Abstract: Resource optimization for online services is described. In one example, objects (such as mailboxes or other data associated with an online service) are assigned to network elements (such as servers) by inferring a relationship graph from log data relating to usage of the online service. The graph has a node for each object, and connections between each pair of objects having data items in common. Each connection has a weight relating to the number of common data items. The graph is partitioned into a set of clusters, such that each cluster has nodes joined by connections with a high weight relative to the weight of connections between nodes in different clusters. The objects are then distributed to the network elements such that objects corresponding to nodes in the same cluster are located on the same network element.

Abstract: A deadline-aware network protocol is described. In an example, data transfer at a transport layer entity of a packet-based communication network is controlled by receiving a request for network resources for a data flow from a network element and allocating network resources to the data flow. The data flow comprises a number of data packets associated with an application, and the request comprises a factor relating to a time deadline associated with the application. The network resources allocated depend on the factor relating to the time deadline. In examples, the network resource can be a bandwidth or data rate allocated to the data flow, and the factor can be a data rate sufficient to complete the data flow within the time deadline. In examples, the network resources are allocated greedily, such that requests are fully satisfied whenever possible, and the network resources are fully utilized.

Abstract: Supporting distributed key-based processes is described. In an embodiment, servers at a data center provide a key-based process for carrying out computationally expensive tasks and are connected using point to point connections in a geometric topology such as a torus. In an example, aggregation trees are built on top of the geometric topology of the data center, each aggregation tree being a sequence of servers in the data center that forms a tree structure. In an embodiment packets of data are sent from the leaves of the trees to the root and at each server along the tree the packets are aggregated using a combiner function of the key-based process. In an embodiment, if a server fails, the trees are dynamically recomputed and a recovery phase is triggered to resend any packets lost at the failed server. In some embodiments, packets are scheduled by inspecting the content of the packets.

Abstract: Content discovery and content transfer between mobile communications nodes is often required, for example, to synchronize maps, traffic hot spot information and the like for vehicle mounted satellite navigation devices, pedestrian hand-held personal digital assistants and other mobile communications nodes. In an embodiment, content discovery processes using a tree-based data structure for transferring data between two mobile communication nodes is described.

Abstract: Content discovery and content transfer between mobile communications nodes is often required, for example, to synchronize maps, traffic hot spot information and the like for vehicle mounted satellite navigation devices, pedestrian hand-held personal digital assistants and other mobile communications nodes. In an embodiment, content discovery processes using data structures designed in particular ways and sent using a single packet enable nodes to identify files to be transferred whilst keeping overheads down. In an embodiment a first and a second data structure are used, each being formed from slightly different information about a subset of the files to be synchronized. In another embodiment a single tree-based data structure is used. A process for transferring data between two mobile communications nodes is also described.

Abstract: Improved storage systems which use write off-loading are described. When a request to store some data in a particular storage location is received, if the particular storage location is unavailable, the data is stored in an alternative location. In an embodiment, the particular storage location may be unavailable because it is powered down or because it is overloaded. The data stored in the alternative location may be subsequently recovered and written to the particular storage location once it becomes available.

Abstract: Content transfer between nodes in a communications network is required in many situations. For example, between fixed nodes in a data center, between a fixed node such as a base station and a mobile node such as a mobile telephone and between mobile nodes themselves such as personal digital assistants. In an embodiment a content transfer process for use between nodes where one node knows the size of content to be transferred is described. For example, a file is divided into blocks to be sent between the nodes. A node receiving a block keeps a record of the received blocks and sends that record to the sending node at certain times. By controlling the times at which the records are sent the number of messages that need to be sent to transfer the records is low and the blocks are transferred in an efficient manner.

Abstract: Content discovery and content transfer between mobile communications nodes is often required, for example, to synchronize maps, traffic hot spot information and the like for vehicle mounted satellite navigation devices, pedestrian hand-held personal digital assistants and other mobile communications nodes. In an embodiment, content discovery processes using data structures designed in particular ways and sent using a single packet enable nodes to identify files to be transferred whilst keeping overheads down. In an embodiment a first and a second data structure are used, each being formed from slightly different information about a subset of the files to be synchronized. In another embodiment a single tree-based data structure is used. A process for transferring data between two mobile communications nodes is also described.

Abstract: A containment system may include a protection system which may protect the computing device from future attacks. For example, a patch may be automatically generated which resolves a detected vulnerability in a program. IN another example, a filter may be automatically generated which filters actions and/or messages which take advantage of a detected vulnerability in a program.

Abstract: A containment system may include generating and/or sending an alert as the basis for safely sharing knowledge about detected worms. An alert may contain information that proves that a given program has a vulnerability. The alert may be self-certifying such that its authenticity may be independently verified by a computing system.

Abstract: One aspect of the invention is a vulnerability detection mechanism that can detect a large class of attacks through dynamic dataflow analysis. Another aspect of the invention includes self-certifying alerts as the basis for safely sharing knowledge about worms. Another aspect of the invention is a resilient and self-organizing protocol to propagate alerts to all non-infected nodes in a timely fashion, even when under active attack during a worm outbreak. Another aspect of the invention is a system architecture that enables a large number of mutually untrusting computers to collaborate in the task of stopping a previously unknown worm, even when the worm is spreading rapidly and exploiting unknown vulnerabilities in popular software packages.

Abstract: Content and/or Path locality may be obtained using DHT protocols by assigning network nodes with individual node identifiers (IDs) in a hierarchical namespace. The hierarchical node IDs may be assigned to reflect organizational boundaries within the network. Therefore, with the structured overlay defined using these hierarchically assigned node IDs, a routing algorithm that uses prefix-matching can provide path locality. Furthermore, a domain prefix may be combined with data identifier derived from the data itself to create an enhanced data key. The use of the enhanced data key with a DHT protocol in this structured overlay can provide content locality.

Abstract: Methods of querying a large number of endsystems are described in which metadata is replicated between endsystems. When a query is injected, an available endsystem receives a message relating to the query which identifies a range of endsystems for which that available endsystem is responsible. The available endsystem then generates completeness data for the range of endsystems based on data stored at the endsystem and this completeness data is transmitted to the sender of the message. The methods may be implemented using device-executable instructions which may be stored on device readable media.

Abstract: A containment system may include generating and/or sending an alert as the basis for safely sharing knowledge about detected worms. An alert may contain information that proves that a given program has a vulnerability. The alert may be self-certifying such that its authenticity may be independently verified by a computing system.

Abstract: To reduce the dependency of overlay networks on underlay networks to route messages, a virtual ring routing architecture may be formed that leverages the design of the overlay network to achieve their desirable scaling and robustness properties but also reduce the dependency on any underlay network to setup and maintain connectivity. More particularly, each node may have a single, fixed, location independent node identifier, to organize the nodes into a virtual ring. The connectivity between nodes through the actual network topology may be formed by a plurality of nodes in the virtual ring by maintaining connectivity to those nodes identified as virtual neighbor nodes within the virtual ring. The path segments defining communication connections between virtual neighbor nodes may be used to route messages between any pair of nodes in the network and may reduce route discovery overhead, reduce delay in transmission, and reduce or eliminate flooding to setup or maintain the path segments.

Abstract: A containment system may include a protection system which may protect the computing device from future attacks. For example, a patch may be automatically generated which resolves a detected vulnerability in a program. IN another example, a filter may be automatically generated which filters actions and/or messages which take advantage of a detected vulnerability in a program.

Abstract: One aspect of the invention is a vulnerability detection mechanism that can detect a large class of attacks through dynamic dataflow analysis. Another aspect of the invention includes self-certifying alerts as the basis for safely sharing knowledge about worms. Another aspect of the invention is a resilient and self-organizing protocol to propagate alerts to all non-infected nodes in a timely fashion, even when under active attack during a worm outbreak. Another aspect of the invention is a system architecture that enables a large number of mutually untrusting computers to collaborate in the task of stopping a previously unknown worm, even when the worm is spreading rapidly and exploiting unknown vulnerabilities in popular software packages.

Abstract: Substantially accurate estimation of coordinates of a subject network node in a coordinate space is accomplished by considering designated coordinates of other positioned nodes within the network. The designation of coordinates in the coordinate space to such nodes allows the computation of predicted coordinate distances between two network nodes based on the coordinates. By optimizing the network distance errors between measured distances and predicted coordinate distances, the predicted coordinates of a subject node joining the network can be iteratively refined. With these estimated coordinates, the coordinate distance between two points in the space may be computed as a prediction of the network distance between the two corresponding nodes. Furthermore, coordinate-based coordinate estimation lends itself to security precautions to protect against malicious reference nodes or external interference.

Abstract: It is common in distributed systems to replicate data. In many cases, this data evolves in a consistent fashion, and this evolution can be modeled. A probabilistic model of the evolution allows us to estimate the divergence of the replicas and can be used by the application to alter its behavior, for example, to control synchronization times, to determine the propagation of writes, and to convey to the user information about how much the data may have evolved. In this paper, we describe how the evolution of the data may be modeled and outline how the probabilistic model may be utilized in various applications, concentrating on a news database example.

Abstract: Substantially accurate estimation of coordinates of a subject network node in a coordinate space is accomplished by considering designated coordinates of other positioned nodes within the network. The designation of coordinates in the coordinate space to such nodes allows the computation of predicted coordinate distances between two network nodes based on the coordinates. By optimizing the network distance errors between measured distances and predicted coordinate distances, the predicted coordinates of a subject node joining the network can be iteratively refined. With these estimated coordinates, the coordinate distance between two points in the space may be computed as a prediction of the network distance between the two corresponding nodes. Furthermore, coordinate-based coordinate estimation lends itself to security precautions to protect against malicious reference nodes or external interference.