Abstract: Systems, methods, and computer-readable media for configuring and verifying compliance requirements in a network.

Abstract: In some examples, a system creates a requirement including EPG selectors representing EPG pairs, a traffic selector, and a communication operator; determines that EPGs in distinct pairs are associated with different network contexts and, for each pair, which network context(s) contains associated policies; creates first data representing the pair, operator, and traffic selector; when only one network context contains the associated policies, creates second data representing a network model portion associated with the only network context and determines whether the first data is contained in the second data to yield a first check; when both network contexts contain the associated policies, also creates third data representing a network model portion associated with a second network context, and determines whether the first data is contained in the second and/or third data to yield a second check; and determines whether policies for the pairs comply with the requirement based on the checks.

Abstract: Systems, methods, and computer-readable media for assurance of rules in a network. An example method can include creating a compliance requirement including a first endpoint group (EPG) selector, a second EPG selector, a traffic selector, and a communication operator, the first and second EPG selectors representing sets of EPGs and the communication operator defining a communication condition for traffic associated with the first and second EPG selectors and the traffic selector. The method can include creating, for each distinct pair of EPGs, a first respective data structure representing the distinct pair of EPGs, the communication operator, and the traffic selector; creating a second respective data structure representing a logical model of the network; determining whether the first respective data structure is contained in the second respective data structure to yield a containment check; and determining whether policies on the network comply with the compliance requirement based on the containment check.

Abstract: Systems, methods, and computer-readable media for performing semantic analysis to identify shadowing events. One or more models of network intents, based at least in part on a priority-ordered listing of rules representing network intents, is received. Each rule comprises a Boolean function of one or more packet characteristics and network fabric conditions, and a corresponding network action. For each given rule of the priority-ordered listing of rules, partial and complete shadowing events are detected based on semantic analysis. The semantic analysis comprises calculating an inverse set that comprises the inverse of the set comprising all rules with a higher or equal priority to the given rule, and then calculating a shadowing parameter that comprises the intersection between the inverse set and the given rule. If the shadowing parameter is equal to zero, a complete shadowing event is detected.

Abstract: Systems, methods, and computer-readable media for discovering a network's topology and health. In some examples, a system can obtain, from at least one of a plurality of controllers on a network, a logical model of the network, the logical model including configurations of one or more objects defined for the network. Based on the logical model, the system can identify a respective location of the plurality of controllers in the network and a plurality of nodes in a fabric of the network. Based on the respective location of the plurality of controllers and plurality of nodes, the system can poll the plurality of controllers and plurality of nodes for respective status information, and determine a health and topology of the network based on the logical model, the respective location, and respective status information.

Abstract: Provided are systems, methods, and computer-readable medium for identifying security risks in applications executing in a cloud environment. In various implementations, a security monitoring and management system can obtain application data from a service provider system. The application data can include a record of actions performed by an application during use of the application by users associated with a tenant. The application executes in a service platform provided for the tenant by the service provider system. In various implementations, the application data is analyzed to identify an event associated with a security risk, where the event is identified from one or more actions performed by the application. The system can determine an action to perform in response to identifying the event. In various examples, an agent executing on the service platform can add instrumentation codes used by the application, where the instrumentation provides the application data.

Abstract: Systems, methods, and computer-readable media for emulating a state of a network environment for purposes of re-executing a network assurance appliance in the emulated state of the network environment. In some embodiments, a method can include receiving snapshot data for a network environment corresponding to a specific time in the network environment and including network events occurring in the network environment generated by a network assurance appliance. A state of the network environment at the specific time can be emulated using the snapshot data to create an emulated state of the network environment. Subsequently, the network assurance appliance can be re-executed in the emulated state of the network environment corresponding to the specific time and the network assurance appliance can be debugged outside of the network environment based on re-execution of the network assurance appliance in the emulated state of the network environment.

Abstract: Embodiments of the present disclosure include systems and methods for validating a target data table based on a source data table. A distributed memory comprises a plurality of computing systems, each storing at least a portion of the source data table and the target data table in local memory. Processing engines can be efficiently executed on each of the plurality of computing systems to perform comparison functions based on in-memory data. A checksum comparison engine is configured to compare source and target checksums. A data aggregation engine is configured to produce column-based aggregation summaries. A rule generation engine is configured to generate validation rules for checking by a validation engine.

Abstract: A method is implemented by a network device for providing a quick change Internet Protocol television (IPTV) service with reduced delay for transitioning to quick change IPTV channels by configuring a multicast address of the IPTV channel to a static group. The static group is assigned to a loopback interface of the network device. The method includes receiving multicast data traffic for a multicast group of a quick change IPTV channel identified by the static group assigned to the loopback interface, and discarding the multicast data traffic for the multicast group of the quick change IPTV channel.

Abstract: An apparatus for delivering media content from a first media device to a second media device is provided. The apparatus includes a server configured to receive media content from a first media device and to receive a first plurality of user experience settings used at the first media device to playback the media content. The server is further configured to store operating capabilities from a second media device. The server is further configured to adjust at least a portion of the operating capabilities in response to the first plurality of user experience settings to generate translated user experience settings and to transmit the media content and the translated user experience settings to the second media device to enable the second media device being to playback the media content substantially similar to the first media device playing back the media content.

Abstract: A method generates a behavioral model of a data center when a machine learning algorithm is applied. A team of human modelers that partition the data center into a plurality of connected nodes is analyzed by a behavioral model. The behavioral model of the data center detects an anomaly in a system behavior center by recursively applying the behavioral model to each node and simple component. A compressed metric vector for the node is generated by reducing a dimension of an input metric vector. A root cause of a failure caused is determined by the anomaly and an action is automatically recommended to an operator to resolve a problem caused by the failure. The proactively actions are taken to keep the data center in a normal state based on the behavioral model using the machine learning algorithm.

Abstract: Systems, methods, and computer-readable media for receiving an indication of an equivalence failure, the equivalence failure corresponding to one or more models of network intents. The indication of the equivalence failure is analyzed and one or more constituent intents that caused the equivalence failure are identified, wherein the one or more constituent intents are associated with a model of the one or more models of network intents. The granularity of the equivalence failure and the identified one or more constituent intents is determined, and an event for external consumption is generated, the event based at least in part on the equivalence failure, the granularity of the equivalence failure, and the identified one or more constituent intents.

Abstract: Systems, methods, and computer-readable media analyzing memory usage in a network node. A network assurance appliance may be configured to query a node in the network fabric for a number of hardware level entries, stored in memory for the node, that are associated with a concrete level network rule. The network assurance appliance may identify a logical level network intent associated with the concrete level network rule, identify a logical level component of the logical level network intent, and attribute the number of hardware level entries to the logical level component.

Abstract: Systems, methods, and computer-readable media analyzing memory usage in a network node. A network assurance appliance may be configured to obtain reference concrete level rules for a node in the network, obtain implemented concrete level rules for the node from the node in the network, compare the reference concrete level rules with the implemented concrete level rules, and determining that the implemented concrete level rules are not appropriately configured based on the comparison.

Abstract: Systems, methods, and computer-readable media for discovering a network's topology and health. In some examples, a system can obtain, from at least one of a plurality of controllers on a network, a logical model of the network, the logical model including configurations of one or more objects defined for the network. Based on the logical model, the system can identify a respective location of the plurality of controllers in the network and a plurality of nodes in a fabric of the network. Based on the respective location of the plurality of controllers and plurality of nodes, the system can poll the plurality of controllers and plurality of nodes for respective status information, and determine a health and topology of the network based on the logical model, the respective location, and respective status information.

Abstract: Systems, methods, and computer-readable media for collecting node information from a fabric and generating models based on the node information. In some examples, a system can obtain, from one or more controllers in a software-defined network (SDN), a logical model of the SDN, the logical model containing objects configured for the SDN from a hierarchical management information tree (MIT) associated with the SDN and representing configurations of the objects, the hierarchical MIT defining manageable objects and object properties for the SDN, the objects corresponding to the manageable objects. The system can obtain a topological model of a fabric associated with the SDN and, based on the topological model, poll nodes in the fabric for respective configurations at the nodes. Based on the respective configurations, the system can generate a node-specific representation of the logical model, the node-specific representation projecting the logical model on each node.

Abstract: Systems, methods, and computer-readable media for handling failure scenarios during data collection and analysis for assurance. In some examples, a system can obtain a logical model of a network and, based on the logical model, identify a plurality of controllers on the network and a plurality of nodes on a fabric of the network. The system can probe the plurality of controllers and plurality of nodes for respective status information, including respective reachability information, respective login diagnostics information, and/or respective software information. Based on the respective status information, the system can determine conditions at the plurality of controllers and the plurality of nodes and define one or more assurance operations based on the conditions at the plurality of controllers and the plurality of nodes. The system can then perform the one or more assurance operations.

Abstract: Systems, methods, and computer-readable media for receiving one or more models of network intents, comprising a plurality of contracts between providers and consumers, each contract containing entries with priority values. Each contract is flattened into a listing of rules and a new priority value is calculated. The listing of rules encodes the implementation of the contract between the providers and the consumers. Each entry is iterated over and added to a listing of entries if it is not already present. For each rule, the one or more entries associated with the contract from which the rule was flattened are identified, and for each given entry a flat rule comprising the combination of the rule and the entry is generated, wherein a flattened priority is calculated based at least in part on the priority value of the given one of given entry and the priority value of the rule.

Abstract: Systems, methods, and computer-readable media for fault code aggregation across application-centric dimensions. In an example embodiment, a system obtains respective fault codes corresponding to one or more network devices in a network and maps the one or more network devices and/or the respective fault codes to respective logical policy entities defined in a logical policy model of the network, to yield fault code mappings. The system aggregates the one or more of the fault code mappings along respective logical policy dimensions in the network to yield an aggregation of fault codes across respective logical policy dimensions and, based on the aggregation, presents, for each of the respective logical policy dimensions, one or more hardware-level errors along the respective logical policy dimension.

Abstract: Systems, methods, and computer-readable media analyzing memory usage in a network node. A network assurance appliance may be configured to determine a hit count for a concrete level rule implemented on a node and identify one or more components of a logical model, wherein each of the one or more components are associated with the concrete level rule. The network assurance appliance may attribute the hit count for the concrete level rule to each of the components of the logical model, determine a number of hardware level entries associated with the each of the one or more components, and generate a report comprising the one or more components of the logical model, the hit count attributed to each of the one or more components of the logical model, and the number of hardware level entries associated with the one or more components of the logical model.