Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: The invention provides apparatus and methods for defending against attacks in a distributed computing environment, including (1) distinguishing attack traffic patterns from legitimate traffic patterns, (2) responsive to nature of message patterns; (3) attack traffic has few origination points, and does not divide further from target device; (4) detectors of illegitimate traffic can cooperate to confirm the suspected attack, with the effect of providing more information to each other.