Abstract: A method includes identifying a middlebox receiving network flow and communicating with one or more backend virtual machines. The method also includes receiving flow statistics corresponding to the network flow of the middlebox and determining whether the flow statistics satisfy an offload rule. The offload rule indicates when to migrate the network flow from the middlebox to an end host. When the flow statistics satisfy the offload rule, the method also includes migrating the network flow from the middlebox to the end host.

Abstract: A method includes identifying a middlebox receiving network flow and communicating with one or more backend virtual machines. The method also includes receiving flow statistics corresponding to the network flow of the middlebox and determining whether the flow statistics satisfy an offload rule. The offload rule indicates when to migrate the network flow from the middlebox to an end host. When the flow statistics satisfy the offload rule, the method also includes migrating the network flow from the middlebox to the end host.

Abstract: A method includes identifying a middlebox receiving network flow and communicating with one or more backend virtual machines. The method also includes receiving flow statistics corresponding to the network flow of the middlebox and determining whether the flow statistics satisfy an offload rule. The offload rule indicates when to migrate the network flow from the middlebox to an end host. When the flow statistics satisfy the offload rule, the method also includes migrating the network flow from the middlebox to the end host.

Abstract: A method for transparent migration of virtual network functions is provided. The method includes identifying a middlebox receiving network flow and communicating with one or more backend virtual machines. The method also includes receiving flow statistics corresponding to the network flow of the middlebox and determining whether the flow statistics satisfy an offload rule. The offload rule indicates when to migrate the network flow from the middlebox to an end host. When the flow statistics satisfy the offload rule, the method also includes migrating the network flow from the middlebox to the end host.

Abstract: Systems and methods for dynamically offloading network traffic flows in one or more virtual networks are disclosed. An example method begins with identifying a virtual router through which to route network traffic of a specific network flow, wherein the specific network flow has a source endpoint existing on a source host machine and a destination endpoint existing on a destination host machine. Flow statistics including statistics about the specific network flow are received. A determination is made as to whether the specific network flow meets an offload rule using the received flow statistics. In response to determining that the specific flow meets the offload rule, the specific network flow is offloaded from the virtual router.

Abstract: Systems and methods for dynamically offloading network traffic flows in one or more virtual networks are disclosed. An example method begins with identifying a virtual router through which to route network traffic of a specific network flow, wherein the specific network flow has a source endpoint existing on a source host machine and a destination endpoint existing on a destination host machine. Flow statistics including statistics about the specific network flow are received. A determination is made as to whether the specific network flow meets an offload rule using the received flow statistics. In response to determining that the specific flow meets the offload rule, the specific network flow is offloaded from the virtual router.

Abstract: A policy management system is described herein which generates rules based, at least in part, on reputation information provided by at least one reputation source and client event information forwarded by filtering logic. The policy management system then deploys the rules to the filtering logic. The filtering logic, which resides in-network between clients and at least one service, uses the rules to process client event information sent by the clients to the service(s). In one illustrative environment, the service corresponds to an ad hosting service, which uses the policy management system and filtering logic to help prevent malicious client traffic from reaching the ad host service, or otherwise negatively affecting the ad hosting service.

Abstract: A debugging system used for a data center in a network is disclosed. The system includes a monitoring engine to monitor network traffic by collecting traffic information from a network controller, a modeling engine to model an application signature, an infrastructure signature, and a task signature using a monitored log, a debugging engine to detect a change in the application signature between a working status and a non-working status using a reference log and a problem log, and to validate the change using the task signature, and a providing unit to provide toubleshooting information, wherein an unknown change in the application signature is correlated to a known problem class by considering a dependency to a change in the infrastructure signature. Other methods and systems also are disclosed.

Abstract: A policy management system is described herein which generates rules based, at least in part, on reputation information provided by at least one reputation source and client event information forwarded by filtering logic. The policy management system then deploys the rules to the filtering logic. The filtering logic, which resides in-network between clients and at least one service, uses the rules to process client event information sent by the clients to the service(s). In one illustrative environment, the service corresponds to an ad hosting service, which uses the policy management system and filtering logic to help prevent malicious client traffic from reaching the ad host service, or otherwise negatively affecting the ad hosting service.

Abstract: Multiple input devices at a source location capture data to be streamed to one or more destination locations. The captured data is provided to a streaming interface of a streaming service that encapsulates the captured data in streaming packets. The streaming interface provides the streaming packets to a streaming gateway of the streaming service that processes the streaming packets and transmits the streaming packets to a streaming gateway at the destination location. The streaming gateways manage the correlated streaming of the multiple data streams. Various processing of the data streams can be performed by the streaming gateways, including various user-defined and system-defined processing.