Cisco Technology, Inc.

Oracle International Corporation

Chao Feng

Samar Sharma

Diheng Qu

Nitesh G Soni

Pramod Cherukumilli

Brian H Xu

Suresh Kumar Nalluru

Ronak K Desai

Ajit Sanzgiri

Devendra Mohan Badhani

Srikanth Narasimhan

Kalyan Venkataramana

Sanjay Sane

Murali Basavaiah

Ganesh Kirti

Venkataraman Natham

Raghavendra J Rao

Sriram Chidambaram

Walter Song

Christopher James Ries

Christopher Jon Bucci

Jon Wei

A method of detecting anomalous user behavior in a cloud environment includes calculating a first vector that is representative of actions taken during a plurality of previous time intervals; calculating a similarity between the first vector and a second vector that comprises counts of actions taken by the user during a current time interval; comparing the similarity to a baseline threshold to determine whether one or more anomalous actions have occurred; and generating an alert based at least in part on a determination that the one or more anomalous actions have occurred in the cloud environment.

Detecting behavior anomalies of cloud users

A method of detecting anomalous user behavior in a cloud environment includes receiving a vector that comprises counts of actions taken by the user during a current time interval; determining whether an action count in the vector is greater than a global mean; building a scale table by combining new action skills that are above a threshold and original action skills if below the threshold; and identifying outliers when the action count is greater than the global mean multiplied by a corresponding action scale from the scale table.

Detecting behavior anomalies of cloud users for outlier actions

A method of distinguishing between human and computer actions in a cloud environment includes receiving one or more actions from a monitored cloud environment; identifying a text string associated with the one or more actions; calculating an entropy value for the text string; determining whether the text string is bot-generated based at least in part on the entropy value; and determining whether to generate an alert based at least in part on a result of determining whether the text string is bot-generated.

Entropy-based classification of human and digital entities

Providing a template for orchestration of a cloud provided service in a datacenter. This template can include virtual processing services, virtual networking services, storage services, and service level requirements that a user or administrator can select for the cloud provided service. Based on the template the cloud provided service can be provisioned according to the requirements of the service level agreement.

Attaching service level agreements to application containers and enabling service assurance

Methods and apparatus for providing one-arm node clustering using a port channel are provided herein. An example application node may be communicatively connected to at least one application node, and the application node may be connected to a network through a port channel. The application node may include: a link included in the port channel for accommodating the network data being communicated between the remote client and server; and a processor configured to send/receive a cluster control packet to/from the at least one application node through the link included in the port channel.

Methods and apparatus for providing one-arm node clustering using a port channel

Methods and apparatuses for automating return traffic redirection to a service appliance by injecting forwarding policies in a packet-forwarding element are disclosed herein. An example method for automating return traffic redirection can include: establishing a communication channel between a service appliance and a packet-forwarding element; and transmitting an out-of-band message over the communication channel to the packet-forwarding element. The message can include a forwarding policy that requests the packet-forwarding element to forward predetermined packets to the service appliance.

Methods and apparatuses for automating return traffic redirection to a service appliance by injecting traffic interception/redirection rules into network nodes

Systems and methods for providing service virtualization endpoint (SVE) redundancy in a two-node, active-standby form. An active-standby pair of SVEs register with a cloud-centric-network control point (CCN-CP) as a single service node (SN) using a virtual IP address for both a control-plane and a data-plane. At any given time, only the active SVE is a host for the control-plane and the data-plane. When a failover happens, the hosting operation is taken over by the standby SVE, therefore the failover will be transparent to CCN-CP and the SN.

Method and apparatus for SVE redundancy

A method for monitoring flow attributes at a network node comprises detecting first information indicative of transmission of a packet through the network node. The first information is discernible from information contained within the packet. The method also comprises determining that the packet is not part of an existing flow and generating, in a flow cache memory, a new flow entry corresponding to the packet. The method further comprises receiving second information associated with the transmission of the packet through the network node. The second information is contained in a forwarding information base (FIB) stored in the network node and cannot be discerned from information contained within the packet. The method also comprises writing, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

Portable system for monitoring network flow attributes and associated methods

An example method is provided and includes configuring a service appliance to offload network control plane and network data plane operations to a switch; establishing a communication channel between the service appliance and the switch; and communicating control messages between the service appliance and the switch over the communication channel. In more particular embodiment, the method can include communicating data messages between the service appliance and the switch over the communication channel.

System and method for configuring service appliances as virtual line cards in a network environment

Methods and apparatus are provided for virtual device context (VDC) integration for network services. VDC integration for network services generally includes mapping a virtual switch, physical ports on the network switch assigned to the virtual switch, a service node and a physical port on a service node to share a common VDC associated with a configuration of the virtual switch. In this manner, the VDC concept is extended to the service node and the network may be easily managed, with a network switch and associated service nodes configured through a single processing system on the network switch or service node.

Virtual device context (VDC) integration for network services

An example method includes disengaging a target node from a cluster, where the disengaging comprises: selecting an inheritor; migrating flows from the target node to the inheritor; informing a migration manager that the target node is disengaged from the cluster; and broadcasting to peer nodes of the target node that the target node is replaced by the inheritor. In particular implementations of the present disclosure, the cluster can include a first layer of a network topology including a forwarding engine that implements hash-based packet forwarding; a second layer of the network topology comprising the target node and the inheritor, where the target node and the inheritor implement flow-based packet forwarding; and a third layer including service nodes configured for packet processing in a network.

Growing community of inventors

San Jose, CA, United States of America

Chao Feng