Abstract: Systems and methods are provided for generating extract-transform-load (“ETL”) machine learning (“ML”) pipeline validation rules based on user-input, wherein the ETL ML pipeline validation rules may be applicable to validate an ETL ML pipeline against multiple test datasets. The ETL ML pipeline validation rules may comprise compute-type validation rules for computing expected values of data structures within a dataset output by the ETL ML pipeline. The ETL ML pipeline validation rules may comprise check-type validation rules for checking whether data structures within a dataset output by the ETL ML pipeline have intended characteristics. Where the ETL ML pipeline validation rules are applicable to validate an ETL ML pipeline against a test dataset which was not referenced to describe the ETL ML pipeline validation rules, then the ETL ML pipeline may reuse these ETL ML pipeline validation rules to validate the ETL ML pipeline without further user-input.

Abstract: Systems and methods are provided for implementing pattern detection as a first step for security improvements of a computer network. The pattern detection may utilize a machine learning (ML) model for predicting network tuple parameters. The ML model can be trained on labelled data flow information and deployed by a central server for preventing network-wide cyber-security challenges (e.g., including DNS flux, etc.). Networking devices (e.g. switches, etc.) can monitor the data flow traffic that it receives from the networking devices and classify network tuple parameters based on the flow behavior. The system can compare the output of the ML model (e.g., a classification of the data flow traffic, etc.) to an implicit label (e.g., the network tuple parameter included with the data flow traffic, etc.). When the classification matches a particular network tuple parameter, the system can generate an alert and/or otherwise identify potential network intrusions and other abnormalities.

Abstract: One aspect of the instant application facilitates automatic policy engine selection. During operation, a system can monitor a network including a set of network devices. The system can receive, based on the monitoring, a set of attributes associated with the network. At least two network devices are equipped with a different policy enforcement engine for enforcing one or more given policy rules. The system can apply a unified policy model to determine, based on the set of attributes, an assignment of the one or more given policy rules to the first policy enforcement engine and the second policy enforcement engine for providing an optimized policy enforcement. The system may then select based on the assignment, one or both of the first policy enforcement engine and the second policy enforcement engine. The system may activate the selected one or both policy enforcement engines for enforcing the given policy rules.

Abstract: Examples for handling ownership of process threads include acquiring ownership of a set of process threads to assign ownership of a subject process thread to an ownership agent. In some examples, acquiring ownership may include acquiring ownership of process threads with a wait event. During acquiring ownership of the set of process threads, one or more process threads that are acquired may be released to attend to an event that has occurred. A thread coordinator that handles ownership during acquiring phase may release and rebid one or more process threads. Upon acquiring all the process threads, the ownership of the subject process thread is assigned to an ownership agent. With a set of ownership conditions, the process threads are acquired efficiently within reduced time and with reduced deadlocks.

Abstract: Examples described herein are generally directed to facilitating access to container state through multiple protocols. According to an example, a distributed state store is provided in which container state is accessible by multiple client containers via nodes of the distributed state store across which the container state is replicated. Responsive to receipt from a first client container of a storage request via a first application programming interface (API) method of the distributed state store that is associated with a first protocol, the container state is stored within the distributed state store. Responsive to receipt from a second client container of an access request via a second API method of the distributed state store that is associated with a second protocol, the container state is returned to the second client container via the second protocol.

Abstract: One aspect provides a system for hardware-assisted pre-execution. During operation, the system determines a pre-execution code region comprising one or more instructions. The system increments a global counter upon initiating the one or more instructions. The system issues a first instruction, which involves setting, in a first entry for the first instruction in a data structure, a first prefetch region identifier with a current value of the global counter. Responsive to a head pointer of the data structure reaching the first entry, the system: determines, based on a non-zero value for the first prefetch region identifier, that the first entry is not available to be allocated; and advances the head pointer to a next entry in the data structure, which renders a load associated with the first entry as a non-blocking load. The system resets the global counter upon completing the one or more instructions.

Abstract: Example implementations relate to metadata operations in a storage system. An example includes a machine-readable medium storing instructions that upon execution cause a processor to: receive a data stream to be stored in persistent storage of a deduplication storage system; store data units of the data stream in a container entity group object according to arrival time, where the data units of the container entity group object are referenced by a plurality of container indexes; generate a data index to list each container index that references at least one data unit included in the container entity group object; and in response to a determination that the total size of the container entity group object exceeds the threshold size, transfer the container entity group object from memory to the persistent storage.

Abstract: Systems and methods are provided for correlating a person/event of interest with other persons based on mobile device usage/location. Personally identifiable information can be kept hidden/obfuscated to protect user privacy in the case of a person of interest, as well as persons correlated to that person/event of interest. Information can be anonymized and posted for sharing with mobile device service providers, such as cellular carriers. A remotely-executed and customizable correlation engine can identify those cellular subscribers that were near/in the same location as the user. A notification alert can be sent, e.g., via an Amber Alert-like system to cellular subscribers that have been in proximity to the user or known areas in which events-of-interest have occurred. Location-based datasets can be flattened into an optimized data structure reflecting preferred location logics, and an application programming interface (API) and obfuscation layer can be used based on the flattened datasets.

Abstract: Examples of techniques for handling unsolicited probe responses are disclosed. In an example, occurrence of an attack on an access point (AP) in an enterprise Wireless Local Area Network (WLAN) is detected based on an unsolicited probe response and Robust Security Network Information Element (RSN IE). Responsive to detecting the attack, unsolicited probe responses at the AP is disabled. Further, Fast initial Link Setup (FILS) discovery at the AP is enabled.

Abstract: Implementations of the present disclosure relate to intrusion detection information. A method comprises detecting, by an access point (AP), at least one device in a wireless communication network to be an illegal device. The method also comprises obtaining, by the AP, intrusion detection information related to the at least one device, the intrusion detection information comprising at least one identifier of the at least one device.

Abstract: Techniques are provided for dynamically generating and executing scripts and loading documents based on container engine events in a Containers-as-a-Service (CaaS) platform. A request to generate an item, which can be either a script or a document, in an application running in a container of a cloud environment is received. Based on the request, at least one container engine event associated with the application is monitored. The at least one container engine event is detected. The item is generated based on the detection of the at least one container engine event. The generated item is instantiated in the application in accordance with a type of the generated item.

Abstract: Examples described herein relate to an authentication management system and a method for managing authentication of a user between an enterprise-level authentication protocol and a cloud-native authentication protocol. The authentication management system may receive an authentication request from an application hosted on a private on-premise network to authenticate a user using the enterprise-level authentication protocol. The authentication request is generated by the application upon receiving an access request from the user via a software as-a-service (SaaS) cloud platform in a cloud-native authentication protocol. Further, the authentication management system may generate an authentication response compliant with the enterprise-level authentication protocol based on an authentication reply that is formatted in compliance to the cloud-native authentication protocol and received from a cloud-native identity and authentication management system based on the authentication request.

Abstract: A system and a method for eliminating data loss in a virtually aggregated network are described. A first network device may identify inactivity of a central network device present in a communication network. The central network device is responsible for distributing routing information between a plurality of network devices including the first network device. The first network device delays network route calculations until a second network device is elected from the plurality of network devices to perform functions of the central network device. The second network device generates link state information related to the plurality of network devices, and shares the link state information with the plurality of network devices. Upon receiving the link state information, the plurality of network device may resume the route calculations.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: Examples of implementing a communication session within a cluster computing environment are described. In an example, a communication session, initially being established by a first application server instance is continued through a second application server instance. Thereafter, a mid-session request received from a communication network may be directed to the second application server instance, wherein the mid-session request pertains to the communication session.

Abstract: Embodiments described herein are generally directed to integration of multiple services across multiple clouds within a unified IAM control plane. According to an example, an MSP provides (i) a user interface through which users of multiple tenants are able to configure permissions for and access multiple resources of a set of services associated with a hybrid cloud; and (i) a unified IAM control plane across the set of services, each of which potentially uses a different IAM protocol or scheme. A centralized IAM service is maintained by the MSP containing information regarding the permissions for the resources. Multiple service integrations for the set of services are supported by the MSP, including providing a first set of APIs that facilitate a direct integration with the unified IAM control plane in which the centralized IAM service maintains access control information for resources associated with a first service of the set of services.

Abstract: Example implementations relate to method and system for an action contextual grouping of servers for applying one or more actions to each group. The method includes analyzing data corresponding to a plurality of servers and a management system to generate a dataset including contextual data and server features. The method further includes obtaining a plurality of actions from the management system, and mapping each action to a plurality of criteria to generate an action criteria table. The plurality of criteria includes dynamic contextual criteria derived by the management system based on at least some of contextual data. The method further includes comparing the plurality of criteria for each action in the action criteria table to the contextual data and/or the server features for each server to tag a corresponding server to the action, and grouping the plurality of servers into a plurality of action contextual groups based on the tag.

Abstract: Composable computing architectures with an interconnection fabric to provide high availability and fault tolerance are described. An interconnection fabric routes packets between compute resources, memory resources, and input/output (I/O) resources. A fabric manager is coupled with the interconnection fabric to receive an I/O or memory requirement for a compute workload for a host device, and to map individual I/O or memory resources from the plurality of I/O resources to individual compute resources from the plurality of compute resource and to dynamically map individual I/O resources from the plurality of I/O resources based on received resource requests.

Abstract: Examples described herein mitigate adjacent channel interference for dual radios of a network device. Examples described herein may associate, by a network device, a first client device with a first radio of the network device, associate, by the network device, a second client device with a second radio of the network device, determine that the first and second client devices are within a steering threshold, and based on the determination that the first and second client devices are within the steering threshold, steer, by the network device, the second client device from the second radio to the first radio. Examples described herein may communicate, using the first radio of the network device, with the first and second client devices.

Abstract: Example implementations relate to storing data in a storage system. An example includes receiving, by a storage controller of a storage system, a data unit to be stored in persistent storage of the storage system. The storage controller determines maximum and minimum entropy values for the received data unit. The storage controller determines, based on at least the minimum entropy value and the maximum entropy value, whether the received data unit is viable for data reduction. In response to a determination that the received data unit is viable for data reduction, The storage controller performs at least one reduction operation on the received data unit.