Abstract: A method of cross-domain policy orchestration may include executing, with a cross-domain automation (CDA) controller, a macro-segmentation of a plurality of domains based at least in part on metadata defining a mapping to a corresponding plurality of domain controllers, and executing, with the CDA controller, a micro-segmentation of policies within a group based at least in part on a merged policy matrix obtained from policies of the domain controllers.

Abstract: This technology enables directed broadcasts in network fabrics. A control plane node is configured to resolve directed broadcast addresses by mapping the directed broadcast address to a subnet address. A fabric border node receives a directed broadcast, extracts a destination address, and transmits a request to the control plane node to resolve the destination address. The control plane node retrieves the stored mapping and generates a map reply with a multicast destination. The fabric border node encapsulates and forwards the directed broadcast to fabric edge nodes, which decapsulate the directed broadcast and deliver a data set from the directed broadcast to appropriate end point devices. Each fabric edge node may be enabled to determine if the fabric edge node may be connected to a silent host and, based on that determination, request the fabric border node to be added to the multicast destination to receive the directed broadcast.

Abstract: A native cloud-based VM in a cloud computing environment of choice is live-mounted without requiring nesting techniques. All operating system data needed to live-mount the VM is accessed over ISCSI. The disclosed technology: supports both Windows and Unix-like (e.g., Linux) operating systems; handles any number of partitions of the root file system without repeated mounting, exporting, and unmounting; and uses only internet protocols (e.g., HTTP, (SCSI) to live-mount the VM. The live-mounted VM gains access to a variety of secondary copies, e.g., made with file-level techniques or with block-level techniques, made within or outside the public cloud computing environment, made from other VMs having the same or a different hypervisor than the public cloud computing environment, and/or made from non-virtualized sources. Access to snapshots as a data source for the live-mounted VM is also disclosed. Thus, a streamlined and source-agnostic technology is disclosed for live-mounting VMs in a public cloud.

Abstract: An integrated circuit (IC) includes one or more active transistors and multiple series-coupled dummy transistors. The dummy transistors are coupled between two active transistors and/or at the ends of each active transistor. When the dummy transistors are coupled between two active transistors, apart from two conductive regions that are coupled to two active transistors, each remaining conductive region of the dummy transistors is maintained in a floating state to control a leakage current between the two active transistors. Similarly, when the dummy transistors are coupled at an end of one active transistor, apart from one conductive region that is coupled to the active transistor, each remaining conductive region of the dummy transistors is maintained in the floating state to control a leakage current between the active transistor and the dummy transistors.

Abstract: Embodiments determine event, e.g., performance degradation, security breach, etc., occurrence based on telemetry data. An embodiment receives telemetry data, e.g., data based on an HTTP transaction, and a rule associated with the telemetry data. The rule defines one or more filters for processing the telemetry data. In turn, a rule engine is modified in accordance with the received rule. The received telemetry data is processed with the modified rule engine to determine event occurrence.

Abstract: Techniques and architecture are described for L2 service insertion in a network. More particularly, the techniques and architecture provide for monitoring a L2 service, e.g., firewall, MAC address (instead of learning the MAC address) and registering/de-registering the service node (e.g., fabric border or edge or LISP service_etr) to the service control plane (e.g., LISP MSMR) based on this. This not only load-balances the traffic (per L2 flow) but also tracks it for node's liveliness. The techniques and architecture also provide L2 service insertion connected to a service border to allow for dynamic SGT based service, e.g., firewall, insertion for both software defined access (SDA) fabric and non-fabric deployments.

Abstract: Techniques for a Software-Defined Networking (SDN) controller associated with a multisite network to implement jurisdictional data sovereignty polices in a multisite network, route network traffic flows between user sites and destination services over one or more provider sites, and/or perform a routing operation on the network traffic flow(s) based on the jurisdictional data sovereignty policies. The jurisdictional data sovereignty polices may be implemented using destination group tags (DGTs) and/or source group tags (SGTs). A secure access service edge (SASE) associated with the network controller may generate, store, and distribute the DGTs to provider sites and/or the SGTs to user sites. Based on the SGT and/or DGT associated with a network traffic flow, one or more services may be applied to the network traffic flow, and the network traffic flow may be routed through a particular region of a software-defined access (SDA) transit.

Abstract: Systems, methods, and computer program products are provided herein for data trace and sequence determinations in distributed networks. An example method includes receiving a request for an interaction determination and determining a plurality of distributed service systems associated with the interaction. The plurality of distributed service systems include a sequence defining an order by which operations associated with the interaction are performed by respective distributed service systems and each of the distributed service systems includes trace agents that generate service system specific data trace objects. The method further includes capturing the one or more service system specific data trace objects for each of the distributed service systems and generating an interaction object based on the service system specific data trace objects for each of the distributed service systems associated with the interaction.

Abstract: Techniques for scalable virtualization of an Input/Output (I/O) device are described. An electronic device composes a virtual device comprising one or more assignable interface (AI) instances of a plurality of AI instances of a hosting function exposed by the I/O device. The electronic device emulates device resources of the I/O device via the virtual device. The electronic device intercepts a request from the guest pertaining to the virtual device, and determines whether the request from the guest is a fast-path operation to be passed directly to one of the one or more AI instances of the I/O device or a slow-path operation that is to be at least partially serviced via software executed by the electronic device. For a slow-path operation, the electronic device services the request at least partially via the software executed by the electronic device.

Abstract: Techniques for group-based classification and policy enforcement at a network fabric edge for traffic that is being sent to external network destinations are disclosed herein. The techniques may include receiving, at a control plane of a network and from an edge node of the network, a request to provide mapping data associated with sending a packet to a destination. Based at least in part on an address prefix value associated with the destination, the control plane may determine that the destination is located in an external network. Additionally, a group identifier that is associated with the destination may be determined. In this way, an indication of the group identifier may be sent to the edge node such that the edge node may determine, based at least in part on the group identifier, a policy decision for routing the packet to the external network.

Abstract: Methods, systems, and apparatuses for device routing management are disclosed. A client device of a wireless network may roam from a first access point to a second access point of the wireless network. The second access point, or the client device itself, may send a network message indicating the client device is currently being served by the second access point. The message may cause a network mapping stored at the first access point and/or at each device associated with the wireless network to be updated to indicate the client device is associated with the second access point, thereby enabling proper routing of network traffic to the client device via the second access point.

Abstract: Systems/techniques that facilitate interpretable task-specific dimensionality-reduction are provided. In various embodiments, a system can access a three-dimensional medical image. In various aspects, the system can generate, via execution of a first deep learning neural network, a voxel-wise weight map corresponding to the three-dimensional medical image and a set of projection vectors corresponding to the three-dimensional medical image. In various instances, the system can generate a set of two-dimensional projection images of the three-dimensional medical image, based on the voxel-wise weight map and the set of projection vectors. In various cases, the first deep learning neural network can be trained in a serial pipeline with a second deep learning neural network that is configured to perform an inferencing task on two-dimensional inputs. This can cause the set of two-dimensional projection images to be tailored to the inferencing task.

Abstract: A method in a computing device includes: capturing, via a sensor, an image of an indicium; determining a confidence level associated with machine recognition of the indicium; based on the confidence level, selecting a feedback attribute; prior to outputting content encoded in the indicium, generating, via an output device, a feedback signal having the feedback attribute, wherein the attribute is configured to indicate a likelihood of success of a decode event to decode the content encoded in the indicium.

Abstract: Techniques that include a network that is configured in the first mode of a reactive mode to respond to a client attempting to access an endpoint of the network by providing information to be sent to a map server and by checking whether at least an IP address associated with the client corresponds to a registration produced for the client by a wireless controller. Further, the network is configured in a second mode of a proactive mode to determine based on a count maintained by a wireless controller of a number of client IP addresses whether to allow access or not to allow access to one or more clients to the network.

Abstract: A network device may receive code for generating an interface for communicating with a large language model, and may generate the interface based on the code. The network device may provide, to the large language model and via the interface, a question associated with the network device, and may receive, from the large language model, an answer to the question associated with the network device.

Abstract: Systems are provided for perioperative care. In an example, a system includes one or more processors and memory storing instructions executable by the one or more processors to output a graphical user interface (GUI) including a first visual representation of a default or previously-determined phase of anesthesia delivery for a patient; receive a plurality of monitoring parameters of the patient over an observation window, at least a portion of the plurality of monitoring parameters obtained from an anesthesia delivery machine; identify, by applying a selected set of rules to the plurality of monitoring parameters, whether an event signaling a change to a new phase of anesthesia delivery for the patient is detected; based on the event being detected, update the GUI to display a second visual representation of the new phase; and based on the event not being detected, maintain the first visual representation on the GUI.

Abstract: This disclosure describes techniques to operate a control plane in a network fabric. The techniques include determining a stateless rule corresponding to communication between a first segment of the network fabric and a second segment of the network fabric. The techniques further include configuring the control plane to enforce the stateless rule.

Abstract: A method and system determine network based access to restricted systems. The method includes receiving a request for a permission access status of a party seeking access to one of the restricted systems. A database of periodically updated lists of entities is accessed. A name of the party is extracted from the request. A determination is made whether the name does not match one of the entities. The name is decomposed into parts if the name not matching one of the entities. A determination is made whether any of the parts of the name matches one of the entities. A denial of access status is forwarded from the computer server to an external computing device if any of the parts of the name matches one of the entities.

Abstract: An approach is provided for lane width estimation from incomplete lane marking detections of a road lane. The approach, for example, involves generating one or more perpendicular lines respectively from location centers of one or more first lane marking detections. A respective lane marking detection represents at least a portion of a boundary of the road lane as a line delimited by two location data points in accordance with detections by at least one sensor device onboard at least one vehicle. The approach also involves identifying second lane marking detections that each respectively intersect one of the one or more perpendicular lines. The approach further involves selecting one or more candidate lane widths based on one or more respective distances from the location centers to the second lane marking detections. The approach further involves determining an estimated lane width of the road lane based on the one or more candidate lane widths.

Abstract: Techniques are described herein for service chaining in fabric networks such that hardware resources can be preserved without service nodes needing additional capabilities. The techniques may include storing a first configuration associated with a first VRF instance of a service forwarding node that is connected to a first service of a service chain sequence. The first configuration may indicate an identifier and a type associated with a second service of the service chain sequence where traffic is to be sent after the first service. Additionally, the techniques may also include storing a second configuration associated with a second VRF instance of the service forwarding node that is connected to the second service. The second configuration may indicate that the second service is a last service of the service chain sequence. When traffic is received at the service forwarding node, the service forwarding node can determine whether the traffic is pre-service traffic or post-service traffic.