Future Wei Technologies, Inc.

Fireeye, Inc.

Wei Xu

Yan Sun

Jun Li

Zhi Peng Liu

Zhe Fu

Xiaofeng Yang

Kun Tan

Phung-Te Ha

Xuefeng Han

Danyang Li

Xiaohe Hu

Yizhen Liu

Embodiments provide methods and apparatuses of allocating resources in a network of computing service nodes to applications. Based on a first service level agreement (SLA) for a first application, a number of physical central processing unit cores and respective quantities of additional physical resources needed are determined to satisfy the first SLA; one or more of the service nodes are selected that collectively have available the number of physical CPU cores and the respective quantities of the one or more additional physical resources wherein the one or more additional physical resources comprise a last level cache (LLC); a first virtual machine on one of the selected service nodes is allocated for the first application; the number of physical CPU cores and the respective quantities of the one or more additional physical resources on the selected service nodes are reserved for use by the first virtual machine.

Method and system for provisioning resources in cloud computing

A network state is verified in real-time by precomputing a data structure representing header spaces of data packets in respective equivalence classes (ECs) in a first snapshot of the network and in a second snapshot of the network at a later time. The data structure includes respective bitmaps indicating for each data packet forwarding rule for each node in the network a forwarding action to be taken for each EC in the network. The respective bitmaps store bits indicating for each data packet forwarding rule whether the data packet forwarding rule applies to the respective ECs in the network. The snapshots are compared to identify network paths that have changed between a time of the first snapshot and the second snapshot of the network and network verification operations are performed on the changed network paths as a logical function of a bitmap corresponding to each changed network path.

Network verification system

A service level agreement (SLA) system is provided for multi-tenant cloud computing to enable provisioning of computing instances for tenants with a networking SLA. A networking SLA may specify a bandwidth requirement, for example, between instances to be scheduled for a tenant in a datacenter. The SLA system evaluates nodes in the datacenter based on a remaining capacity of links associated with nodes implementing the networking SLA. A modular system is provided to enable integration of the SLA system into existing cloud computing infrastructures. The cloud management system may query the SLA system to determine nodes in the datacenter capable of meeting a networking SLA. The list may be ordered to indicate nodes having better capacity to fulfill the networking SLA. The cloud management system can utilize the ordered list of nodes in scheduling instance deployments for tenant requests.

Networking service level agreements for computer datacenters

An apparatus, such as a network element, comprises a receiver to receive a plurality of packets. A memory stores instructions and forms a first and second set of virtual queues to store the plurality of packets. A processor having one or more cores with one or more packet classifiers provides a classification of a packet in the plurality of packets. The processor in communication with the memory executes instructions to transfer the packet from the receiver to a virtual queue in the first set of virtual queues based on the classification. The processor also transfers the packet from the virtual queue to a transmitter based on a demand rate value and supply rate value associated with the virtual queue.

Multi-core lock-free rate limiting apparatus and method

A method comprising receiving, by a network element, a data packet, searching, by the network element, the received data packet at a first hierarchical level to determine whether a substring of a string of a regular expression exists in the received data packet, searching, by the network element when the search of the received data packet at the first hierarchical level finds a match, the received data packet at a second hierarchical level to determine whether the string of the regular expression exists in the received data packet, and transmitting, by the network element, the received data packet to a next network element along an original path of the received data packet without searching the received data packet at a third hierarchical level when the search of the received data packet at the first or second hierarchical level does not find a match.

Hierarchical pattern matching for deep packet analysis

A computer-implemented method classifies a packet received from a network. The method comprises receiving the packet having header information and a rule-set that indicates a plurality of actions to perform on the packet. A geometric representation of the rule-set is constructed having a plurality of dimensions and rule boundaries. At least one rule boundary and dimension of the geometric representation is split to form a search structure having a plurality of nodes. Each node in the plurality of nodes is constrained to a predetermined memory threshold. The search structure is searched using the header information to obtain a rule in the rule-set that indicates an action to take on the packet.

Packet classification using multi-dimensional splitting

According to one embodiment of the invention, a computerized method is described for improved efficiency in malware detection. The method comprises detecting a system call initiated by a virtual machine and determining a class assigned to the detected system call. In response to determining that the system call is associated with a first class of system calls, providing information associated with the system call to virtualized device hardware. In contrast, in response to determining that the system call is associated with a second class of system calls, which is different from the first class of system calls, the virtual machine resumes virtual processing of an object without providing information to the virtualized device hardware.

Growing community of inventors

Dublin, CA, United States of America

Wei Xu