Abstract: A system may include a historical managed software system data store that contains electronic records associated with controllers and deployed workloads (each electronic record may include time series data representing performance metrics). An entropy calculation system, coupled to the historical managed software system data store, may calculate at least one historical entropy value based on information in the historical managed software system data store. A detection engine, coupled to a monitored system currently executing a deployed workload in the cloud computing environment, may collect time series data representing current performance metrics associated with the monitored system. The detection engine may then calculate a current monitored entropy value (based on the collected time series data representing current performance metrics) and (iii) compare the current monitored entropy value with a threshold value (based on the historical entropy value).

Abstract: A system may include a historical time series data store that contains electronic records associated with Software-as-a-Service (“SaaS”) applications in a multi-tenant cloud computing environment (including time series data representing execution of the SaaS applications). A monitoring platform may retrieve time series data for the monitored SaaS application from the historical time series data store and create tenant vector representations associated with the retrieved time series data. The monitoring platform may then provide the retrieved time series data and tenant vector representations together as final input vectors to an autoencoder to produce an output including at least one of a tenant-specific loss reconstruction and tenant-specific thresholds for the monitored SaaS application. The monitoring platform may utilize the output of the autoencoder to automatically detect an anomaly associated with the monitored SaaS application.

Abstract: A system and method are disclosed associated with a cloud computing environment. The system includes a tracing tool, coupled to a controller in the cloud computing environment, that captures sequences of events associated with the controller and a deployed workload. A detection engine may detect important event patterns in the sequences captured by the tracing tool using a PrefixSpan algorithm in connection with a specific controller action associated with the deployed workload. A neural network, trained with the detected important event patterns, may predict which important event patterns caused the controller to perform the specific action associated with the deployed workload.

Abstract: A Relational Database Management System (“RDBMS”) as a service cluster may including a master RDBMS Virtual Machine (“VM”) node associated with an Internet Protocol (“IP”) address and a standby RDBMS VM node associated with an IP address. The RDBMS as a service (e.g., PostgreSQL as a service) may also include n controller VM nodes each associated with an IP address. An internal load balancer may receive requests from cloud applications and include a frontend IP address different than the RDBMS IP as a service addresses and a backend pool including indications of the master RDBMS VM node and the standby RDBMS VM node. A Hyper-Text Transfer Protocol (“HTTP”) custom probe may transmit requests for the health of the master RDBMS VM node and the standby RDBMS VM node via the associated IP addresses, and responses to the requests may be used in connection with a failover operation.

Abstract: Some embodiments may be associated with a cloud computing environment. A serverless runtime workload may execute an eBPF program via a kprobe which gets invoked when function code is executed as a Linux process. The system may determine, by the kprobe function associated with an identifier, that an orchestrator is evicting the serverless runtime workload. Responsive to the determination, a userspace program may be invoked via the eBPF in tandem with the kprobe acting as an interception mechanism. The system may then capture the current workload process state data associated with the serverless runtime workload based on the identifier. A clustered memory-based storage component may store the captured current workload process state data in association with the identifier. A subsequent serverless runtime workload may determine that the orchestrator is restoring the serverless runtime workload.

Abstract: According to some embodiments, a user vector generator may access information about a user (e.g., a software deployment developer or operator) in a user data store that contains electronic records each associated with different user. Each record may include, for example, a user identifier and user characteristics. Based on the user characteristics, the system may automatically generate a user vector indicating a computing environment skillset level for that user (e.g., beginner, intermediate, or expert). A machine learning privilege assignment platform may receive an indication of the user vector for the user and, based on the user vector and a machine learning algorithm, generate a privilege decision for that user (e.g., when the user attempts to update the system). An indication of the privilege decision may be output, according to some embodiments, to an SMT solver to review the privilege decision before granting the user access to the computing environment.

Abstract: A host delegates Just-In-Time (JIT) bytecode compilation to a serverless Web Assembly (WASM) runtime. The WASM runtime receives the bytecode, together with any additional arguments (e.g.: offsets of dependent functions, vtable metadata, virtual machine state). The host may include a parser to provide the additional arguments. In response to receiving the bytecode and arguments, the WASM runtime triggers a thread and loads appropriate WASM modules to compile the bytecode. The resulting assembly instructions are sent back to the host for execution in connection with the (frequently requested) method. Only the bytecode of frequently-accessed methods (as determined at the host) may be delegated for compilation. Delegation of bytecodes for compilation according to embodiments, may conserve a significant percentage of CPU cycles at the host, which can then be used for executing code instead.

Abstract: A computer-implemented method includes constructing a tenancy knowledge graph having a plurality of tenant nodes representing respective tenants in a multitenant computing environment, a plurality of property nodes representing respective properties of the tenants, and a plurality of edges connecting the plurality of tenant nodes and the plurality of property nodes, transforming the plurality of property nodes to corresponding property vectors, performing random walks starting from the plurality of tenant nodes of the tenancy knowledge graph, feeding sequences of nodes traversed by the random walks into a neural network to generate a plurality of tenant vectors corresponding to the plurality of tenant nodes, and clustering the plurality of tenant nodes into one or more tenant clusters based on similarity of the plurality of tenant vectors.

Abstract: A computer-implemented method includes constructing a tenancy knowledge graph having a plurality of tenant nodes representing respective tenants in a multitenant computing environment, a plurality of property nodes representing respective properties of the tenants, and a plurality of edges connecting the plurality of tenant nodes and the plurality of property nodes, transforming the plurality of property nodes to corresponding property vectors, performing random walks starting from the plurality of tenant nodes of the tenancy knowledge graph, feeding sequences of nodes traversed by the random walks into a neural network to generate a plurality of tenant vectors corresponding to the plurality of tenant nodes, and clustering the plurality of tenant nodes into one or more tenant clusters based on similarity of the plurality of tenant vectors.

Abstract: Methods and systems may be associated with a cloud computing environment. A serverless function orchestrator may execute a socket activation for a VM to pre-provision a TCP socket (e.g., setting up virtual interfaces and creating socket structures) before the VM hosts any serverless function associated with the pre-provisioned TCP socket. After this socket activation, the orchestrator may receive a request for a first serverless function and, responsive to the received request, start the first serverless function on the VM using the pre-provisioned TCP socket. After the activation and prior to starting the first serverless function, the system may queue packets received in connection with the pre-provisioned TCP socket. In some embodiments, multiple TCP sockets, each associated with a VM, may activated before any serverless functions are hosted and the first serverless function is started on a VM selected based on information in a serverless function experience data store.

Abstract: Methods and systems may be associated with a cloud computing environment. A proxy platform data store may contain node data associated with nodes of the cloud computing environment. Each node might, for example, store multi-party computation information. A proxy platform, able to access the proxy platform data store, may detect that a first node needs to access a cloud application secret key and determine, based on information in the proxy platform data store, a set of nodes associated with the secret key that the first node needs to access. The proxy platform may then use a multi-party computation algorithm and information received from the set of nodes to generate the secret key.

Abstract: Some embodiments may be associated with a cloud-based actor framework. A dispatcher platform may determine that a first tenant actor is to be created for a first tenant in connection with a workload associated with a plurality of tenant identifiers. The first tenant may be, for example, associated with a first tenant identifier. The dispatch platform may then select a first thread for the first tenant actor from a pool of available threads and spin a first web assembly module such that execution of the first web assembly module is associated with a first web assembly browser sandbox. The dispatcher platform can then securely create the first tenant actor within the first web assembly browser sandbox to execute the workflow for the first tenant identifier. Similarly, a second web assembly browser sandbox may execute a second tenant actor for a second tenant identifier.

Abstract: Some embodiments may be associated with a cloud-based computing environment. A WASM runtime may execute as serverless functions on an entity (VM or container) dynamically selected based on a data store location (associated with data locality and/or gravity). The WASM runtime may include one or more sandboxes each running a WASM module. A database service may access the data store, and the database service may execute on the same entity as the WASM runtime. In some embodiments, an orchestration layer selects the entity based on a default policy or user-defined custom rules in accordance with exposed attributes (CPU load, memory load, read/write mixture, etc.). According to some embodiments, the serverless functions execute in a multi-tenant fashion. Moreover, the WASM runtime process may use instruction set secure enclaves to secure an access host such that, even if a root is compromised, an attacker cannot access a sandbox memory heap.

Abstract: Some embodiments may be associated with a cloud-based computing environment. A computer processor of an orchestration layer platform may deploy and manage multi-tenant workloads (e.g., each being associated with a Virtual Machine (“VM”)) in the cloud-based computing environment. A Kubernetes control plane operator associated with the multi-tenant workloads may detect a trigger event (e.g., an actual VM state not matching a desired VM state) that results in a reconciliation request for a particular tenant workload. Responsive to the reconciliation request, serverless tenant execution code, representing reconciler logic compiled into a Web Assembly (“WASM”) module, may be spun up in a WASM sandbox to perform reconciliation for the particular tenant workload.

Abstract: Some embodiments may be associated with a cloud-based actor framework. A dispatcher platform may determine that a first tenant actor is to be created for a first tenant in connection with a workload associated with a plurality of tenant identifiers. The first tenant may be, for example, associated with a first tenant identifier. The dispatch platform may then select a first thread for the first tenant actor from a pool of available threads and spin a first web assembly module such that execution of the first web assembly module is associated with a first web assembly browser sandbox. The dispatcher platform can then securely create the first tenant actor within the first web assembly browser sandbox to execute the workflow for the first tenant identifier. Similarly, a second web assembly browser sandbox may execute a second tenant actor for a second tenant identifier.

Abstract: Some embodiments may be associated with a cloud-based computing environment. A centralized multi-tenancy service may include an application interface to receive a query from one of a plurality of applications. A tenant policy store may contain declarative tenant policies, and a tenant policy manager engine may automatically process the received query based on at least one tenant policy. If the received query is not processed successfully, the centralized multi-tenancy service may return an error message to the application via the application interface. If the received query is processed successfully, the centralized multi-tenancy service may exchange information with a multi-tenant service instance (e.g., a multi-tenant database as a service instance) and return a data result to the application via the application interface.

Abstract: Some embodiments may be associated with a cloud-based computing environment. A multi-tenant master process platform, associated with a RDBMS, may create a logical database for a tenant on a physical instance of the cloud-based computing environment. A connection to the logical database may be received from a client user associated with the tenant, and a process for the connection may be created. A process identification number created for the process may then be captured along with the database identifier for the tenant using an in-kernel virtual machine program. The system may send the process identification number and the database identifier to a user space program. The user space program creates a control group with the name of the database identifier and places the process identification number into the control group. The control group can then be limited with respect to a maximum amount of resources (memory, CPU etc.).

Abstract: A system and method are disclosed to facilitate automated database system workload classification. A utilization metrics data source may contain utilization metrics vectors associated with workloads of the database system. A variational autoencoder may receive utilization metrics vectors from the utilization metrics data source and encode the utilization metrics vectors into latent vector features. Moreover, the variational autoencoder may be trained to generate appropriate distributions around the latent vector features. A synthetic workload creation platform receives information about the distributions around the latent vector features and samples different values from the distributions to create synthetic workload vectors. A workload classification platform, trained using the synthetic workload vectors, may then generate workload classification labels for workloads running on the database system (e.g., to tune database parameters as appropriate).

Abstract: A system and method are disclosed associated with a multi-tenant cloud computing environment. The system may receive information about a serverless function workload (e.g., a NodeJS, Java function or ABAP workload) to be launched in the cloud computing environment. A tenant associated with the serverless function workload to be launched may be identified and, based at least in part on the identified tenant, an objective function (e.g., throughput, latency, cost, etc.) for the serverless function workload to be launched may be identified. A recommendation service platform may then iteratively configure tuning parameters of the cloud computing environment using Bayesian optimization (e.g., to reach a global optimum using a Gaussian process) and the determined objective function. The system may then arrange for the serverless function workload to be executed in the cloud computing environment in accordance with the configured tuning parameters.

Abstract: A system and method are disclosed to facilitate automated database system workload classification. A utilization metrics data source may contain utilization metrics vectors associated with workloads of the database system. A variational autoencoder may receive utilization metrics vectors from the utilization metrics data source and encode the utilization metrics vectors into latent vector features. Moreover, the variational autoencoder may be trained to generate appropriate distributions around the latent vector features. A synthetic workload creation platform receives information about the distributions around the latent vector features and samples different values from the distributions to create synthetic workload vectors. A workload classification platform, trained using the synthetic workload vectors, may then generate workload classification labels for workloads running on the database system (e.g., to tune database parameters as appropriate).