Microsoft Technology Licensing, LLC

Paul Barham

Richard John Black

Rebecca Isaacs

Peter Bernard Key

Richard Mortier

Ulfar Erlingsson

Edward Pearce Wobber

Moises Goldszmidt

Thomas Michael Roeder

John Philip MacCormick

Koenraad Laevens

Neil Stratford

Derek McAuley

Marcus Peinado

Manuel Costa

Austin N Donnelly

Efstathios Papaefstathiou

Miguel Castro

Jonathan C Hardwick

Jean-Philippe Martin

Quanzhan Zheng

Periklis Akritidis

Glenn F LaVigne

Hosts or end-systems residing at the edges of a network gather data about the traffic they transmit into and receive from the network. The network's routing protocol (typically a link-state protocol such as OSPF) is monitored and routing data or packets are used to recover the network's current status and topology. This data can be collected, fused, and maintained and a platform, preferably distributed, can be provided to query the data, thus enabling a variety of network management applications.

Distributed network management

Software fault isolation methods using byte-granularity memory protection are described. In an embodiment, untrusted drivers or other extensions to a software system are run in a separate domain from the host portion of the software system, but share the same address space as the host portion. Calls between domains are mediated using an interposition library and access control data is maintained for substantially each byte of relevant virtual address space. Instrumentation added to the untrusted extension at compile-time, before load-time, or at runtime and added by the interposition library enforces the isolation between domains, for example by adding access right checks before any writes or indirect calls and by redirecting function calls to call wrappers in the interposition library. The instrumentation also updates the access control data to grant and revoke access rights on a fine granularity according to the semantics of the operation being invoked.

Software fault isolation using byte-granularity memory protection

Extensions to operating systems or software applications can be hosted in virtual environments to fault isolate the extension. A generic proxy extension invoked by a host process can coordinate the invocation of an appropriate extension in a virtual process that can provide the same support APIs as the host process. Furthermore, a user mode context can be provided to the extension in the virtual process through memory copying or page table modifications. In addition, the virtual process, especially a virtual operating system process running on a virtual machine, can be efficiently started by cloning a coherent state. A coherent state can be created when a virtual machine starts up, or when the computing device starts up and the appropriate parameters are observed and saved. Alternatively, the operating system can create a coherent state by believing there is an additional CPU during the boot process.

VEX&#x2014;virtual extension framework

An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing data in the computer. The collected data is analyzed to form a graph that describes and predicts what output is generated in response to received input. Later, a window of input and output data is collected from the computer. This collected window of data is used to query the activity model. The graph in the activity model is then used to give the probability that the collected window of data was collected from the computer used to generate the activity model. A high probability indicates that the computer is performing normally, while a low probability indicates that the computer may behaving erratically and there may be a problem with the computer.

Dynamic activity model of network services

An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing channels for packets for a predetermined window of time. To generate an activity model, an input and an output channel are selected. A probability distribution function describing the observed waiting time between packet arrivals on the selected input channel and the selected output channel is generated by mining the data collected during the selected window of time. A probability distribution function describing the observed waiting time between a randomly chosen instant and receiving a packet on the selected input channel is also generated. The distance between the two generated probability distribution functions is computed. If the computed distance is greater than a predefined confidence level, then the two selected channels are deemed to be related. Otherwise, the selected channels are deemed to be unrelated. The activity model is further generated by comparing each input and output channel pair entering or leaving a particular computer.

Automatic discovery of service/host dependencies in computer networks

A computing system for determining performance factors for using in performance modeling of a deployed subject system, is presented. The computing system includes a plurality of software components comprising the subject system. Each of the components is susceptible to event tracing while executing on the computing system. The computing system includes a tracing component. The tracing component is configured to trace events of the components of the subject system as they execute. The computing system includes a transaction identification table. The transaction identification table comprises starting and ending actions for transactions performed by the subject system. The computing system also includes a transaction identification component that identifies actions from traced events, identifies related actions corresponding to a transaction according to the starting and ending actions in the transaction identification table, and stores the related actions in the transaction workflow data store.

Generating static performance modeling factors in a deployed system

Network congestion avoidance within aggregated channels is disclosed. In one embodiment, a method first transmits a packet associated with a first channel of a plurality of related channels from a source protocol layer (e.g., a source IP layer) of a source through a network (e.g., the Internet). Next, the method triggers an ECN event by the packet at the network. Finally, at least one channel is determined to have decreased packets transmitted therethrough, in response to the triggering of the ECN event (e.g., based on a congestion pricing criteria).

Congestion avoidance within aggregate channels

Extensions to operating systems or software applications can be hosted in virtual environments to fault isolate the extension. The virtual environment in which extensions designed to control hardware devices can safely execute can be efficiently created during an initial startup sequence of a host environment by indicating to the host environment that a second processing unit is present in the computing system allowing the host environment to create a coherent state. A virtual process, especially a virtual operating system process running on a virtual machine, can be efficiently started by the created coherent state. A coherent state can be created when an operating system starts up and the appropriate parameters are observed and saved. Alternatively, an operating system of the host environment can create the coherent state by receiving indication of the second processing unit during the boot process.

VEX-virtual extension framework

Systems and methods for switch prefetch in multicore computer chips can allow a programmer to tailor operations of a computer program to available data. Control-flow decisions can be made by the program based on the availability of data in a cache. For example, a new instruction in a processor instruction set can receive a list comprising pairs of data addresses and code addresses. The processor can look for data items corresponding to the listed data addresses, and find the first available data item in the cache. When a cached data item is found, control is transferred to the code address supplied in the table. If no data is in the cache, then the processor can stall until the most quickly fetched data item is available.

Switch prefetch in a multicore computer chip

A method and system are presented for determining the loading and capacity on a variable capacity channel by measuring the times at which packets are enqueued for transmission, and have their transmission completed, or by measuring these times in addition to the arrival times of the packets. The times may be measured using a device driver or other operating system component. The measurement may be performed in a centralized or distributed fashion for multi-access or point to point channels.

Method and system for measuring load and capacity on a variable capacity channel

A method and system for avoiding network congestion by measuring network load to adjust a rate at each source. The load (e.g., as a price value) is provided to network traffic sources, which adjust their flows based on a per-flow weight (willingness to pay). The load may be determined in-band by routers or out-of-band by an observer node. A load value (e.g., as a price) is increased or decreased based on the actual load or an estimate based on the actual load. The sources obtain the load value and control the output rates per flow based on each flow's associated weight (willingness to pay), e.g., as set by an administrator. Further, two classes of applications are enabled by allowing certain applications to ignore price.

Growing community of inventors

Cambridge, United Kingdom

Paul Barham