Abstract: A method for processing a resource access request in a network based on a software defined network (SDN) protocol includes receiving a resource access request forwarded by a first SDN switch in the network, wherein there exists no forwarding rule matching the resource access request in the first SDN switch; obtaining, according to the resource access request, resource server information of a resource server where the requested resource is stored, wherein the resource server is located in the network; generating a forwarding rule corresponding to the resource access request according to the resource server information; and sending to the first SDN switch at least one portion of the forwarding rule corresponding to the resource access request, so that the first SDN switch forwards the resource access request according to the at least one portion of the forwarding rule.

Abstract: In one embodiment, a system includes a first tracked device and a second tracked device. The first tracked device includes first known device data, describing one or more previous connections known to the first tracked device. The second tracked device includes second known device data, describing one or more previous connections known to the second tracked device. The first tracked device is configured to connect to the second tracked device, transfer to the second tracked device at least a portion of the first known device data, and receive from the second tracked device at least a portion of the second known device data. The first tracked device is further configured to modify the first known device data to incorporate the second known device data. The second known device data includes data related to a previous connection involving a third tracked device outside a signal range of the first tracked device.

Abstract: In one embodiment, a system includes a first tracked device and a second tracked device. The first tracked device includes first known device data, describing one or more previous connections known to the first tracked device. The second tracked device includes second known device data, describing one or more previous connections known to the second tracked device. The first tracked device is configured to connect to the second tracked device, transfer to the second tracked device at least a portion of the first known device data, and receive from the second tracked device at least a portion of the second known device data. The first tracked device is further configured to modify the first known device data to incorporate the second known device data. The second known device data includes data related to a previous connection involving a third tracked device outside a signal range of the first tracked device.

Abstract: A method includes retrieving, from a memory accessible by a computer, a document comprising a workload definition document that defines an intended virtual configuration to include at least one virtual machine and at least one network appliance to be associated with at least one of the virtual machines in the intended virtual configuration, each network appliance respectively serving a role in the intended virtual configuration of transforming, inspecting, filtering, or otherwise manipulating all the network traffic, before it reaches an intended virtual machine, for purpose other than a data packet forwarding in a virtual configuration. The workload definition document is parsed to extract attributes of each of the network appliances, including one or more security policy to be applied to each network appliance. Configuration data is extracted from the parsed workload definition document that is related to any security policy of any of the network appliances to be deployed.

Abstract: A method includes retrieving, from a memory accessible by a computer, a document comprising a workload definition document that defines an intended virtual configuration to include at least one virtual machine and at least one network appliance to be associated with at least one of the virtual machines in the intended virtual configuration, each network appliance respectively serving a role in the intended virtual configuration of transforming, inspecting, filtering, or otherwise manipulating all the network traffic, before it reaches an intended virtual machine, for purpose other than a data packet forwarding in a virtual configuration. The workload definition document is parsed to extract attributes of each of the network appliances, including one or more security policy to be applied to each network appliance. Configuration data is extracted from the parsed workload definition document that is related to any security policy of any of the network appliances to be deployed.

Abstract: The present invention relates to data packet processing in a data network, and provides a method and system for processing data packets. The method comprising: dividing flows containing data packets into elephant flows and mice flows according to a particular division parameter, wherein, an elephant flow contains more data packets than a mice flow; transmitting the divided elephant flows and mice flows to a virtual switch in a server; processing the mice flows at the virtual switch, and transmitting the elephant flows and the processed mice flows to a hardware switch in network; and processing the elephant flows at the hardware switch, and forwarding the received mice flows and the processed elephant flows. With the method and system, network performance may be effectively improved.

Abstract: A method and a system of associating a runtime event with a component. The method includes catching the runtime event; catching the context of the current running environment and determining the current component based on said context; and getting the associating policy of current component and determining the responsible component associated with said runtime event based on said associating policy.

Abstract: Method, apparatus and system for resolving domain names in network. One embodiment provides a method for resolving a domain name in a network, including: receiving, at a controller associated with a switch in the network, a domain name system (DNS) request for the domain name from the switch, the DNS request initiated by a client, the controller controlling operations of the switch in the network; and controlling processing of the DNS request based on a predefined security constraint at the controller to obtain a network address corresponding to the domain name, wherein the DNS request is forwarded by the switch to the controller in response to a DNS record related to the domain name being missed in first storage at the switch. Other embodiments of the present invention provide a corresponding apparatus and system.

Abstract: Techniques for realizing service chaining, a corresponding apparatus and an SDN (Software Defined Network) controller are disclosed. The method includes temporarily modifying an original destination MAC (media access control) address of a packet and an original source MAC address the packet during the time the packet makes a hop from one middlebox to another. A restore operation is used to restore the original source and destination MAC addresses after the hop is made.

Abstract: A method for processing a resource access request in a network based on a software defined network (SDN) protocol includes receiving a resource access request forwarded by a first SDN switch in the network, wherein there exists no forwarding rule matching the resource access request in the first SDN switch; obtaining, according to the resource access request, resource server information of a resource server where the requested resource is stored, wherein the resource server is located in the network; generating a forwarding rule corresponding to the resource access request according to the resource server information; and sending to the first SDN switch at least one portion of the forwarding rule corresponding to the resource access request, so that the first SDN switch forwards the resource access request according to the at least one portion of the forwarding rule.

Abstract: The present invention discloses a method and apparatus for processing a data packet in a software defined network SDN protocol-based network. The method comprises: receiving a data packet forwarded by a SDN switch in the network; obtaining a rule corresponding to a data flow where the data packet is located; determining, according to the received data packet, data flow characteristics of the data flow where the data packet is located; determining timeout information of the rule according to a predetermined matching relationship between the data flow characteristics and the timeout information, the timeout information indicating time that the rule will be kept in a flow table of the SDN switch; and sending the rule and the timeout information of the rule to the SDN switch for processing the data packet by the SDN switch according to the rule.

Abstract: A method for processing a resource access request in a network based on a software defined network (SDN) protocol includes receiving a resource access request forwarded by a first SDN switch in the network, wherein there exists no forwarding rule matching the resource access request in the first SDN switch; obtaining, according to the resource access request, resource server information of a resource server where the requested resource is stored, wherein the resource server is located in the network; generating a forwarding rule corresponding to the resource access request according to the resource server information; and sending to the first SDN switch at least one portion of the forwarding rule corresponding to the resource access request, so that the first SDN switch forwards the resource access request according to the at least one portion of the forwarding rule.

Abstract: A method and system for deploying a cluster, wherein the cluster contains a plurality of cluster members, the method comprising: obtaining a unique identifier for each cluster member; according to the unique identifier of each cluster member, obtaining cluster configuration information for the cluster member; configuring the cluster member using the obtained cluster configuration information of the cluster member; and deploying the cluster. The method and system can enhance the cluster deployment efficiency.

Abstract: A method and apparatus for managing remote devices. In one embodiment of the present invention, there is provided a method of managing a remote device, comprising: obtaining a first identifier based on a name sequence in state information of the remote device, the first identifier being for indicating a template that provides the state information; obtaining a second identifier based on a numerical value sequence in the state information; sending a state access notification that comprises at least the first identifier and the second identifier; and providing the state information based on the first identifier and the second identifier in response to having received a result of activating the state access notification. In one embodiment of the present invention, there is provided an apparatus for managing a remote device.

Abstract: A method, computer program product and apparatus for diagnosing a fault incident in a data center. A determination is made as to whether a fault incident happened in the data center. If a fault incident happened, then the business logic being executed in a node where the fault incident happened is determined. The log files associated with the execution process of the business logic is selected based on a management model corresponding to the data center, where the management model reflects the deployment and application dependency of the business logics. The fault incident is diagnosed based on the log files. The management model is utilized to select the log files associated with the execution process of the business logic, and to write information of the business logic and dependency relationships between the applications into the log file, so as to automatically, rapidly and accurately diagnose the fault incident.

Abstract: A method and apparatus for discovering application configuration files in a system. The method includes the steps of: obtaining a process identifier of an application in concern; comparing the obtained process identifier with a process identifier of a process for operating configuration files in the system; and determining configuration files to be the configuration files of the application in concern if the obtained process identifier is identical to the process identifier of a process for operating the configuration files in the system. Application configuration files can be automatically discovered and thereby monitored, such that the change of the application configuration files can be effectively and accurately detected, so as to facilitate a user to perform various subsequent operations.

Abstract: A method and apparatus for locating a memory leak in a program code by a computer device using a combination of dynamic analysis and static analysis approaches. The method includes dynamically analyzing the program to determine a memory leak characteristic; filtering out items which do not match the determined memory leak characteristic of the program to reduce a static analysis range to certain suspicious parts of a source code; and statically analyzing the suspicious parts of the program to locate the memory leak in the program. The apparatus includes a dynamic analyzer device to determine memory leak characteristics; and a static analyzer device to filter out items which do not match the determined memory leak characteristic to reduce a static analysis range to certain suspicious parts of a source code and locate the memory leak in the program.

Abstract: A method and an apparatus for diagnosing memory leak. The method includes: tracing the allocation of objects; recording allocation paths and allocation time of each object; giving to each object one unique identifier (ID) corresponding to an allocation path; determining the allocation path to which each object belongs; organizing the objects which are allocated but still not collected, and counting the age generations of the objects of the similar type according to the allocation time of each object; ranking the allocation paths according to the age generations of the surviving objects; and analyzing the ranking of the allocation paths, in which the allocation path with higher rank is more probable to introduce memory leaks. Thus, the suspicious allocation path possibly incurring memory leaks is selected and reported to the user for analysis.

Abstract: A computer implemented method and system for determining resource usage of a tenant in a multi-tenant architecture. The method includes the steps of: recording, within predetermined time intervals, total consumption of each resource in each predetermined time interval; obtaining total times of calling each operation by each tenant in each predetermined time interval; calculating consumption of each resource during each operation based on the total times and the total consumption obtained within the period of time; and calculating usage of each resource by each tenant within the period of time based on the calculated consumption of each resource during each operation and the total times of calling each operation of each tenant in each predetermined time interval. The system includes apparatus for performing the above method.

Abstract: A method and device for performing a constraint failure analysis on an instance model. The present invention provides a convenient tool to bridge between a model-constraint designer and a model user, reduce load for model/constraint usability, simplify the learning curve, and assist to make a model correction for the model user.