公开(公告)号：EP3126960A1

公开(公告)日：2017-02-08

申请号：EP15774396.4

申请日：2015-03-24

Applicant: NEC Laboratories America, Inc.

Inventor： ARORA, Nipun ,  RHEE, Junghwan ,  ZHANG, Hui ,  JIANG, Guofei

IPC: G06F9/30 ,  G06F9/445

CPC classification number: G06F11/3466

Abstract: The present invention enables capturing API level calls using a combination of dynamic instrumentation and library overriding. The invention allows event level tracing of API function calls and returns, and is able to generate an execution trace. The instrumentation is lightweight and relies on dynamic library/shared library linking mechanisms in most operating systems. Hence we need no source code modification or binary injection. The tool can be used to capture parameter values, and return values, which can be used to correlate traces across API function calls to generate transaction flow logic.

Abstract translation: 本发明能够使用动态仪器和库覆盖的组合捕获API级别的调用。 本发明允许API函数调用和返回的事件级别跟踪，并且能够生成执行跟踪。 仪器是轻量级的，并且在大多数操作系统中都依赖于动态库/共享库链接机制。 因此，我们不需要源代码修改或二进制注入。 该工具可用于捕获参数值和返回值，这些值可用于在API函数调用之间关联跟踪以生成事务流逻辑。

公开(公告)号：EP3058465A1

公开(公告)日：2016-08-24

申请号：EP14854428.1

申请日：2014-10-14

Applicant: NEC Laboratories America, Inc.

Inventor： RHEE, Junqhwan ,  ZHANG, Hui ,  ARORA, Nipun ,  JIANG, Guofei ,  KIM, Chung Hwan

IPC: G06F11/36

CPC classification number: G06F11/3636 ,  G06F11/3419

Abstract: Methods and systems for performance inference include inferring an internal application status based on a unified call stack trace that includes both user and kernel information by inferring user function instances. A calling context encoding is generated that includes information regarding function calling paths. The analysis includes performing a top-down latency breakdown and ranking calling contexts according to how costly each function calling path is.

公开(公告)号：EP2524277A2

公开(公告)日：2012-11-21

申请号：EP11733405.2

申请日：2011-01-13

Applicant: NEC Laboratories America, Inc.

Inventor： ZHANG, Hui ,  SU, Ya-Yunn ,  JIANG, Guofei ,  YOSHIHIRA, Kenji

IPC: G06F1/32 ,  G06F15/16 ,  G06F9/06

CPC classification number: G06F1/3206 ,  G06F9/5077 ,  G06F9/5094 ,  Y02D10/22 ,  Y02D10/36

Abstract: A method and system for coordinating energy management in a virtualized data center including a plurality of physical servers and a plurality of virtual machines (VMs), includes analyzing status information about the virtualized data center; determining server utilization target settings for server consolidation from the analyzed status information; and executing the server consolidation according to the determined server utilization target settings. Server consolidation can be executed by determining an effective size of each of the VMs and placing the VMs on the servers in a selective manner using an independent workload VM placement process, a correlation-aware VM placement process, or a migration-cost and correlation-aware VM placement process.

公开(公告)号：EP3186932A1

公开(公告)日：2017-07-05

申请号：EP15835856.4

申请日：2015-08-21

Applicant: NEC Laboratories America, Inc.

Inventor： LUMEZANU, Cristian ,  JIN, Cheng ,  ZHANG, Hui ,  SHARMA, Abhishek ,  XU, Qiang ,  ARORA, Nipun ,  JIANG, Guofei

IPC: H04L12/721 ,  H04L12/761 ,  H04L12/937 ,  H04L12/64

Abstract: Systems and methods for controlling legacy switch routing in one or more hybrid networks of interconnected computers and switches, including generating a network underlay for the one or more hybrid networks by generating a minimum spanning tree (MST) and a forwarding graph (FWG) over a physical network topology of the one or more hybrid networks, determining an optimal path between hosts on the FWG by optimizing an initial path with a minimum cost mapping, and adjusting the initial path to enforce the optimal path by generating and installing special packets in one or more programmable switches to trigger installation of forwarding rules for one or more legacy switches.

Abstract translation: 用于控制互连计算机和交换机的一个或多个混合网络中的传统交换机路由的系统和方法，包括通过在一个或多个混合网络上生成最小生成树（MST）和转发图（FWG）来生成一个或多个混合网络的网络底层 一个或多个混合网络的物理网络拓扑，通过使用最小成本映射优化初始路径来确定FWG上的主机之间的最佳路径，并且通过在一个或多个混合网络中生成并安装特定分组来调整初始路径以实施最佳路径，或 更多可编程交换机来触发安装一个或多个传统交换机的转发规则。

公开(公告)号：EP3183848A1

公开(公告)日：2017-06-28

申请号：EP15833008.4

申请日：2015-08-20

Applicant: NEC Laboratories America, Inc.

Inventor： XU, Qiang ,  LUMEZANU, Cristian ,  LIU, Zhuotao ,  ARORA, Nipun ,  SHARMA, Abhishek ,  ZHANG, Hui ,  JIANG, Guofei

IPC: H04L12/751 ,  G06F9/455

CPC classification number: H04L41/12 ,  G06F9/45533 ,  H04L41/083 ,  H04L43/087 ,  H04L45/02 ,  H04L45/121 ,  H04L45/123 ,  H04L45/124

Abstract: Systems and methods for decoupled searching and optimization for one or more data centers, including determining a network topology for one or more networks of interconnected computer systems embedded in the one or more data center, searching for routing candidates based on a network topology determined, and updating and applying one or more objective functions to the routing candidates to determine an optimal routing candidate to satisfy embedding goals based on tenant requests, and to embed the optimal routing candidate in the one or more data centers.

Abstract translation: 用于对一个或多个数据中心进行解耦搜索和优化的系统和方法，包括确定嵌入在一个或多个数据中心中的互连计算机系统的一个或多个网络的网络拓扑，基于确定的网络拓扑搜索路由候选，以及 更新并将一个或多个目标函数应用于路由候选者以基于租户请求确定最佳路由候选者以满足嵌入目标，并且将最佳路由候选者嵌入到一个或多个数据中心中。

公开(公告)号：EP3085022A1

公开(公告)日：2016-10-26

申请号：EP14870677.3

申请日：2014-12-19

Applicant: NEC Laboratories America, Inc.

Inventor： ZHANG, Hui ,  RHEE, Junghwan ,  ARORA, Nipun ,  LUMEZANU, Cristian ,  JIANG, Guofei

IPC: H04L12/26

CPC classification number: H04L41/0631 ,  H04L41/069 ,  H04L41/14 ,  H04L43/0858

Abstract: A computer implemented method for network monitoring includes providing network packet event characterization and analysis for network monitoring that includes supporting summarization and characterization of network packet traces collected across multiple processing elements of different types in a virtual network, including a trace slicing to organize individual packet events into path-based trace slices, a trace characterization to extract at least 2 types of feature matrix describing those trace slices, and a trace analysis to cluster, rank and query packet traces based on metrics of the feature matrix.

Abstract translation: 一种用于网络监测的计算机实现方法包括为网络监测提供网络分组事件表征和分析，其包括支持在虚拟网络中跨越不同类型的多个处理元件收集的网络分组跟踪的摘要和表征，包括用于组织各个分组事件的跟踪分片 基于路径的跟踪片，跟踪表征，以提取描述这些跟踪片段的至少2种类型的特征矩阵，以及基于特征矩阵的度量的集群，排序和查询分组跟踪的跟踪分析。

公开(公告)号：EP2807563A1

公开(公告)日：2014-12-03

申请号：EP13741063.5

申请日：2013-01-09

Applicant: NEC Laboratories America, Inc.

Inventor： LUMEZANU, Cristian ,  JIANG, Guofei ,  ZHANG, Yueping ,  SINGH, Vishal ,  AREFIN, Ahsan

IPC: G06F11/36 ,  G06F9/44

CPC classification number: G06F11/3476 ,  G06F11/0793 ,  G06F11/3006 ,  G06F11/3017 ,  G06F11/302 ,  G06F11/3055 ,  H04L41/142 ,  H04L41/145 ,  H04L43/04

Abstract: A debugging system used for a data center in a network is disclosed. The system includes a monitoring engine to monitor network traffic by collecting traffic information from a network controller, a modeling engine to model an application signature, an infrastructure signature, and a task signature using a monitored log, a debugging engine to detect a change in the application signature between a working status and a non-working status using a reference log and a problem log, and to validate the change using the task signature, and a providing unit to provide toubleshooting information, wherein an unknown change in the application signature is correlated to a known problem class by considering a dependency to a change in the infrastructure signature. Other methods and systems also are disclosed.

公开(公告)号：EP2772021A2

公开(公告)日：2014-09-03

申请号：EP13735761.2

申请日：2013-01-09

Applicant: NEC Laboratories America, Inc.

Inventor： LUMEZANU, Cristian ,  JIANG, Guofei ,  ZHANG, Yueping ,  SINGH, Vishal ,  WANG, Ye

IPC: H04L12/26

CPC classification number: H04L47/12 ,  H04L43/026 ,  H04L43/16 ,  H04L47/2441 ,  H04L47/41 ,  H04L63/1425 ,  Y02D50/30

Abstract: A device used in a network is disclosed. The device includes a network monitor to monitor a network state and to collect statistics for flows going through the network, a flow aggregation unit to aggregate flows into clusters and identify flows that can cause a network problem, and an adaptive control unit to adaptively regulate the identified flow according to network feedback. Other methods and systems also are disclosed.

公开(公告)号：EP2286337A2

公开(公告)日：2011-02-23

申请号：EP09751062.2

申请日：2009-04-06

Applicant: NEC Laboratories America, Inc.

Inventor： JIANG, Guofei ,  CHEN, Haifeng ,  YOSHIHIRA, Kenji

IPC: G06F11/30 ,  G06F9/44 ,  G06F21/00

CPC classification number: H04L43/16 ,  G06F11/0709 ,  G06F11/0781 ,  G06F21/552 ,  H04L41/0681 ,  H04L41/16

Abstract: A system and method for prioritizing alerts includes extracting invariants to determine a stable set of models for determining relationships among monitored system data. Equivalent thresholds for a plurality of rules are computed using an invariant network developed by extracting the invariants. For a given time window, a set of alerts are received from a system being monitored. A measurement value of the alerts is compared with a vector of equivalent thresholds, and the set of alerts is ranked.

公开(公告)号：EP3205072A1

公开(公告)日：2017-08-16

申请号：EP15848332.1

申请日：2015-10-12

Applicant: NEC Laboratories America, Inc.

Inventor： LI, Zhichun ,  WU, Zhenyu ,  QIAN, Zhiyun ,  JIANG, Guofei ,  AKHOONDI, Masoud ,  KUSANO, Markus

IPC: H04L29/06 ,  H04L12/26

CPC classification number: H04L63/1416 ,  G06F17/30958 ,  H04L63/1425 ,  H04L63/1441 ,  H04L2463/146

Abstract: Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.

Abstract translation: 用于入侵攻击恢复的方法和系统包括监视网络中的两个或更多主机以生成系统事件的审计日志。 根据审计日志生成一个或多个依赖关系图（DGraphs）。 确定DGraphs每个边缘的相关性分数。 DGraphs中的不相关事件被修剪以产生浓缩的回溯图。 通过凝聚回溯图中的攻击检测点回溯来确定原点。