Abstract: Network management systems and associated methods are described for providing intent-driven management of networks using one or more compilers. An intent identifying an expectation for behavior in a network and entity associations for the intent may be received at a compiler. The compiler may determine one or more artifacts for the respective entities based on the intent. The compiler may output instructions based on the artifacts for the consumers. The instructions may be in a language and/or format corresponding to the consumers.

Abstract: Systems and methods are provided for obtaining policy data associated with a private network implemented at least partly within a cloud provider network; establishing, based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtaining metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enabling the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

Abstract: Systems and methods are provided for evaluation of communication paths through networks to determine whether communication is permitted across one or more internal network boundaries. The analysis may be used to determine whether a node in one isolated network (e.g., VPC, VPN, client on-premise network, etc.) is able to communicate with a node in another isolated network across region and/or segment boundaries. The automated analysis can allow users (e.g., network administrators) to see what high-level policies (e.g., Cloud WAN policies written in a declarative language) are interfering with or permitting communication between the nodes.

Abstract: Systems and methods are provided for evaluation of networks and changes thereto using automated analysis of network models. The automated analysis can be used to determine how to implement and mutate networks efficiently and effectively, to determine whether and why network resources are unable to communicate with each other, and the like. Automated analysis can allow users (e.g., network administrators) to define networks and pose changes to networks using high-level policies (e.g., written in a declarative language), have those polices automatically translated to lower-level implementation operations for analysis, and in some cases have results of the analysis presented back to the users in an easy-to-understand form.

Abstract: Systems and methods are provided for resiliency testing microservice-based applications. For example, a method for resiliency testing an application includes receiving a test script that specifies a failure scenario in a distributed microservice-based application comprising a plurality of microservices, and an asserted behavioral expectation of at least one microservice of the distributed microservice-based application in response to the specified failure scenario. The specified failure scenario is translated into fault injection rules. The fault injection rules are utilized to execute fault injection operations on messages that are exchanged between at least a first microservice and a second microservice of the distributed microservice-based application, to stage the specified failure scenario during the failure recovery testing of the distributed microservice-based application.

Abstract: Systems and methods are provided for resiliency testing microservice-based applications. For example, a method for resiliency testing an application includes receiving a test script that specifies a failure scenario in a distributed microservice-based application comprising a plurality of microservices, and an asserted behavioral expectation of at least one microservice of the distributed microservice-based application in response to the specified failure scenario. The specified failure scenario is translated into fault injection rules. The fault injection rules are utilized to execute fault injection operations on messages that are exchanged between at least a first microservice and a second microservice of the distributed microservice-based application, to stage the specified failure scenario during the failure recovery testing of the distributed microservice-based application.

Abstract: A processing device comprises a processor coupled to a memory and is configured to obtain data characterizing host devices of a computer network of an enterprise. The data is applied to a logistic regression model to generate malware infection risk scores for respective ones of the host devices. The malware infection risk scores indicate likelihoods that the respective host devices will become infected with malware. The logistic regression model incorporates features of the host devices including at least user demographic features, virtual private network (VPN) activity features and web activity features of the host devices, and the data characterizing the host devices comprises data for the incorporated features. Proactive measures are taken to prevent malware infection in a subset of the host devices based at least in part on the malware infection risk scores. The processing device may be implemented in the computer network or an associated network security system.