Abstract: A method for data-center management includes, in a data center including multiple components, monitoring a plurality of performance measures of the components. A set of composite metrics is automatically defined, each composite metric including a respective weighted combination of two or more performance measures from among the performance measures. Baseline values are established for the composite metrics. An anomalous deviation is detected of one or more of the composite metrics from the respective baseline values.

Abstract: Systems, computer program products, and methods are described herein for machine learning (ML) based system for network resilience and steering. An example system monitors data movement across one or more network ports; extracts network performance indicators associated with the data movement; determines, via a machine learning (ML) subsystem, that a status of a first network port is indicative of operational failure based on at least the network performance indicators; determines that the first network port is associated with a first network port cluster; determines a redundant network port and an intermediate network switch associated with the first network port cluster; and triggers the intermediate network switch to reroute a portion of network traffic from the first network port to the redundant network port in response to the status of the first network port.

Abstract: Systems, computer program products, and methods are described herein for machine learning (ML) based network resilience and steering. An example system monitors data traffic across one or more network ports and determines a first data traffic pattern from the data traffic. The system further determines, via a ML subsystem, that the first data traffic pattern is indicative of a security threat to a first network port. In response to determining that the first data traffic pattern is indicative of the security threat to the first network port, the system further isolates the first network port from the one or more network ports.

Abstract: Apparatuses, systems, and techniques of using one or more circuits (e.g., of a network interface) to obtain contents of at least one memory region usable, by one or more processes being performed by a host computing system, to store dynamic memory allocations, and determine whether any of the process(es) is performing at least one potentially harmful task based at least in part on the contents of the memory region(s).

Abstract: Apparatuses, systems, and techniques of using one or more circuits (e.g., of a network interface) to obtain assembly code for one or more machine code segments loaded and/or injected into a process, and determine whether the assembly code is likely to perform at least one unauthorized task.

Abstract: Apparatuses, systems, and techniques to predict a probability of an error in processing units, such as those of a data center. In at least one embodiment, the probability of an error occurring in a processing unit is identified using a machine learning model trained using one or more previously trained machine learning models, in which the machine learning model is smaller than the previously trained machine learning models.

Abstract: Apparatuses, systems, and techniques for classifying a candidate uniform resource locator (URL) as malicious using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being words in a candidate URL and numeric features of a URL structure of the candidate URL. The security service classifies, using the ML detection system, the candidate URL as malicious or benign using the set of features. The security service outputs an indication of a malicious URL responsive to the candidate URL being classified as malicious.

Abstract: Apparatuses, systems, and techniques to predict a probability of an error or anomay in processing units, such as those of a data center. In at least one embodiment, the probability of an error occuring in a proccessing unit is identified using multiple trained machine learning models, in which the trained machine learning models each outputs, for example, the probability of an error occuring within a different predetermined time period.

Abstract: Apparatuses, systems, and techniques for classifying one or more candidate uniform resource locators (URLs) as having a domain generation algorithm (DGA) domain using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being domain characters in one or more candidate URLs. The security service classifies, using the ML detection system, the one or more candidate URLs as having a DGA domain or a non-DGA domain using the set of features. The security service outputs an indication of a DGA malware responsive to the one or more candidate URLs being classified as having the DGA domain.

Abstract: Apparatuses, systems, and techniques for detecting that one or more computer programs executed by a host device are subject to malicious activity using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being associated with the one or more computer programs. The security service determines, using the ML detection system, whether the one or more computer programs are subject to malicious activity based on the set of features. The security service outputs an indication of the malicious activity responsive to a determination that the one or more computer programs are subject to the malicious activity.

Abstract: Apparatuses, systems, and techniques for classifying one or more computer programs executed by a host device as being ransomware using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service obtains a series of snapshots of data stored in the physical memory and extracts a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time. The security service classifies a process of the one or more computer programs as ransomware or non-ransomware using the set of features and outputs an indication of ransomware responsive to the process being classified as ransomware.

Abstract: A system and method may determine if a class of process (e.g. NN execution, cryptocurrency mining, graphic processing) is executing on a processor, or which class is executing, by calculating or determining features from execution telemetry or measurements collected from processors executing processes, and determining from at least a subset of the features the likelihood that the processor is executing the class of process. Execution telemetry may include data regarding or describing the execution of the process, or describing hardware used to execute the process, such as processor temperature, memory usage, etc.

Abstract: System and method for detecting cable anomalies including collecting a first set cable measurement data. The first set of cable measurement data may be used to create a model including one or more groups based on the collected first set of cable measurement data. Collecting a second set of cable measurement data and determine a probability of anomaly for cable measurement data of the second set of cable measurement data, the probability of anomaly based on the deviation of the cable measurement data from one or more groups of the model.

Abstract: A method for data-center management includes, in a data center including multiple components, monitoring a plurality of performance measures of the components. A set of composite metrics is automatically defined, each composite metric including a respective weighted combination of two or more performance measures from among the performance measures. Baseline values are established for the composite metrics. An anomalous deviation is detected of one or more of the composite metrics from the respective baseline values.