Abstract: Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.

Abstract: A computer system and a method are disclosed for use in automatically deploying an application program to execute with one or more library resources. The computer system includes a deployment unit which deploys the application program into a runtime execution environment. When a predetermined trigger condition is detected, the deployment unit clones a first library resource to create a clone, transforms the application to depend upon the clone and resolves the dependencies of the application using the clone. In one embodiment, the trigger condition relates to a pinning situation, whereby a library upon which the application program depends cannot be wired to the application program to resolve the dependency. Here, the clone now satisfies that dependency. In another embodiment, the trigger condition is a mandatory cloning property that requires the library to be cloned. The mandatory cloning property may also be user-specified through a user interface.

Abstract: A computer system which configures an application program to execute with one or more resources is disclosed. The computer system includes a configuration unit to configure the application program for deployment into a runtime execution environment. The application program is divided into a plurality of bundles and the configuration unit examines the bundles individually to determine a bundle environment for each bundle based on dependencies of that bundle on the one or more resources. The configuration unit selects one or more conventions, which provide templates of configuration for a relevant resource, according to the determined bundle environment, and the configuration unit automatically generates a system configuration from the selected conventions and adds the generated system configuration to the application program, whereby the dependencies of the application program upon the resources are configured based on at least the automatically generated system configuration.

Abstract: A virtualized platform includes a virtual switch connected to the virtual network interface cards (vNICs) for a group of virtual machines running the same application program that is associated with multiple software ports. A module in the virtualized platform monitors the virtual switch's receipt of a network packet that includes control information relating to the application program and its software ports. The module applies a load balancing algorithm to select a vNIC from the vNICs connected or connectable to the virtual switch, based on the rate of processing of previous network packets by each the vNICs (e.g., as measured by the size of a network packet queue). The module might also apply the load balancing algorithm to select a software port for the application. The module then causes the virtual switch to route the network packet to the selected vNIC and software port.

Abstract: A computer implemented method for configuring virtual internal networks for testing is provided. The method includes deploying a virtual firewall and deploying a public switch enabling access to an external local area network through a first interface of the virtual firewall. A private switch enabling access to a plurality of virtual machines through a second interface of the virtual firewall is provided. The plurality of virtual machines define a private network behind the firewall. A network address is assigned to the virtual firewall and a private address is assigned to each of the virtual machines. The plurality of virtual machines are then tested through a test launcher in communication with the public switch.

Abstract: To generate a checkpoint for a virtual machine (VM), first, while the VM is still running, a copy-on-write (COW) disk file is created pointing to a parent disk file that the VM is using. Next, the VM is stopped, the VM' s memory is marked COW, the device state of the VM is saved to memory, the VM is switched to use the COW disk file, and the VM begins running again for substantially the remainder of the checkpoint generation. Next, the device state that was stored in memory and the unmodified VM memory pages are saved to a checkpoint file. Also, a copy may be made of the parent disk file for retention as part of the checkpoint, or the original parent disk file may be retained as part of the checkpoint. If a copy of the parent disk file was made, then the COW disk file may be committed to the original parent disk file.

Abstract: Memory assigned to a virtual machine is reclaimed. A resource reservation application running as a guest application on the virtual machine reserves a location in guest virtual memory. The corresponding physical memory can be reclaimed and allocated to another virtual machine. The resource reservation application allows detection of guest virtual memory page-out by the guest operating system. Measuring guest virtual memory page-out is useful for determining memory conditions inside the guest operating system. Given determined memory conditions, memory allocation and reclaiming can be used control memory conditions. Memory conditions in the virtual machine can be controlled with the objective of achieving some target memory conditions.

Abstract: A method of maintaining update history of a virtual machine (VM) is disclosed. The VM includes a version number. The method includes continuously monitoring a state of the VM. The monitoring of the state including detecting updates in configurations and applications of the VM. The changes in a status of the applications and the configuration are captured and metadata of the VM is updated when a change in the configurations or in the applications is detected. The version number of the VM is then incremented.

Abstract: A method for providing quality of service to a plurality of hosts accessing a common resource is described. The common resource may be a middle-tier or back-end server. A client IO request is received at one host of the plurality of hosts from one of a plurality clients executing as software entities on respective hosts. The host determines whether an issue queue is full. The IO request is issued to the common resource when the issue queue is not full. A current average latency observed at the host and an adjusted window size is calculated, based at least in part on the current average latency. The issue queue is resized to correspond with the adjusted window size.

Abstract: A method and system for providing quality of service to a plurality of hosts accessing a common resource is described. According to one embodiment, a plurality of IO requests is received from clients executing as software entities on one of the hosts. An IO request queue for each client is separately managed, and an issue queue is populated based on contents of the IO request queues. When a host issue queue is not full, a new IO request is entered into the host issue queue and is issued to the common resource. A current average latency observed at the host is calculated, and an adjusted window size is calculated at least in part based on the current average latency. The window size of the issue queue is adjusted according to the calculated window size.

Abstract: A virtualized computer system provides fault tolerant operation of a primary virtual machine. In one embodiment, this system includes a backup computer system that stores a snapshot of the primary virtual machine and a log file containing non-deterministic events occuring in the instruction stream of the primary virtual machine. The primary virtual machine periodically updates the snapshot and the log file. Upon a failure of the primary virtual machine, the backup computer can instantiate a failover backup virtual machine by consuming the stored snapshot and log file.

Abstract: A thread scheduling mechanism is provided that flexibly enforces performance isolation of multiple threads to alleviate the effect of anti-cooperative execution behavior with respect to a shared resource, for example, hoarding a cache or pipeline, using the hardware capabilities of simultaneous multi-threaded (SMT) or multi-core processors. Given a plurality of threads running on at least two processors in at least one functional processor group, the occurrence of a rescheduling condition indicating anti-cooperative execution behavior is sensed, and, if present, at least one of the threads is rescheduled such that the first and second threads no longer execute in the same functional processor group at the same time.

Abstract: A process of providing access to data associated with a virtual machine running on a host computer system to an offload server is implemented to improve the performance of the host computer system. Once the offload computer system knows how and where to access the data associated with that of the virtual machine, operations can be offloaded from the host computer system and performed by the offload server. Backup operations can be offloaded onto the server. The server can run backup software and directly access the data associated with the virtual machine, thereby freeing the hardware resources of the host computer to handle normal applications running on the virtual machine.

Abstract: A computer implemented method for processing virtualization of physical computers that are part of a group into virtual computers is provided. The method includes obtaining relationship data from the physical computers, where the relationship data identifies parameters used to communicate within the group. Then, the method analyzes utilization parameters for each of the physical computers of the group. A visual model for proposed virtualization of the group of physical computers is then generated. The visual model identifies hosting machines designated to define a virtual computer for each of the physical computers, where the visual model provides a graphical illustration of the group of physical computers once converted to virtual computers. The method enables adjustment of the proposed virtualization of the group of physical computers.

Abstract: Memory assigned to a virtual machine is reclaimed. A resource reservation application running as a guest application on the virtual machine reserves a location in guest virtual memory. The corresponding physical memory can be reclaimed and allocated to another virtual machine. The resource reservation application allows detection of guest virtual memory page-out by the guest operating system. Measuring guest virtual memory page-out is useful for determining memory conditions inside the guest operating system. Given determined memory conditions, memory allocation and reclaiming can be used control memory conditions. Memory conditions in the virtual machine can be controlled with the objective of achieving some target memory conditions.

Abstract: In a virtualized computer system, a network frame is transmitted from a virtual machine using a network interface device, possibly through a virtual switch, by copying only a part of the network frame to the transmit buffers that have pre-translated mappings from guest physical addresses to hypervisor virtual addresses and to machine addresses. The length of the part of the network frame that is copied to the transmit buffers may be variable.

Abstract: A method for controlling and maintaining a level of service of web applications is disclosed. The method includes generating a context for each request sent from a client to a web server and for each reply sent from a web server to a client. Then it is determined whether the context belongs to an identified transaction. Statistics respective of the identified transaction is then gathered. Further, a determination is made whether at least one policy predefined for the identified application is violated. A plurality of corrective actions are performed if at least one policy is determined to be violated.