Abstract: A method, apparatus and computer program product for scheduling placement of containers in association with a set of hosts. The technique utilizes metrics that characterize container-specific risks. A first metric is a host interface risk for a container that quantifies how similar or dissimilar the container is relative to other containers running on a host. Preferably, host interface risk is derived with respect to a system call interface comprising a set of system calls, and the metric is based at least in part on a measure of dissimilarity among system calls. A second metric is a data sensitivity score that quantifies a degree to which sensitive data accesses are associated to the container. Based at least in part on the host interface risk scores and the data sensitivity scores, one or more containers are automatically scheduled for placement on the set of hosts to minimize security risk for the set of hosts.

Abstract: Various exemplary embodiments relate to a method, policy and charging rules node (PCRN) and machine-readable storage medium for creating policy and control charging rules with minimal rule instantiation latency. Embodiments may include one or more of the following: receiving at a PCRN from an application node a first service request message, determining whether the PCRN should wait for a mate message for the service flow, if the PCRN should not wait for a mate message, immediately generating at least one PCC rule, and immediately pushing the first PCC rule to at least one gateway. Various exemplary embodiments may further include using subscriber preferences and/or a record of previous decisions to determine whether the PCRN should wait for a mage message. In various embodiments, the PCRN may disable a timer when it determines it should not wait for a mate message.

Abstract: Various exemplary embodiments relate to a method, policy and charging rules node (PCRN) and machine-readable storage medium for creating policy and control charging rules with minimal rule instantiation latency. Embodiments may include one or more of the following: receiving at a PCRN from an application node a first service request message, determining whether the PCRN should wait for a mate message for the service flow, if the PCRN should not wait for a mate message, immediately generating at least one PCC rule, and immediately pushing the first PCC rule to at least one gateway. Various exemplary embodiments may further include using subscriber preferences and/or a record of previous decisions to determine whether the PCRN should wait for a mage message. In various embodiments, the PCRN may disable a timer when it determines it should not wait for a mate message.