Cisco Technology, Inc.

Microsoft Technology Licensing, LLC

University of California

Pmc-sierra, Inc.

George Varghese

Sumeet Singh

Jitendra Dattatraya Padhye

Flavio Giovanni Bonomi

Daniel Max Firestone

Stefan Roberts Savage

Khoa Anh To

Cristi Estan

Ramachandran Ramjee

Rong Pan

Sundar Iyer

John David Huber

John Andrew Fingerhut

Sushil Kumar Singh

Carlo Aldo Curino

Ashok Anand

Jonathan Chang

Ajit Shelat

Bhavish Aggarwal

Michael Ayres

Michael Semanko

Bashir Eghbali

Travis G Newhouse

Pushkar Chitnis

Deepali Joshi

Amit Phansalkar

Chitra Muthukrishnan

Ramana Kompella

Athula Balachandran

Ashish Vulimiri

Various technologies described herein pertain to controlling geo-scale analytics with bandwidth and regulatory constraints. An analytical query (e.g., a recurrent analytical query, a non-recurrent analytical query, etc.) to be executed over distributed data in data partitions stored in a plurality of data centers can be received. Moreover, a query execution plan for the analytical query can be generated, where the query execution plan includes tasks. Further, replication strategies for the data partitions can be determined. A replication strategy for a particular data partition can specify one or more data centers to which the particular data partition is to be replicated if the particular data partition is to be replicated. The tasks of the query execution plan for the analytical query can further be scheduled to the data centers based on the replication strategies for the data partitions. The analytical query can be part of a workload of analytical queries.

Geo-scale analytics with bandwidth and regulatory constraints

Micro-schedulers control bandwidth allocation for clients, each client subscribing to a respective predefined portion of bandwidth of an outgoing communication link. A macro-scheduler controls the micro-schedulers, by allocating the respective subscribed portion of bandwidth associated with each respective client that is active, by a predefined first deadline, with residual bandwidth that is unused by the respective clients being shared proportionately among respective active clients by a predefined second deadline, while minimizing coordination among micro-schedulers by the macro-scheduler periodically adjusting respective bandwidth allocations to each micro-scheduler.

Controlling fair bandwidth allocation efficiently

An end host redundancy elimination system and method to provide redundancy elimination as an end system service. Embodiments of the system and method use optimization techniques that reduce server central processing unit (CPU) load and memory footprint as compared to existing approaches. For server storage, embodiments of the system and method use a suite of highly-optimized data structures for managing metadata and cached payloads. An optimized asymmetric max-match technique exploits the inherent structure in data maintained at the server and client and ensures that client processing load is negligible. A load-adaptive fingerprinting technique is used that is much faster than current fingerprinting techniques while still delivering similar compression. Load-adaptive means that embodiments of the fingerprinting technique can adapt CPU usage depending on server load. Embodiments of the system and method operate above the transmission control protocol (TCP) layer, thereby reducing the number of roundtrips needed for data transfer.

Asymmetric end host redundancy elimination for networks

A method and system to detect an evasion attack are provided. The system may include a repository to store signature fragments that together constitute an attack signature, an interceptor to intercept a data packet associated with a network connection, a string-matching module to determine whether the payload of the data packet includes any of the stored signature fragments thereby identifying a match, a responder to perform a prevention action in response to the match, and a detector to detect that a size of the data packet is less than a size threshold. The system may further include a state machine to commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.

Methods and systems to detect an evasion attack

Network worms or viruses are a growing threat to the security of public and private networks and the individual computers that make up those networks. A content sifting method if provided that automatically generates a precise signature for a worm or virus that can then be used to significantly reduce the propagation of the worm elsewhere in the network or eradicate the worm altogether. The content sifting method is complemented by a value sampling method that increases the throughput of network traffic that can be monitored. Together, the methods track the number of times invariant strings appear in packets and the network address dispersion of those packets including variant strings. When an invariant string reaches a particular threshold of appearances and address dispersion, the string is reported as a signature for suspected worm.

Detecting public network attacks using signatures and fast content analysis

A method and apparatus is described to select a representative signature for use in identifying content in a packet stream. The method may comprise receiving the packet stream and obtaining content from a data payload of the packet. Thereafter, a plurality of signatures is identified from the content and a complexity score or a frequency score is determined based on the content. A signature of the plurality of signatures is then selected as the representative signature based on the complexity score or the frequency score.

Method and apparatus for content classification

Detecting attacks against computer systems by automatically detecting signatures based on predetermined characteristics of the intrusion. One aspect looks for commonalities among a number of different network messages, and establishes an intrusion signature based on those commonalities. Data reduction techniques, such as a hash function, are used to minimize the amount of resources which are necessary to establish the commonalities. In an embodiment, signatures are created based on the data reduction hash technique. Frequent signatures are found by reducing the signatures using that hash technique. Each of the frequent signatures is analyzed for content, and content which is spreading is flagged as being a possible attack. Additional checks can also be carried out to look for code within the signal, to look for spam, backdoors, or program code.

A method and apparatus for detecting malicious attacks is described. The method may comprise obtaining routing information from a packet communicated via a network and maintaining a count of packets associated with a device associated with the routing information. For example, the routing information may a source or destination IP address, a port number, or any other routing information. The device may be classified as a potentially malicious device when the count exceeds a threshold. The count may be incremented when the TCP SYN flag is set and the TCP ACK flag is not set. An embodiment comprises obtaining a source hash of the source IP address and a destination hash of the destination IP address. Thereafter, the source hash and the destination hash may be mapped to multi stage filters. The device associated with the packet may then be selectively categorizing as a suspicious device.

Detecting malicious attacks using network behavior and header analysis

Various improvements are provided for prior art policing methods, including token bucket methods and virtual time policing methods. Some preferred methods of the invention involve assigning a non-zero drop probability even when the packet would otherwise have been transmitted according to a prior art policing method. For example, a non-zero drop probability may be assigned even when there are sufficient tokens in a token bucket to allow transmission of the packet. A non-zero drop probability may be assigned, for example, when a token bucket level is at or below a predetermined threshold or according to a rate at which a token bucket is being emptied. Some implementations involve treating a token bucket as a virtual queue wherein the number of free elements in the virtual queue is proportional to the number of remaining tokens in the token bucket. Such implementations may involve predicting a future virtual queue size according to a previous virtual queue size and using this predicted value to calculate a drop probability.

Modification of policing methods to make them more TCP-friendly

A method and device to process a packet received by a network device is described. The method may comprise analyzing the packet to identify at least one set of a plurality of sets, mapping the at least one set to at least one functional unit, and performing functionality associated with the at least one functional unit. Analyzing the packet to identify at least one of a plurality of sets may comprise determining when the packet includes at least one set identifier, and identifying the at least one set based on the at least one set identifier. A set status identifier may be defined for each set, the set status identifier indicating when set identifiers associated with a corresponding set are detected in the packet. The device may be a router, switch or any other device that processes digital data e.g., packet data including packets headers, payload or the like.

System and method to process data packets in a network using stateful decision trees

A method and apparatus is described for identifying content in a packet. The method may obtain data sample from the packet where the data sample is in a predetermined window at an initial offset point in the packet. For each offset point, a first stage of processing on the data sample may be performed to identify if the data sample corresponds to potentially relevant reference string. A more focused second stage of processing may then be carried out on the data sample to identify if the data sample corresponds to potentially relevant reference string. Thereafter, an even more focused third stage of processing may be carried out on the data sample to obtain a third stage result. If the data sample passes all three stages of processing, a predefined action is identified which is associated with a reference string corresponding to the data sample.

Scalably detecting and blocking signatures at high speeds

A method and apparatus is described to process packets in a network. The method may comprise receiving the packet and determining a length K of the packet. If the length of the packet is less than a reference length M then no analysis may be performed on the packet. However, if the packet length K is not less than M, the method may determine if the packet length K is at least greater than a reference window size W. When the packet length is greater than Wthen a window size W for the processing of the packets is set equal to W; and the packet length is less than Wthen a window size W for the processing of the packets is set equal to the packet size K. Thereafter, the packet is processed using the window size W.

Method and apparatus to process packets in a network

A combined hash table/bucket trie technique facilitates fast, deterministic, memory-efficient exact match look-ups on extremely large tables. A limited number of hash keys which collide on the same location can be stored in the hash table. If further keys collide on the same location, a bucket trie is formed, the colliding keys are stored in the trie, and trie traversal information is stored in the hash table. Regardless of the number of buckets in the trie, an input key need only be compared with the keys in one bucket to detect a stored key identical to the input key or conclude that no stored key is identical to the input key.

Growing community of inventors

San Diego, CA, United States of America

George Varghese