Microsoft Technology Licensing, LLC

Abhishek Kumar Singh

Saad Syed

Ajay Mani

Avnish Kumar Chhabra

Muhammad Usman Sharif

Sushant Pramod Rewaskar

Gaurav Jagtiani

Wei Zhao

Thiruvengadam Venketesan

Akram Hassan

Yue Zhao

Huaming Huang

Junaid Ahmed

Walter Sun

Tanmay Arun Ganacharya

Srikanth Raghavan

Scott Lambert

Douglas Christopher Burger

Albert Gordon Greenberg

Ming Zhang

Burton Jordan Smith

Lin Guo

Kumar Hemachandra Chellapilla

David A Maltz

David B Wecker

David Bradley Probert, Jr

Parantap Lahiri

Srinivas Krishnan

Li Xiong

Yinzhe Yu

Jay Goyal

Cristina Del Amo Casado

Jingfeng Li

Vinay Deshpande

Binit Ranjan Mishra

Fabrice Canel

Thomas Francis McElroy

Li-Fen Wu

Vishnu Challam

Siddharth Verma

Nikola J Livic

Freddie L Aaron

Peter A Loveless

Yevgeniy Olegovich Razuvayev

Ash Beitz

Thomas Arthur Ledbetter

Reza Sherafat Kazemzadeh

Arbab Amjad

Brahm Kiran Singh

Swapnil Bhalode

Aditya Joshi

Harsh Gupta

Hariharan Jayaraman

Tino Morenz

Systems, methods and computer program products are described herein that can be used to help achieve a safe rollout of software in a production datacenter environment. In accordance with certain embodiments, cloud services requests from certain users of a cloud services system (e.g., users that are authorized to receive cloud services via computing devices running test versions of infrastructure software) are dynamically matched to clusters (groups of commonly-managed computing devices called nodes) that are capable of providing the requested services on nodes running test versions of infrastructure software. Within such clusters, the requested services are provided to the users on a subset of cluster nodes that run a test version of an infrastructure software component, while the remaining cluster nodes are not running the particular test version.

Partitioning and orchestrating infrastructure software deployments for safety and agility across diverse configurations and hardware types

Methods, systems, apparatuses, and computer program products are provided that enable the automated deployment of microservices to a network-accessible server set. The automated deployment may be based on constraint(s) that are specified by a declarative deployment model that is associated with the microservice to be deployed. For example, a centralized deployment orchestrator may receive microservice(s) and their associated declarative deployment model(s). The deployment orchestrator analyzes the declarative deployment model(s) and determines which microservice(s) are to be deployed based on the constraint(s) specified by the declarative deployment model(s). The foregoing techniques advantageously determine when to deploy microservice(s), while also minimizing human intervention typically required to deploy microservice(s). Moreover, by controlling when certain microservice(s) are deployed and/or which microservice(s) are deployed, deployed microservice(s) that function incorrectly and/or cause at least a portion of the network-accessible computing environment to malfunction can be easily identified.

Automated constraint-based deployment of microservices to cloud-based server sets

Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Safe and agile rollouts in a network-accessible server infrastructure using slices

Methods for accelerated code injection detection using operating system controlled memory attributes are performed by systems and apparatuses. The methods optimize search operations for memory segments in system and virtual memories by searching for segment attributes. A set of memory segments is determined wherein each memory segment in the set includes specific attributes. The memory segments in the set are ranked for a threat level based on segment attribute. The threat level is used to determine subsequent actions including providing indications of the memory segments in the set and initiating execution of an anti-malware application. Relevant segment attributes used for the segment search can be dynamically updated in an attribute list. Segment attributes of a segment can be determined by accessing a memory manager of an operating system via an API.

Accelerated code injection detection using operating system controlled memory attributes

Embodiments described herein are directed to migrating affected services away from a faulted cloud node and to handling faults during an upgrade. In one scenario, a computer system determines that virtual machines running on a first cloud node are in a faulted state. The computer system determines which cloud resources on the first cloud node were allocated to the faulted virtual machine, allocates the determined cloud resources of the first cloud node to a second, different cloud node and re-instantiates the faulted virtual machine on the second, different cloud node using the allocated cloud resources.

Healing cloud services during upgrades

Embodiments are directed to implementing rate controls to limit faults detected by timeout and to learning and adjusting an optimal timeout value. In one scenario, a computer system identifies cloud components that have the potential to fail within a time frame that is specified by a timeout value. The computer system establishes a number of components that are allowed to fail during the time frame specified by the timeout value and further determines that the number of component failures within the time frame specified by the timeout value has exceeded the established number of components that are allowed to fail. In response, the computer system increases the timeout value by a specified amount of time to ensure that fewer than or equal to the established number of components fail within the time frame specified by the timeout value.

Implementing rate controls to limit timeout-based faults

Methods, systems, and computer-storage media for improving the freshness, or the apparent freshness, of search results are described. In an embodiment, the first portion of search results presented on a search results page are based on responsiveness to the search query and a second portion of results describe only recently published documents that are responsive to the search query. In an embodiment, a more recent version of the document, which is not directly used to determine responsiveness, is used to build the caption for a search result. Another way to make search results appear fresh is to include a publication time within the search result caption. In one embodiment, the publication time is generated by calculating a point in time between when a document is first added to a search index and the previous time the search engine visited the site where the document was found.

Enhancing freshness of search results

A source device obtains a data packet that includes both a destination address and a payload. The source device selects an exit point address of multiple exit point addresses corresponding to the destination address based on one or more policies. The source device encapsulates the data packet with a header that includes the selected exit point address, and the encapsulated data packet is provided to the backbone network. The encapsulated data packet is routed through the backbone network based on the exit point address, and an edge router of the backbone network identifies an interface of the edge router that corresponds to the exit point address. The header is removed from the encapsulated data packet, and the data packet is added to a buffer of the interface for routing to one or more other devices outside of the backbone network.

Backbone network with policy driven routing

A client application installed on end user computers generates metadata from the content of web pages visited by end users and provides the metadata to a search engine. When an end user visits a web page, the end user's computer downloads and displays the web page to the end user. The client application may simultaneously access the web page content and generate this metadata in the form of a content signature of the web page from the web page content. The client application then provides the content signature to a search engine. The search engine may employ content signatures to identify new web pages to crawl and index. Additionally, the search engine may employ content signatures to identify changes to web pages and determine the crawl frequency of web pages.

Content signature notification

Embodiments are directed to establishing a model for testing cloud components and to preventing cascading failures in cloud components. In one scenario, a computer system models identified cloud components (including cloud hardware components and/or cloud software components) as health entities. Each health entity is configured to provide state information about the cloud component. The computer system establishes declarative safety conditions which declaratively describe cloud computing conditions that are to be maintained at the identified cloud components. The computer system then tests against the declarative safety conditions to determine which cloud components are or are becoming problematic. Upon determining that an error has occurred, the computer system notifies users of the error and the component at which the error occurred. Guarded interfaces are established to ensure that actions taken to fix the error do not cause further failures.

Cloud management using a component health model

Methods, systems, and computer-readable media are disclosed for packet sanitization. A particular method intercepts a packet of a packet stream, where the packet stream is transmitted in accordance with a particular protocol. The packet is analyzed based on a specification associated with the particular protocol. Based on the analysis, a data value of a field of the packet is replaced with a sanitized data value to create a sanitized packet. The sanitized packet may be injected into the packet stream or may optionally be forwarded to a signature module that checks the sanitized packet for malicious content. When malicious content is found, the sanitized packet may be dropped, the sanitized packet may be logged, the sanitized packet may be redirected, or a notification regarding the sanitized packet may be sent to an administrator.

Sanitization of packets

A human-readable list of patch differences ranked by weight helps vulnerability analysts allocate their time. From binary code, identified source functions and recognized sink functions are used when assigning relative weights to changes caused by a patch. Source functions are identified using an export table, import table, and remote procedure call interface. Sink functions are recognized using blacklisted functions, patch-targeted functions, memory functions, string functions, and functions called with mismatched parameters. A change prioritizer assigns weights based on an architectural graph and a set of prioritization rules that specify what kind of change is made by a patch, and what kind of function is changed. Weight assignments may be additive. Rules may assign certain kinds of change a higher priority for subsequent scrutiny by an analyst.

Binary code change vulnerability prioritization

Growing community of inventors

Bellevue, WA, United States of America

Abhishek Kumar Singh