公开(公告)号：WO2016032898A1

公开(公告)日：2016-03-03

申请号：PCT/US2015/046313

申请日：2015-08-21

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： LUMEZANU, Cristian ,  JIN, Cheng ,  ZHANG, Hui ,  SHARMA, Abhishek ,  XU, Qiang ,  ARORA, Nipun ,  JIANG, Guofei

IPC: H04L12/721 ,  H04L12/761 ,  H04L12/937 ,  H04L12/64

CPC classification number: H04L45/48 ,  H04L12/462 ,  H04L45/14 ,  H04L45/16 ,  H04L45/18 ,  H04L45/64

Abstract: Systems and methods for controlling legacy switch routing in one or more hybrid networks of interconnected computers and switches, including generating a network underlay (304) for the one or more hybrid networks by generating a minimum spanning tree (MST) (306) and a forwarding graph (FWG) (308) over a physical network topology of the one or more hybrid networks (400), determining an optimal path between hosts on the FWG by optimizing an initial path with a minimum cost mapping (312), and adjusting the initial path (310) to enforce the optimal path (314) by generating and installing special packets in one or more programmable switches to trigger installation of forwarding rules for one or more legacy switches (516).

Abstract translation: 用于控制互连计算机和交换机的一个或多个混合网络中的传统交换机路由的系统和方法，包括通过生成最小生成树（MST）（306）和转发来为所述一个或多个混合网络生成网络底层（304） 通过一个或多个混合网络（400）的物理网络拓扑图（FWG）（308），通过利用最小成本映射优化初始路径（312）来确定FWG上的主机之间的最佳路径，并且调整初始 路径（310），以通过在一个或多个可编程交换机中生成和安装特殊分组来触发一个或多个传统交换机（516）的转发规则的安装来强制实现最佳路径（314）。

公开(公告)号：WO2016029031A1

公开(公告)日：2016-02-25

申请号：PCT/US2015/046138

申请日：2015-08-20

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： XU, Qiang ,  LUMEZANU, Cristian ,  LIU, Zhuotao ,  ARORA, Nipun ,  SHARMA, Abhishek ,  ZHANG, Hui ,  JIANG, Guofei

IPC: H04L12/751 ,  G06F9/455

CPC classification number: H04L41/12 ,  G06F9/45533 ,  H04L41/083 ,  H04L43/087 ,  H04L45/02 ,  H04L45/121 ,  H04L45/123 ,  H04L45/124

Abstract: Systems and methods for decoupled searching and optimization for one or more data centers, including determining a network topology for one or more networks of interconnected computer systems embedded in the one or more data centers (304), searching for routing candidates based on a network topology determined (310), and updating (314) and applying (316) one or more objective functions to the routing candidates to determine an optimal routing candidate to satisfy embedding goals based on tenant requests, and to embed the optimal routing candidate in the one or more data centers (412).

Abstract translation: 一种用于一个或多个数据中心的去耦合搜索和优化的系统和方法，包括确定嵌入在一个或多个数据中心（304）中的互连计算机系统的一个或多个网络的网络拓扑，基于网络拓扑搜索路由选择 确定（310）并且更新（314）并且将（316）一个或多个目标函数应用于路由候选以基于租户请求来确定最佳路由选择以满足嵌入目标，并且将最佳路由候选嵌入在一个或 更多数据中心（412）。

公开(公告)号：WO2015153178A1

公开(公告)日：2015-10-08

申请号：PCT/US2015/022116

申请日：2015-03-24

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： ARORA, Nipun ,  RHEE, Junghwan ,  ZHANG, Hui ,  JIANG, Guofei

IPC: G06F9/30 ,  G06F9/445

CPC classification number: G06F11/3466

Abstract: The present invention enables capturing API level calls using a combination of dynamic instrumentation and library overriding. The invention allows event level tracing of API function calls and returns, and is able to generate an execution trace. The instrumentation is lightweight and relies on dynamic library/shared library linking mechanisms in most operating systems. Hence we need no source code modification or binary injection. The tool can be used to capture parameter values, and return values, which can be used to correlate traces across API function calls to generate transaction flow logic.

Abstract translation: 本发明可以使用动态检测和库重写的组合捕获API级别调用。 本发明允许API函数调用和返回的事件级别跟踪，并且能够生成执行跟踪。 该仪器是轻量级的，并且依赖于大多数操作系统中的动态库/共享库链接机制。 因此，我们不需要源代码修改或二进制注入。 该工具可用于捕获参数值和返回值，可用于将API函数调用之间的跟踪相关联，以生成事务流逻辑。

公开(公告)号：WO2015057617A1

公开(公告)日：2015-04-23

申请号：PCT/US2014/060358

申请日：2014-10-14

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： RHEE, Junqhwan ,  ZHANG, Hui ,  ARORA, Nipun ,  JIANG, Guofei ,  KIM, Chung Hwan

IPC: G06F11/36

CPC classification number: G06F11/3636 ,  G06F11/3419

Abstract: Methods and systems for performance inference include inferring an internal application status based on a unified call stack trace that includes both user and kernel information by inferring user function instances. A calling context encoding is generated that includes information regarding function calling paths. The analysis includes performing a top-down latency breakdown and ranking calling contexts according to how costly each function calling path is.

Abstract translation: 用于性能推理的方法和系统包括通过推断用户功能实例来推断基于包括用户和内核信息的统一调用堆栈跟踪的内部应用程序状态。 生成包含有关函数调用路径的信息的调用上下文编码。 分析包括根据每个功能调用路径的代价昂贵地执行自上而下的延迟故障和排序呼叫上下文。

公开(公告)号：WO2015148429A1

公开(公告)日：2015-10-01

申请号：PCT/US2015/022115

申请日：2015-03-24

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： ZHANG, Hui ,  LUMEZANU, Cristian ,  RHEE, Junghwan ,  ARORA, Nipun ,  XU, Qiang ,  JIANG, Guofei

IPC: H04L12/26 ,  H04L12/937

CPC classification number: H04L45/02 ,  H04L43/12 ,  H04L45/64 ,  H04L45/70

Abstract: A computer implemented method for network monitoring includes providing network packet event characterization and analysis for network monitoring that includes supporting summarization and characterization of network packet traces collected across multiple processing elements of different types in a virtual network, including a trace slicing to organize individual packet events into path-based trace slices, a trace characterization to extract at least 2 types of feature matrix describing those trace slices, and a trace analysis to cluster, rank and query packet traces based on metrics of the feature matrix.

Abstract translation: 一种用于网络监测的计算机实现方法包括为网络监测提供网络分组事件表征和分析，其包括支持在虚拟网络中跨越不同类型的多个处理元件收集的网络分组跟踪的概括和表征，包括用于组织各个分组事件的跟踪分片 基于路径的跟踪切片，提取描述这些跟踪切片的至少2种类型的特征矩阵的跟踪表征，以及基于特征矩阵的度量的集群，排序和查询分组跟踪的跟踪分析。

公开(公告)号：WO2015095630A1

公开(公告)日：2015-06-25

申请号：PCT/US2014/071340

申请日：2014-12-19

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： ZHANG, Hui ,  RHEE, Junghwan ,  ARORA, Nipun ,  LUMEZANU, Cristian ,  JIANG, Guofei

IPC: H04L12/26

CPC classification number: H04L41/0631 ,  H04L41/069 ,  H04L41/14 ,  H04L43/0858

Abstract: A computer implemented method for network monitoring includes providing network packet event characterization and analysis for network monitoring that includes supporting summarization and characterization of network packet traces collected across multiple processing elements of different types in a virtual network, including a trace slicing to organize individual packet events into path-based trace slices, a trace characterization to extract at least 2 types of feature matrix describing those trace slices, and a trace analysis to cluster, rank and query packet traces based on metrics of the feature matrix.

Abstract translation: 一种用于网络监测的计算机实现方法包括为网络监测提供网络分组事件表征和分析，其包括支持在虚拟网络中跨越不同类型的多个处理元件收集的网络分组跟踪的概括和表征，包括用于组织各个分组事件的跟踪分片 基于路径的跟踪切片，提取描述这些跟踪切片的至少2种类型的特征矩阵的跟踪表征，以及基于特征矩阵的度量的集群，排序和查询分组跟踪的跟踪分析。

公开(公告)号：WO2015095277A1

公开(公告)日：2015-06-25

申请号：PCT/US2014/070749

申请日：2014-12-17

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： ZHANG, Hui ,  ARZANI, Behnaz ,  IVANCIC, Franjo ,  RHEE, Junghwan ,  ARORA, Nipun ,  JIANG, Guofei

IPC: H04L12/701 ,  H04L12/841

CPC classification number: H04L45/42 ,  H04L41/12 ,  H04L41/145 ,  H04L43/0864 ,  H04L43/106 ,  H04L45/00 ,  H04L45/64 ,  H04L47/283

Abstract: Methods and systems for finding a packet's routing path in a network includes intercepting control messages sent by a controller to one or more switches in a software defined network (SDN). A state of the SDN at a requested time is emulated and one or more possible routing paths through the emulated SDN is identified by replaying the intercepted control messages to one or more emulated switches in the emulated SDN. The one or more possible routing paths correspond to a requested packet injected into the SDN at the requested time.

Abstract translation: 用于在网络中找到分组的路由路径的方法和系统包括将由控制器发送的控制消息拦截在软件定义网络（SDN）中的一个或多个交换机上。 仿真在请求时间的SDN的状态，并且通过在被仿真的SDN中重放截取的控制消息给一个或多个仿真开关来识别通过仿真SDN的一个或多个可能的路由路径。 一个或多个可能的路由路径对应于在请求的时间内注入到SDN中的请求的分组。

公开(公告)号：WO2018111355A1

公开(公告)日：2018-06-21

申请号：PCT/US2017/047285

申请日：2017-08-17

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： DEBNATH, Biplob ,  ZHANG, Hui ,  ARORA, Nipun ,  XU, Jianwu ,  JIANG, Guofei ,  ZONG, Bo

IPC: G05B23/02

Abstract: A computer-implemented method executed on a processor (214) for automatically analyzing log contents received via a network (803) and detecting content-level anomalies is presented. The computer-implemented method includes building a statistical model (103) based on contents of a set of training logs and detecting, based on the set of training logs, content-level anomalies (106) for a set of testing logs. The method further includes maintaining an index and metadata, generating attributes for fields, editing model capability to incorporate user domain knowledge, detecting anomalies using field attributes, and improving anomaly quality by using user feedback (107).

公开(公告)号：WO2017087591A1

公开(公告)日：2017-05-26

申请号：PCT/US2016/062397

申请日：2016-11-17

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： XU, Jianwu ,  ZHANG, Hui ,  ARORA, Nipun ,  DEBNATH, Biplob ,  JIANG, Guofei

IPC: G06F11/34

CPC classification number: G06F11/3612 ,  G06F11/0706 ,  G06F11/0766 ,  G06F11/3636

Abstract: Systems and methods are disclosed for handling log data from one or more applications, sensors or instruments by receiving heterogeneous logs from arbitrary/unknown systems or applications; generating regular expression patterns from the heterogeneous log sources using machine learning and extracting a log pattern therefrom; generating models and profiles from training logs based on different conditions and updating a global model database storing all models generated over time; tokenizing raw log messages from one or more applications, sensors or instruments running a production system; transforming incoming tokenized streams are into data-objects for anomaly detection and forwarding of log messages to various anomaly detectors; and generating an anomaly alert from the one or more applications, sensors or instruments running a production system.

Abstract translation: 公开了用于通过从任意/未知系统或应用接收异构日志来处理来自一个或多个应用，传感器或仪器的日志数据的系统和方法; 使用机器学习从异构日志源生成正则表达式模式并从中提取日志模式; 根据不同的条件从训练日志生成模型和配置文件，并更新存储随时间生成的所有模型的全局模型数据库; 标记来自运行生产系统的一个或多个应用程序，传感器或仪器的原始日志消息; 将输入的标记化流转换成用于异常检测和将日志消息转发到各种异常检测器的数据对象; 并从运行生产系统的一个或多个应用程序，传感器或仪器生成异常警报。

公开(公告)号：WO2017083006A1

公开(公告)日：2017-05-18

申请号：PCT/US2016/051872

申请日：2016-09-15

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： ZHANG, Hui ,  JIANG, Guofei ,  RHEE, Junghwan ,  ARORA, Nipun

IPC: G06F9/54

CPC classification number: G06F9/542 ,  G06F9/44505 ,  G06F11/3404 ,  G06F11/3466

Abstract: Methods and systems for profiling requests include generating request units (202) based on collected kernel events that include complete request units and half-open request units. The generated request units are sequenced (204) based on a causality relationship set that describes causality relationships between kernel events.

Abstract translation: 用于分析请求的方法和系统包括基于收集的内核事件生成请求单元（202），所述内核事件包括完整请求单元和半开放请求单元。 基于描述内核事件之间的因果关系的因果关系集对所生成的请求单元排序（204）。