Oracle International Corporation

Pmc-sierra Us, Inc.

Craig Schelp

Felix Schmidt

Nipun Agarwal

Stuart Wray

Andrew Brownsword

Onur Kocberber

Pravin Shinde

Manel Fernandez Gomez

Guang-Tong Zhou

Juan Fernandez Peinador

Rod Reddekopp

Hossein Hajimirsadeghi

Akhilesh Singhania

Morten Zilmer

Kenny C Gross

Kalyanaraman Vaidyanathan

Arun Raghavan

Matteo Casserini

Tayler Hetherington

Navaneeth P Jamadagni

Jonathan David Loewen

Renata Khasanova

Pavan Chandrashekar

Paria Rashidinejad

Charles Gordon

Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.

Machine learning-based DNS request string representation with hash replacement

Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.

Malicious activity detection by cross-trace analysis and deep learning

Techniques are described herein for estimating CPU, memory, and I/O utilization for a workload via out-of-band sensor readings using a machine learning model. The framework involves receiving sensor data associated with executing benchmark applications, obtaining ground truth utilization values for the benchmarks, preprocessing the training data to select a set of enhanced sequences, and using the enhanced sequences to train a random forest model to estimate CPU, memory, and I/O utilization given sensor monitoring data. Prior to the training phase, a machine learning model is trained using a set of predefined hyper-parameters. The trained models are used to generate estimations for CPU, memory, and I/O utilizations values. The utilization values are used with workload context information to assess the deployment and generate one or more recommendations for machine types that will best serve the workload in terms of system utilization.

Out of band server utilization estimation and server workload characterization for datacenter resource optimization and forecasting

Techniques are described herein for accurately measuring the reliability of storage systems. Rather than relying on a series of approximations, which may produce highly optimistic estimates, the techniques described herein use a failure distribution derived from a disk failure data set to derive reliability metrics such as mean time to data loss (MTTDL) and annual durability. A new framework for modeling storage system dynamics is described herein. The framework facilitates theoretical analysis of the reliability. The model described herein captures the complex structure of storage systems considering their configuration, dynamics, and operation. Given this model, a simulation-free analytical solution to the commonly used reliability metrics is derived. The model may also be used to analyze the long-term reliability behavior of storage systems.

Techniques for accurately estimating the reliability of storage systems

Embodiments monitor statistics from groups of devices and generate an alarm upon detecting a utilization imbalance that is beyond a threshold. Particular balance statistics are periodically sampled, over a timeframe, for a group of devices configured to have balanced utilization. The devices are ranked at every data collection timestamp based on the gathered device statistics. The numbers of times each device appears within each rank over the timeframe are tallied. The device/rank summations are collectively used as a probability distribution representing the probability of each device being ranked at each of the rankings in the future. Based on this probability distribution, an entropy value that represents a summary of the imbalance of the group of devices over the timeframe is derived. An imbalance alert is generated when one or more entropy values for a group of devices shows an imbalanced utilization of the devices going beyond an identified imbalance threshold.

Detecting device utilization imbalances

Embodiments use Bayesian techniques to efficiently estimate the bit error rates (BERs) of cables in a computer network at a customizable level of confidence. Specifically, a plurality of probability records are maintained for a given cable in a computer system, where each probability record is associated with a hypothetical BER for the cable, and reflects a probability that the cable has the associated hypothetical BER. At configurable time intervals, the probability records are updated using statistics gathered from a switch port connected to the cable. In order to estimate the BER of the cable at a given confidence level, embodiments determine which probability record is associated with a probability mass that indicates the confidence level. The estimate for the cable BER is the hypothetical BER that is associated with the indicated probability mass. Embodiments store the estimate in memory and utilize the estimate to aid in maintaining the computer system.

Estimate bit error rates of network cables

Herein are computerized techniques for autonomous and artificially intelligent administration of a computer cloud health monitoring system. In an embodiment, an orchestration computer automatically detects a current state of network elements of a computer network by processing: a) a network plan that defines a topology of the computer network, and b) performance statistics of the network elements. The network elements include computers that each hosts virtual execution environment(s). Each virtual execution environment hosts analysis logic that transforms raw performance data of a network element into a portion of the performance statistics. For each computer, a configuration specification for each virtual execution environment of the computer is automatically generated based on the network plan and the current state of the computer network. At least one virtual execution environment is automatically tuned and/or re-provisioned based on a generated configuration specification.

Application- and infrastructure-aware orchestration for cloud monitoring applications

Herein are computerized techniques for generation, costing/scoring, optimal selection, and reporting of intermediate configurations for a datacenter change plan. In an embodiment, a computer receives a current configuration of a datacenter and a target configuration. New configurations are generated based on the current configuration. A cost function is applied to calculate a cost of each new configuration based on measuring a logical difference between the new configuration and the target configuration. A particular new configuration is selected that has a least cost. When the particular configuration satisfies the target configuration, the datacenter is reconfigured based on the particular configuration. Otherwise, this process is (e.g. iteratively) repeated with the particular configuration instead used as the current configuration. In embodiments, new configurations are randomly, greedily, and/or manually generated. In an embodiment, new configurations obey design invariants that constrain which changes and/or configurations are attainable.

Automated mechanisms for ensuring correctness of evolving datacenter configurations

The disclosed embodiments relate to a technique for training a prognostic pattern-recognition system to detect incipient anomalies that arise during execution of a computer system. During operation, the system gathers and stores telemetry data obtained from n sensors in the computer system during operation of the computer system. Next, the system uses the telemetry data gathered from the n sensors to train a baseline model for the prognostic pattern-recognition system. The prognostic pattern-recognition system then uses the baseline model in a surveillance mode to detect incipient anomalies that arise during execution of the computer system. The system also uses the stored telemetry data to train a set of additional models, wherein each additional model is trained to operate with one or more missing sensors. Finally, the system stores the additional models to be used in place of the baseline model when one or more sensors fail in the computer system.

Robust training technique to facilitate prognostic pattern recognition for enterprise computer systems

Herein are techniques for analysis of data streams. In an embodiment, a computer associates each software actor with data streams. Each software actor has its own backlog queue of data to analyze. In response to receiving some stream content and based on the received stream content, data is distributed to some software actors. In response to determining that the data satisfies completeness criteria of a particular software actor, an indication of the data is appended onto the backlog queue of the particular software actor. The particular software actor is reset to an initial state by loading an execution snapshot of a previous initial execution of an embedded virtual machine. Based on the particular software actor, execution of the execution snapshot of the previous initial execution is resumed to dequeue and process the indication of the data from the backlog queue of the particular software actor to generate a result.

Engine for reactive execution of massively concurrent heterogeneous accelerated scripted streaming analyses

A high efficiency search table is implemented with a multiple hash algorithm. The search table allows for exact match searching of arbitrary data sets with fixed latency. The probability of collisions from the hash algorithms is reduced through the use of oversized pointer tables allowing for a level of indirection between hash values and table entries. In the event of a collision in all hash functions, a firmware assisted cuckoo algorithm is employed to resolve the collision.

Search table for data networking matching

In a Ternary Content Addressable Memory (TCAM) optimized for network packet classification, network operation rules are preprocessed into sub-lists in accordance with a decision tree based packet classification algorithm. The decision tree is encoded as a lookup memory, which is accessed with a predetermined base address of higher order address bits combined with lower order address bits obtained from specific bit positions from a received network packet. Depending on the nodes traversed in the decision tree, different base addresses and values from different bit positions of the packet are used until a sub-list of potential rules is identified. A bitwise comparison of values of each rule against the packet is then executed, the matching rule with the highest precedence is returned as the matching table entry and the configured value associated with the entry is prepended to the packet.

Growing community of inventors

Surrey, Canada

Craig Schelp