (UDID) of a closest device having a lowest adjusted attribute distance among all adjusted attribute distances that are generated, and assign the UDID of the closest device to the currently-observed device.

Abstract: A computing system can include a plurality of clients located outside a cloud-based computing environment, where each of the clients may be configured to encode respective original data with a respective unique secret key to generate data hypervectors that encode the original data. A collaborative machine learning system can operate in the cloud-based computing environment and can be operatively coupled to the plurality of clients, where the collaborative machine learning system can be configured to operate on the data hypervectors that encode the original data to train a machine learning model operated by the collaborative machine learning system or to generate an inference from the machine learning model.

Abstract: A system includes a memory, at least one processor in communication with the memory, a guest hypervisor, and a host hypervisor executing on the at least one processor. The host hypervisor is configured to receive a request for additional memory, request the additional memory from a paravirtualized memory device, allocate the additional memory to the guest hypervisor, and report a status of the request. The status of the request is either a success status or a failure status.

Abstract: An apparatus for a license orchestrator to most efficiently distribute fee-based licenses includes a processor and a memory that stores code executable by the processor to determine that a workload is scheduled to be executed by a computing device. The computing device includes a licensable resource available for execution of the workload. The code is executable to compare a per-use licensing cost associated with using the licensable resource for execution of the workload with a cost of using existing capabilities of the computing device for execution of the workload and license and use the licensable resource for execution of the workload in response to determining that the per-use licensing cost of the licensable resource is less than using the existing capabilities of the computing device.

Abstract: Systems and methods may use models to generate predictions of specific access rights for users. Further, systems and methods may generate the predictions in an environment in which the availability of the specific access rights change frequently. The access rights, predicted using embodiments described herein, may be both available and associated with user affinities. An interface associated with the primary load management system may be configured to display the predicted access rights for a user operating a user device.

Abstract: Examples of services described herein expose an application programming interface (API) which may return the run-time configuration information. In this manner, software external to the service (e.g., an orchestrator) may query the service to determine the run-time configuration information, then provide both the initial configuration information known to the external software and the run-time configuration information to an Internet-facing gateway. Examples described herein may accordingly avoid or reduce instances of an upgrade dependency. When the service is upgraded, the run-time configuration information may be obtained by calling the API without a need to also upgrade the software external to the service.

Abstract: A set of workload criteria is determined from a workload associated with a plurality of sources. The workload is divided among a set of workload groups according to the set of workload criteria and a first workload scheduler. A set of edge computing resources is assigned to each workload group within the set according to the set of workload criteria and the set of workload groups. A portion of the workload associated with a subset of the plurality of sources is handled by a first subset of edge computing resources and a second workload scheduler, where the subset of sources is associated with a first workload group. The handling includes balancing, by the second workload scheduler, the portion of the workload among the subset of sources. The handled workload is reported to a control center.

Abstract: A system for distributing media includes a wide area network (WAN), a media player coupled to the WAN at a first home, and a media server coupled to the WAN at a second home for providing media. A service is coupled to the WAN for receiving a request for media from the media player and for establishing a connection between the first and second homes over the WAN. Media is streamed across the WAN from the second home to the first home. The system may include a storage device coupled to the media player where media is transferred across the WAN for storage at the storage device. A media device may be coupled to the media player for playing the streamed/transferred media where the media player and the media device may comprise a television, stereo, or computer and the media item may comprise video, photographs, or audio.

Abstract: There is provided a system for automating processes, the system comprising at least one computer configured to provide at least one virtual user which interacts with applications and/or documents to run at least one automated process. There is also provided a method of running automated processes, the method comprising the steps of providing at least one computer and providing at least one virtual user on the at least one computer which interacts with applications and/or documents to execute at least one automated process.

Abstract: A method may include obtaining feature data associated with a set of feature inputs of a machine learning model, determining a probability that a subset of the feature data is concurrently used as the set of feature inputs for the machine learning model, and storing the subset of the feature data on a same cache node or server of a plurality of cache nodes or servers based on the probability.

Abstract: Example implementations relate to method and system for data management in a computing system, such as an edge server having a processing resource. During operation, the processing resource collects data from a plurality of smart devices and process a portion of the data at each edge-stage of a plurality of first edge-stages to generate partially processed data. Further, the processing resource evaluates a data processing load at an edge-stage of the plurality of first edge-stages based on a throughput of the edge-stage or a size of a data processing queue of a next edge-stage of the plurality of first edge-stages. The processing resource further pushes the partially processed data to the next edge-stage or a portion of the partially processed data to an external computing system and a remaining portion of the partially processed data to the next edge-stage, based on the data processing load at the edge-stage.

Abstract: Examples herein relate to developing an orchestration plan. Examples disclose the development of a representation of a set of services wherein each service relates to other services via different types of relationships. The examples apply a set of dependency rules for each type of relationship at each service within the set of services such that the application of the set of dependency rules creates inter-service dependencies between state transitions of the set of services. Based on the creation of the inter-service dependencies, the orchestration plan is developed which includes a sequenced order of the state transitions for the set of services.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to improve workload domain management of virtualized server systems. An example apparatus includes a resource pool handler to generate a pool of virtualized servers including a first virtualized server based on a policy, ones of the virtualized servers to be allocated to a workload domain to execute an application, a resource status analyzer to determine a health status associated with the workload domain and determine whether the health status satisfies a threshold based on the policy, and a resource allocator to allocate the first virtualized server to the workload domain to execute the application when the health status is determined to satisfy the threshold.

Abstract: Provided is an information processing apparatus that automatically controls the execution order of print jobs. For example, the image forming apparatus is an information processing apparatus for processing the print jobs. A time deviation calculation unit sets a window of a specific length in the print queue in which the print jobs are stored. A time deviation calculation unit calculates total print time and deviation of the print time of the print jobs in the window. The print control unit controls the execution order of the print jobs in the window based on the total print time and the deviation calculated by the time deviation calculation unit. The output unit outputs the print jobs in the execution order controlled by the print control unit.

Abstract: Digital pass verification systems and methods are disclosed herein. One or more servers are to distribute instructions on a network. The instructions, when executed, cause a first device carried by a person to at least: access a result of a diagnostic test performed on the person, the result provided by a second device; generate a machine-readable code in response to the result being negative; and display the machine-readable code on a display of the first device to enable the person to gain access to a location.

Abstract: A method for remote access includes obtaining, by a virtual private network (VPN) server, trust data of a user accessing a first network; determining, by the VPN server, a first trust level corresponding to the trust data according to a first correspondence, wherein the first correspondence comprises the trust data and the first trust level; determining, by the VPN server, a first access zone of the first network corresponding to the first trust level according to a second correspondence, wherein the second correspondence comprises the first trust level and the first access zone; and establishing, by the VPN server, a first VPN connection between a device used by the user and the first access zone.

Abstract: A cloud tracking system may store configuration data separately for each account of multiple accounts that an entity has with a cloud computing provider and may aggregate the configuration data into a data structure that stores the configuration data together for the multiple accounts. The cloud tracking system may receive a request that includes a user identifier of a user associated with the entity and may search for the user identifier in the data structure. The cloud tracking system may identify a set of deployed cloud computing services associated with the user identifier based on searching for the user identifier in the data structure, wherein the set of deployed cloud computing services is associated with more than one account of the multiple accounts. The cloud tracking system may identify one or more deployed cloud computing services, of the set of deployed cloud computing services, that are outdated.

Abstract: A secured virtual container is enabled to securely store personal data corresponding to a user, where such data is inaccessible to processes running outside the secured virtual container. The secured virtual container may also include an execution environment for a machine learning model where the model is securely stored and inaccessible. Personal data may be feature engineered and provided to the machine learning model for training purposes and/or to generate inference values corresponding to the user data. Inference values may thereafter be relayed by a broker application from the secured virtual container to applications external to the container. Applications may perform hyper-personalization operations based at least in part on received inference values. The broker application may enable external applications to subscribe to notifications regarding availability of inference values. The broker may also provide inference values in response to a query.

Abstract: A compute server receives a request from a client device that triggers execution of a third-party code piece. The compute server is one of multiple compute servers that are part of a distributed cloud computing network. The request may be an HTTP request and directed to a zone. A single process at the compute server executes the third-party code piece in an isolated execution environment. The single process is also executing other third-party code pieces in other isolated execution environments respectively. A response is generated to the request based at least in part on the executed third-party code piece, and the generated response is transmitted to the client device.

Abstract: Disclosed herein are system, method, and computer program product embodiments for preemptively evaluating whether roles are over-privileged within an (IAM) identity and access management system. Roles may be over-privileged when they are granted permissions to perform certain actions outside the scope granted to those roles. The evaluation occurs without submitting the certain actions to the IAM system and allows roles to be evaluated on a preemptive basis so that corrective actions may be taken to prevent unauthorized access to resources. Roles may be associated with policies which may each define different permissions for accessing resources. The evaluation may involve generating an effective policy from the policies associated with a role to provide a comprehensive view of all permissions associated with the role.

Abstract: Storage efficiency driven migration includes: determining a level of similarity between first data stored on a first storage system and second data stored on a second storage system; determining, in dependence upon the level of similarity, that an expected amount of storage space reduction from migrating similar data exceeds a threshold level; and responsive to determining that the expected amount of storage space reduction exceeds the threshold level, initiating a migration of one or more portions of the first data from the first storage system to the second storage system.

Abstract: A personal digital key (e.g., which can be carried by a human) contains a memory having different service blocks. Each service block is accessible by a corresponding service block access key. As the personal digital key (PDK) moves around, it is detected by sensors. The sensors report position data, thus enabling location tracking of the PDK. The sensors also provide a data path to various applications. An application that has access to a service block access key can therefore access the corresponding service block on the PDK. The sensors themselves may also contain service block access keys.

Abstract: The present invention provides an image forming apparatus comprising: at least one first module and at least one second module configured to execute functions corresponding respectively to the at least one first module; a first control unit configured to notify, to a corresponding second module, a request accepted by the at least one first module; and a second control unit configured to control in accordance with the notification from the first control unit, the corresponding second module, wherein the at least one first module is activated at all times from when the image forming apparatus is activated, and the at least one second module is generated as a container of an execution environment that is independent of an operating system and whose activation state is controlled by an instruction from the second control unit.

Abstract: Provided are methods and systems related to communications between a social media service or provider (e.g., Twitter®, Facebook®) or other resource (e.g., web page) and one or more content providers. In an aspect, provided are methods, comprising receiving user information and a user agnostic identifier, providing an access element configured to provide access to content from a content provider based on the user information and the user agnostic identifier, receiving, from the content provider, a notification indicative of a user interaction with the content based on a user accessing the content, and tracking user behavior based on at least one of the user information, the user agnostic identifier, the access element, and the notification.

Abstract: While scheduled checkpoints are being taken of a cluster of active compute nodes distributively executing an application in parallel, a likelihood of failure of the active compute nodes is periodically and independently predicted. Responsive to the likelihood of failure of a given active compute node exceeding a threshold, the given active compute node is proactively migrated to a spare compute node of the cluster at a next scheduled checkpoint. Another spare compute node of the cluster can perform prediction and migration. Prediction can be based on both hardware events and software events regarding the active compute nodes.

Abstract: A method and network node are provided for dimensioning a network service (NS). The method comprises calculating, based on given capacity requirements of the NS, a required number of virtual network functions component (VNFC) instances of each of a plurality of virtual network function (VNF) in the NS; selecting a VNF deployment flavor (VnfDf) for each of the plurality of VNFs in the NS, based on the calculated required number of VNFC instances; generating a network service deployment flavor (NsDf) including the selected VnfDfs; and onboarding a network service descriptor (NSD), which includes the NsDf, for use for instantiating the dimensioned NS.

Abstract: A device may receive CNF data identifying a CNF to be deployed in a network. The device may perform multiple levels of validation associated with deploying the CNF. The device may determine, based on performing the multiple levels of validation, whether one or more issues are associated with deploying the CNF in the network. The one or more issues may include one or more of: a connectivity issue, a package issue, a network functions virtualization orchestrator (NFVO) issue, or a network functions virtualization infrastructure (NFVI) issue. The device may perform one or more actions based on determining whether the one or more issues are associated with the deploying the CNF in the network.

Abstract: Resource allocation limitations include resource limits and resource guarantees. A consumer is vulnerable to interruption by other consumers if using more resources than guaranteed. Resources are designated and/or assigned to consumers based on resource limits and resource guarantees. A constraint programming (CP) solver determines resource limits and resource guarantees that minimize vulnerability and/or vulnerability cost based on resource usage data. A CP data model includes limit elements, guarantee elements, and vulnerability elements. The CP data model further includes guarantee-vulnerability constraints, which relies on exceedance distributions generated from resource usage data for the consumers. The CP data model declaratively expresses combinatorial properties of a problem in terms of constraints. CP is a form of declarative programming.

Abstract: Systems, methods, and devices for secure and configurable control of user equipment (UE) devices associated with enterprise accounts are disclosed herein. Each enterprise account is associated with a plurality of UE devices, which may access networked assets associated with the enterprise. In order to manage UE device access to enterprise assets and to other networks via an internet connection through a wireless telecommunications network, data associated with different enterprise accounts is virtually separated at the edge routers and maintained as separate data streams to distinct virtual environments associated with the enterprise accounts at one or more asset hosting servers. The virtual environments on the assets hosting servers further facilitate enterprise-specific control of mobile assets, such as enforcing security policies relating to access, connections, filtering, or encryption.