Abstract: In one implementation, a device may generate variants of a cloud-native application modified to simulate vulnerabilities. The device may identify dormant attack paths in the variants susceptible to activation. The device may update an attack path knowledge base with the dormant attack paths. The device may prevent changes to the cloud-native application in a production environment that would activate the dormant attack paths identified in the variants.

Abstract: In one embodiment, a method by a runtime configuration service at an edge site comprises receiving a registration request from a particular application comprising a particular identifier associated with the particular application, establishing a connection to a control plane application programming interface (API) gateway located in an edge backend, sending a state request message to the API gateway comprising a site identifier and the particular identifier, receiving a state response message from the API gateway comprising a desired state for the particular application, storing a desired state for the particular application, and sending a notification to the particular application indicating an updated desired state for the particular application is available.

Abstract: In one embodiment, a device may receive a request for training data that is based on application data generated by an application executed at a data collection node, wherein the application data is associated with metadata identifiers. The device may determine one or more training data constraints that restrict use of the application data as training data. The device may generate the training data in part by excluding application data of a particular type from being included in the training data based on a match between its metadata identifier and the one or more training data constraints. The device may provide the training data to be used to train a machine learning model.

Abstract: A method for providing a symbiotic network orchestrator utilized to automatically commission edge computing devices on corporate computing networks and edge site computing networks is presented. The method includes receiving an indication of a potential connection of an edge computing device to one or more computing networks associated with the orchestrator. The one or more computing networks includes a corporate computing network and an edge site computing network. The method further includes determining, based on the corporate computing network, the edge site computing network, and a predetermined set of rules, an intent for commissioning the edge computing device, reconfiguring, based on the intent, the corporate computing network and the edge site computing network, and commissioning the edge computing device on one or more of the corporate computing network or the edge site computing network in accordance with the reconfiguring.

Abstract: In one implementation, a device may identify a task requested by a prompt for input to a language model. The device may compute, based on the task, two or more estimated performance metrics for each of a plurality of candidate language models associated with that model performing the task. The device may select a particular language model from among the plurality of candidate language models to optimize the two or more estimated performance metrics. The device may cause the prompt to be sent to the particular language model for performance of the task.

Abstract: In one implementation, a device may determine a classification of a task requested by a prompt for input to a language model. The device may compute, based on the classification of the task, an estimated resource utilization associated with the language model performing the task. The device may calculate a resource utilization differential between the estimated resource utilization and a resource utilization associated with another entity performing the task instead of the language model. The device may provide an indication of the resource utilization differential via a user interface.

Abstract: In one implementation, a method is disclosed comprising providing a prompt to a large language model to perform a task; determining a likelihood of an outcome of the task changing over a period of time; storing the prompt and the outcome in a cache when the likelihood indicates that the outcome of the task is unlikely to change over the period of time; and returning the outcome from the cache in response to a subsequent prompt asking the large language model to perform the task, in lieu of providing the subsequent prompt to the large language model.

Abstract: In one embodiment, a device may receive a request for training data that is based on application data generated by an application executed at a data collection node, wherein the application data is associated with metadata identifiers. The device may determine one or more training data constraints that restrict use of the application data as training data. The device may generate the training data in part by excluding application data of a particular type from being included in the training data based on a match between its metadata identifier and the one or more training data constraints. The device may provide the training data to be used to train a machine learning model.

Abstract: A method for providing a symbiotic network orchestrator utilized to automatically commission edge computing devices on corporate computing networks and edge site computing networks is presented. The method includes receiving an indication of a potential connection of an edge computing device to one or more computing networks associated with the orchestrator. The one or more computing networks includes a corporate computing network and an edge site computing network. The method further includes determining, based on the corporate computing network, the edge site computing network, and a predetermined set of rules, an intent for commissioning the edge computing device, reconfiguring, based on the intent, the corporate computing network and the edge site computing network, and commissioning the edge computing device on one or more of the corporate computing network or the edge site computing network in accordance with the reconfiguring.

Abstract: In one implementation, a device may identify features of a prompt to be sent to a language model that are indicative of a type of data that the prompt would cause the language model to access. The device may determine whether data control policies apply for the prompt based on the type of data that the prompt would cause the language model to access. The device may determine, based on the features, whether processing of the prompt by the language model violates an applicable data control policy. The device may prevent the language model from processing the prompt when the processing of the prompt violates the applicable data control policy.

Abstract: In one embodiment, a method by a site router agent at an edge site includes receiving a first message from a message router at an edge backend, where a destination field of the first message includes a destination information, determining that the first message is destined to a first application instance by comparing a first unique identifying information associated with the first application instance with the destination information, storing the first message into a storage communicatively connected to the site router agent, establishing a network connection with the first application instance, and sending the first message to the first application instance upon establishing the network connection.

Abstract: In one embodiment, a method by a site router agent at an edge site includes receiving a first message from a message router at an edge backend, where a destination field of the first message includes a destination information, determining that the first message is destined to a first application instance by comparing a first unique identifying information associated with the first application instance with the destination information, storing the first message into a storage communicatively connected to the site router agent, establishing a network connection with the first application instance, and sending the first message to the first application instance upon establishing the network connection.

Abstract: In one embodiment, a method may receive a first notification message associated with an instance of an edge application at an edge site of an edge network. The method may receive a subset of a unique identifier associated with the instance of the edge application from an application processing interface (API) router agent associated with the edge application. The method may use the subset of the unique identifier to determine a complete unique identifier associated with the instance of the edge application. The method may generate a second notification message corresponding to an API call using the complete unique identifier. The method may determine a network connection with the API router agent associated with the edge application. In response to determining the network connection is stable, the method may expose the second notification message to the API router agent associated with the edge application.

Abstract: In one embodiment, a method may access a first description of a plurality of edge applications and a cluster level security policy on an edge site of an Internet of Things (IoT) network. The method may receive a second description of a storage related operation associated with an edge application to be deployed on the edge site. The method may determine a permission level for the storage related operation based on the first and second descriptions. The method may determine, using the cluster level security policy and the permission level, an updated cluster level security policy. In response to determining the permission level is privileged, the method may perform, using a first secure agent, an edge cluster, and the updated clustered level security policy, the storage related operation associated with the edge application on the edge site of the IoT network.

Abstract: A method for providing a symbiotic network orchestrator utilized to automatically commission edge computing devices on corporate computing networks and edge site computing networks is presented. The method includes receiving an indication of a potential connection of an edge computing device to one or more computing networks associated with the orchestrator. The one or more computing networks includes a corporate computing network and an edge site computing network. The method further includes determining, based on the corporate computing network, the edge site computing network, and a predetermined set of rules, an intent for commissioning the edge computing device, reconfiguring, based on the intent, the corporate computing network and the edge site computing network, and commissioning the edge computing device on one or more of the corporate computing network or the edge site computing network in accordance with the reconfiguring.

Abstract: In one embodiment, a method by a runtime configuration service at an edge site comprises receiving a registration request from a particular application comprising a particular identifier associated with the particular application, establishing a connection to a control plane application programming interface (API) gateway located in an edge backend, sending a state request message to the API gateway comprising a site identifier and the particular identifier, receiving a state response message from the API gateway comprising a desired state for the particular application, storing a desired state for the particular application, and sending a notification to the particular application indicating an updated desired state for the particular application is available.

Abstract: In one embodiment, a device may determine a compliance status of a communication of a type of data between a first workload and a second workload based on a data compliancy policy and a verified node location of at least one of the first workload and the second workload. The device may send, based on the compliance status of the communication, an instruction for handling the communication to at least one of a node executing the first workload and a node executing the second workload.

Abstract: In one embodiment, a device may obtain an identifier of a proof of location process (PLP) and an identifier of a node where the PLP is executed. The device may receive a query from a compliance engine for a proof of location of the node where the PLP is executed. The device may identify, based on the identifier of the PLP and the identifier of the node, a physical location of the node. The device may provide, to the compliance engine, a response to the query that is indicative of the physical location of the node, wherein the compliance engine enforces one or more data compliance policies with respect to a workload executed by the node and based on the physical location of the node.

Abstract: In one embodiment, a device may receive a request for training data that is based on application data generated by an application executed at a data collection node, wherein the application data is associated with metadata identifiers. The device may determine one or more training data constraints that restrict use of the application data as training data. The device may generate the training data in part by excluding application data of a particular type from being included in the training data based on a match between its metadata identifier and the one or more training data constraints. The device may provide the training data to be used to train a machine learning model.

Abstract: In one embodiment, a method by a site router agent at an edge site comprises determining that a first application instance becomes running on the edge site, where the first application instance is associated with a first unique identifying information, sending a report to a control plane of an edge backend indicating that the first application instance becomes available at the edge site, retrieving a first message from a message router at the edge backend, determining that the first message is destined to the first application instance based on a destination field of the first message, storing the first message into a storage communicatively connected to the site router agent, establishing a network connection with the first application instance, and sending the first message to the first application instance upon establishing the network connection.