Techniques for service assurance using fingerprints associated with executing virtualized applications

Abstract

Examples include techniques for service assurance using fingerprints associated with execution of virtualized applications. Examples include receiving information of computing events collected when a virtual machine executes one or more applications for processing a workload of a virtual network function over a period of time. Service performance risk can be reported based on sample fingerprints generated using the collected computing events.

Description

Technical Field

[0001] Examples described herein generally relate to monitoring activities associated with one or more applications executed by a virtual machine. Background Art

[0002] A relatively new technology called network function virtualization (NFV) has been evolving rapidly in recent years. In some examples, NFV infrastructure is becoming increasingly important to large data centers or telecommunications providers to allow the aggregation of at least some computing resources that can be disaggregated and / or located in a variety of geographical locations. In an example virtualized environment of NFV infrastructure, a host computing system can host multiple virtual machines (VMs). The multiple VMs can individually execute one or more virtual network functions (VNFs) or applications associated with the one or more VNFs. A given VNF executed by one or more VMs can perform functions that could have been implemented using dedicated hardware devices before (e.g., firewalls, network address translation, etc.). In addition, virtualized network environments can also provide a variety of new applications and / or services to end users. For example, deployments in which a single computing application is packaged into dedicated virtual computing nodes (e.g., containers and VMs) are gaining widespread acceptance as Docker® and other similar virtualization technologies mature. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Figure 1 An example system is illustrated.

[0004] Figure 2 Illustrate a sample input / output scenario for monitoring a daemon.

[0005] Figure 3 An example block diagram illustrating a monitoring background process.

[0006] Figure 4 An example process is illustrated.

[0007] Figure 5 An example block diagram of a device is illustrated.

[0008] Figure 6 An example illustrating the logic flow.

[0009] Figure 7 Examples of storage media are illustrated.

[0010] Figure 8 An example block diagram of a computing platform is illustrated. DETAILED DESCRIPTION

[0011] In an example virtualized environment of an NFV infrastructure, a computing system may host multiple VMs. The multiple VMs may execute one or more VNFs individually. In some examples, a hypervisor or virtual machine manager (VMM) implemented by an operating system (OS) of a host computing platform may allocate computing resources to a VM, including but not limited to a central processing unit (CPU), CPU core, memory, storage device, or networking resources. An application executed by a VM in today's NFV-type infrastructure may fail, a hypervisor / VMM arranged to manage the VM may fail, and / or a CPU / core assigned to the VM may fail. Currently, human intervention may be required to resolve a failure by inferring the cause of the failure through external analysis of the behavior of the application at the networking or telemetry level.

[0012] A telecommunications usage model may have an NFV type infrastructure and have a requirement for 99.999% (5 9s) uptime. The 99.999% uptime requirement allows a VM to be down or inoperative for no more than 5.26 minutes in a whole year. Human intervention for resolving failures may not be feasible for only a few minutes of downtime per year. Therefore, an automatic solution may be required to meet the 99.999% uptime requirement. Current software solutions for automatic solutions may not be able to detect all cases of failures, and may also involve direct detection of software and service assurance middleware for detecting software failures, and additional allocation of computing resources for detecting hardware failures. For VNFs executed by VMs supported by physical computing resources (e.g., CPUs / cores), further complexity in attempts at automatic solutions may be added because these VNFs may not have visibility into failures in these supporting physical computing resources. With respect to these challenges, the examples described in this article are needed.

[0013] Figure 1 An example system 100 is illustrated. In some examples, system 100 includes multiple virtual machines (VMs), such as VMs 110-1 through 110-N, where “ N” Refers to any positive integer greater than 2. VMs 110-1 to 110-N may be managed or controlled by a VM manager (VMM) or hypervisor such as VMM 120. VMs 110-1 to 110-N may be supported by computing resources such as, but not limited to, CPU / cores 130-1, 130-2, 130-3, or 130-4 and memory 140.

[0014] In some examples, the computing resources including CPU / cores 130-1 to 130-4 and memory 140 may be physical elements that are part of a NFV infrastructure that is arranged to support virtual elements (such as VMs 110-1 to 110-N) that may individually execute one or more virtual network function (VNF) applications. For example, VMs 110-1, 110-2, and VMs 110-N may execute VNFapps 112-1, 112-2, and 112-N, respectively. According to some examples, VNF apps 112-1, 112-2, or 112-N may perform functions, tasks, or services that may include, but are not limited to, firewall services, domain name services (DNS), caching services, or network address translation (NAT) services.

[0015] According to some examples, VMs 110-1 to 110-N may include guest operating systems (OS) 116-1 to 116-N that facilitate execution of respective VNF apps 112-1 to 112-N by VMs 110-1 to 110-N, respectively. Guest OSs 116-1 to 116-N may be represented as an OS kernel plus system libraries and services in an example of hardware virtualization, or may be just system libraries and services in an example of application stack virtualization that may share the guest OS kernel (e.g., by a container). Also, VMs 110-1 to 110-N may include respective memory mapping agents 114-1 to 114-N that perform memory mapping that connects a host physical address (HPA) of a portion of memory 140 allocated to a given VM to a virtual or linear guest memory address (GPA) used by one or more VNF applications executed by the given VM. For example, while processing or handling a workload, the memory mapping agent 114-1 of the VM 110-1 may map the HPA at the memory 140 allocated to the VM 110-1 for executing the VNF app 112-1 to the GPA used by the VNF app 122-1. As further described below, the memory mapping may facilitate sample fingerprints associated with the behavior of one or more VNF applications being executed by the VM while processing the workload.

[0016] In some examples, monitoring daemon process 160 may be executed by a CPU / core of system 100 that is separate from CPU / cores 130-1 through 130-4 included in the computing resources provisioned or allocated to VMs 110-1 through 110-N. Although in some examples, monitoring daemon process 160 may be executed by the same CPU / core allocated to VMs 110-1 through 110-N. Also, monitoring daemon process 160 may be on the same or different computing platform as other elements of system 100, and as such, CPU / cores 130-N may also be located on the same or different computing platforms, respectively. Figure 1As shown in , a separate CPU / core for executing the monitoring background process 160 is shown as CPU / core 130-N. As described in more detail below, the monitoring background process 160 may include logic and / or features for receiving data and / or performance monitoring interrupts (PMIs) to determine sample fingerprints for target workloads processed by the VNF apps 110-1 to 110-N executed by the VMs 110-1 to 110-N. The logic and / or features of the monitoring background process 116 may then compare the sample fingerprints with corresponding fingerprint references associated with corresponding behavior models to determine deviations from normal and / or expected behavior.

[0017] According to some examples, such as Figure 1 As shown in , each of the CPU / cores 130-1 to 130-4 may have a portion of the memory 140 for storing the corresponding debug storage 142-1 to 142-4. For these examples, the CPU / core may be programmed to store microarchitectural or computational events in a dedicated portion of the memory 140 arranged to store the debug storage 142-1 to 142-4. When the VMs 110-1 to 110-N execute the corresponding VNF apps 112-1 to 112-N (when these VNF apps process the corresponding workloads), the computational events may be associated with the behavior exhibited by the CPU / cores 130-1 to 130-4 in supporting these VMs. The computational events may be marked or tracked via various event tracing techniques, including but not limited to precise event-based sampling (PEBS), processor tracing (PT), branch target storage (BTS), or embedded trace microunit (ETM). PEBS, PT, or BTS event tracing techniques may be associated with Intel®-based microprocessor architectures, and ETM may be associated with ARM®-based microprocessor architectures. However, the examples are not limited to only these types of microprocessor architectures and associated event tracing techniques. The example event tracing techniques mentioned above may track or monitor microarchitectural or computing events exhibited by a CPU / core, such as, but not limited to, instruction retirements, branch miss predictions, cache misses, translation lookaside buffer (TLB) misses, or other types of microarchitectural or computing events.

[0018] According to some examples, debug storage 142-1 to 142-4 may store microarchitectural or computing events in a CPU-specific format via corresponding data streams 133-1 to 133-4 from corresponding CPUs / cores 130-1 to 130-4. The CPU-specific format may contain a microarchitectural or computer event identifier (ID) and an address (typically an HPA of data of an executed instruction or operation) at which a specific microarchitectural or computer event occurred. The CPU-specific format may be depicted as an [event ID, address] tuple, where "event ID" represents the type of computing or microarchitectural event, and "address" represents the HPA associated with the computing or microarchitectural event. For example, the tuple [L1-miss, OxFA803911] stored by CPU / core 130-1 to debug storage 142-1 may identify a cache level 1 (L1) miss at HPA location OxFA803911 in a memory used as an L1 cache (not shown) by CPU / core 130-1.

[0019] In some examples, CPU / cores 130-1 to 130-4 may issue PMIs and route those PMIs to interrupt controller 150. For these examples, the PMIs may be routed via Figure 1 1 through 132-4 shown in the figure and routed to the interrupt controller 150. PMI may be routed from the CPU / cores 130-1 through 130-4 to the interrupt controller 150 based on exceeding a capacity threshold for storing data associated with computational or microarchitectural events stored to the respective debug storage 142-1 through 142-4. In some examples, the interrupt controller 150 may then forward the received PMI to the CPU 130-N that is executing the monitoring background process 160 via the PMI stream 152. Although the interrupt controller 150 is shown as a separate element of the system 100, in some examples, the interrupt controller 150 may be part of the internal logic of the CPU / cores 130-1 through 130-4 (e.g., located on the same die or chip) and may act as an application programmable interrupt controller (APIC) that is programmed to redirect PMI from the CPU / cores 130-1 through 130-4 to the CPU / core 130-N that is executing the monitoring background process 160. In Figure 1 1. Interrupt controller 150 is depicted as a separate element to simplify the process of redirecting PMIs generated by CPUs / cores 130-1 through 130-4 to CPU / core 130-N.

[0020] According to some examples, debug storage 142-1 to 142-4 may be configured to store PEBS buffers. For these examples, trace event data (e.g., cache misses) collected or collected by CPU / cores 130-1 to 130-4 via PEBS technology may be stored in debug storage 141-1 to 142-4 via corresponding data streams 133-1 to 133-4. A PEBS interrupt threshold may be set for each PEBS buffer stored in debug storage 142-1 to 142-4, and a PMI may be triggered if the PEBS interrupt threshold is met or exceeded. The PMI may be routed to interrupt controller 150 from a CPU / core having a PEBS buffer in its debug storage that meets or exceeds the PEBS interrupt threshold, and the PMI may then be forwarded to CPU / core 130-N. This routing of the PMI to the interrupt controller 150 for forwarding to the CPU / core 130-N executing the monitoring background process 160 enables other CPUs / cores of the system 100 to perform monitoring duties and relieves the CPU / core provisioned to support VM execution of VNF applications.

[0021] In some examples, the PEBS interrupt threshold can be a field stored in the PEBS index (not shown) that is used to specify the threshold value that triggers the PMI and notifies the monitoring background process 160 that the PEBS buffer is almost full. This field can be programmed (for example, by the monitoring background process 160) with the linear address of the first byte of the PEBS record stored in the PEBS buffer representing the threshold record. For these examples, a given CPU / core can cause the PEBS record to be written to the PEBS buffer and can then update the PEBS index. If the PEBS index reaches the threshold value of this field, the given CPU / core will generate a PMI and route this PMI to the interrupt controller 150. The interrupt controller 150 will then forward the PMI to the CPU / core 130-N executing the monitoring background process 160 to indicate that the PEBS buffer of the given CPU / core is almost full.

[0022] According to some examples, the monitoring background process 160 may subscribe to notifications from the VMM 120. These notifications may be routed via the data flow 103 and may include VM / CPU context data. For these examples, the VM / CPU context data may indicate what CPU / core has been assigned or allocated to support a given VM. The VM / CPU context data may be contained in a tuple containing [timestamp, VMID, CPU / core ID], which means that at a specific moment in time, the VM with identifier "VM ID" is supported by the CPU / core with identifier "CPU / core ID" to execute one or more VNF applications. Other types of VM / CPU context data may include, but are not limited to, what active processes are being executed by a given VM. For example, what type of workload is being processed by the one or more VNF applications.

[0023] In some examples, in response to PMI received from CPU / core 130-1 through 130-4, monitoring daemon 160 may read or request event trace data from debug storage 142-1, 142-2, 142-3, or 142-4 via data stream 107. For example, monitoring daemon 160 may read or request information from PEBS buffers stored in debug storage 142-1, 142-2, 142-3, or 142-4 in response to PMI forwarded from interrupt controller 150 (based on these PEBS buffers being nearly full as mentioned above).

[0024] According to some examples, memory mapping data or notifications may be routed from the memory mapping agent 114-1, 114-2, or 114-N to the monitoring daemon 160 to provide information about how the HPA of the memory 140 allocated to the corresponding VM 110-1 to 110-N is mapped to the virtual or linear GPA used by the corresponding VNF app 112-1 to 112-N to process the workload. Figure 1 As shown in , memory mapping data from the memory mapping agent 114-1 at the VM 110-1 may be routed to the monitoring daemon 160 via data flow 101 to indicate the GPA to HPA mapping for the VNF app 112-1 processing workload.

[0025] In some examples, CPU / cores 130-1 through 130-N and memory 140 may be hosted by one or more host computing platforms, which may include, but are not limited to, servers, server arrays or server farms, web servers, network servers, Internet servers, workstations, minicomputers, mainframe computers, supercomputers, network appliances, web appliances, distributed computing systems, multiprocessor systems, processor-based systems, or combinations thereof.

[0026] In some examples, CPU / cores 130-1 to 130N may individually or collectively represent various commercially available processors, including, but not limited to: AMD® Athlon®, Duron®, and Opteron® processors; ARM® application, embedded, and security processors; IBM® and Motorola® DragonBall® and PowerPC® processors; IBM and Sony® Cell processors; Intel® Atom®, Celeron®, Core (2) Duo®, Core i3, Core i5, Core i7, Itanium®, Pentium®, Xeon®, or Xeon Phi® processors; and similar processors.

[0027] According to some examples, memory 140 may be composed of one or more memory devices or dies that may include various types of volatile and / or non-volatile memory. The one or more memory devices or dies may include various types of volatile and / or non-volatile memory. Volatile memory may include, but is not limited to, random access memory (RAM), dynamic RAM (D-RAM), double data rate synchronous dynamic RAM (DDR SDRAM), static random access memory (SRAM), thyristor RAM (T-RAM), or zero capacitor RAM (Z-RAM). Non-volatile memory may include, but is not limited to, non-volatile types of memory such as three-dimensional (3-D) cross-point memory that may be byte or block addressable. Byte or block addressable non-volatile types of memory may also include, but are not limited to: memory using chalcogenide phase change materials (e.g., chalcogenide glass), multi-threshold level NAND flash memory, NOR flash memory, single-level or multi-level phase change memory (PCM), resistive memory, nanowire memory, ferroelectric transistor random access memory (FeTRAM), magnetoresistive random access memory (MRAM) combined with memristor technology, spin transfer torque MRAM (STT-MRAM), or any combination of the above memories, or other non-volatile memory types.

[0028] Figure 2 An example input / output scheme 200 is illustrated. In some examples, such as Figure 2As shown in , scheme 200 includes inputs / outputs of monitoring daemon 160. For these examples, behavior model data 201, event trace data 202, VM / CPU context data 204, memory map data 206, and PMI 208 may include various types of inputs received by monitoring daemon 160. Meanwhile, decision data 210 (as further described below) may be a type of output generated by monitoring daemon 160. At least some of the various types of inputs to monitoring daemon 160 (such as event trace data 202, VM / CPU context data 204, memory map data 206, or PMI 208) may be routed through the CPU / core executing monitoring daemon 160. For example, as previously described with respect to Figure 1 As mentioned, various data or PMI streams may be routed through the CPU / core 130 -N to reach the monitoring daemon 160 .

[0029] According to some examples, input to the behavior model data 201 may be received from a management entity (not shown) of the system 100, or may be loaded when the monitoring background process 160 is initiated. For these examples, the behavior model data 201 input to the monitoring background process 160 may include one or more reference fingerprints based on a target workload (e.g., a NAT or DNS workload) to be processed by the VNF application executed by the VMs 110-1 to 110-N. The reference fingerprints included in the behavior model data 201 may reflect the expected behavior of the VNF application. For example, the expected number and type of micro-architectural or computing events (e.g., instruction retirements, branch miss predictions, cache misses, TLB misses, etc.) generated by the VNF application executed by a given VM when processing a target workload over a period of time may be the reference fingerprints included in the behavior model data 201.

[0030] In some examples, the monitoring background process 160 may include logic and / or features for collecting information from event trace data 202, VM / CPU context data 204, memory mapping data 206, and PMI 208, and may process this data to generate sample fingerprints associated with one or more VNF applications executed by a given VM that processes an actual runtime workload over a given period of time (e.g., a few minutes or hours). As further described below, the logic and / or features of the monitoring background process 160 may compare a reference fingerprint of a target workload being processed by the VNF application with the sample fingerprint to determine a deviation from normal and / or expected operation. The decision data 210 may include an indication to the management entity of whether that comparison indicates that the VNF application and the associated VM, CPU / core, or memory are operating as expected. According to some examples, if the deviation from normal and / or expected operation is above a threshold, the decision data 210 may include an indication to the management entity that a possible problem needs to be resolved by the management entity. In other examples, the monitoring background process 160 may include logic and / or features for further analyzing the deviation if the determined deviation from normal and / or expected operation is relatively small or within an acceptable range of deviation. For these other examples, relatively small deviations (e.g., associated with normal / expected deviations) may be acceptable, and the ruling data 210 may indicate that there are no issues that need to be resolved by the management entity. Also, for these other examples, the monitoring background process 160 may include logic and / or features for adjusting the reference fingerprint based on the sample fingerprint to update the behavior model for future comparison of the updated reference fingerprint with later sample fingerprints. Alternatively, the monitoring background process 160 may cause the adjustment of the reference fingerprint to be performed by logic and / or features remotely to the monitoring background process 160, which may have more computing power to update the behavior model for future comparisons.

[0031] Figure 3 exemplifies an example block diagram of the monitoring background process 160. In some examples, such as Figure 3 The monitoring background process 160 shown in FIG. 1 includes event reading loop logic 310, fingerprint logic 320, reporting logic 330, code analysis logic 340, or model update logic 350. For these examples, the dashed lines Figure 3The elements of may represent data received or collected by the logic and / or features of the monitoring background process 160, and / or structures for storing data received or collected by the logic and / or features of the monitoring background process 160 (e.g., stored in the memory 140 or remotely stored / stored to the computing platform that hosts the monitoring background process 160). For example, the VM context buffer 360 may store data received or collected by the event read loop logic 310, such as data collected or received from the event tracking / PMI data 302 or from the VM context / CPU data. The VM context buffer 360 may also store the model 364 and the state information 366.

[0032] According to some examples, microarchitectural or computing events from event tracing / PMI data 302 and VM context CPU data 304 for one or more VNF applications executed by a given VM while processing a workload may be collected or read by event read loop logic 310 and combined. The combined data may be added to VM event tracing data 362 of VM context buffer 360. For these examples, VM context buffer 360 may be assigned to a given VM or specific to a given VM. Model 364 may include one or more behavioral models of a given VM with fingerprint references based on corresponding one or more target workloads. Also, the internal processing state of a given VM is maintained by state information 366. Model 364 may be stored locally on the same computing platform that hosts monitoring background process 160, or may be retrieved from a different computing platform that is remote from the hosting computing platform of monitoring background process 160.

[0033] In some examples, such as Figure 3 As shown in , fingerprint logic 320 may include pre-processing features 322 and comparison features 324. For these examples, pre-processing features 322 may be capable of processing information obtained from VM event trace data 362 to generate a sample fingerprint. Comparison features 324 may be capable of comparing the sample fingerprint with a reference fingerprint obtained from model 364, taking into account the internal processing state of a given VM obtained from state information 366 and / or indicated in VM event trace data 362.

[0034] According to some examples, the comparison feature 324 may generate a deviation value based on a comparison of the sample fingerprint with the reference fingerprint. The deviation value may indicate the amount of deviation of the sample fingerprint from the reference fingerprint. For example, a deviation value of how many cache misses or TLB misses are observed in the sample fingerprint relative to the number of cache misses or TLB misses in the reference fingerprint may be generated by the comparison feature 324. The deviation value may be normalized for the measurement of the distance between the reference fingerprint and the sample fingerprint. For example, the reference fingerprint may represent the frequency of execution of different types of computing instructions for each range of code addresses. When normalizing the deviation value, the code analysis logic 340 may use an example fifty code range with the most computing instructions, and then measure the distance between the sample fingerprint and the reference fingerprint in a 50-dimensional space.

[0035] In some examples, compare features 324 may use other methods to compare the sample fingerprint to the reference fingerprint. These other methods may include, but are not limited to, using artificial intelligence / machine learning methods, such as fuzzy logic, artificial neural networks, or other types of similar artificial intelligence / machine learning methods. These other methods may be able to implement more complex comparison schemes than directly comparing deviation values, and may allow complex feature extraction and pattern detection.

[0036] According to some examples, when using the deviation value methodology, if the deviation value generated by the comparison feature 324 is above a threshold, the reporting logic 330 can indicate to the management entity that a possible problem needs to be resolved by the management entity. This type of indication can simply be a warning that a possible problem exists and needs to be further investigated.

[0037] In some examples, if the deviation value generated by the comparison feature 324 is above a threshold, the code analysis logic 340 may perform additional analysis before determining whether to have the reporting logic 330 send an alarm or report. For these examples, further analysis is performed as to whether the deviation value above the threshold is abnormal (e.g., caused by a security threat and / or service performance risk) or normal (e.g., within the expected deviation of a given internal processing state of the VM). When the reference fingerprint does not contain the computational behavior seen during the creation of the behavioral model, the threshold deviation criterion or value may be equal to and / or exceed the deviation value. Alternatively, when one or more VNF applications executed by a given VM being monitored access a critical system function that is a symptom of a security attack, the threshold deviation criterion or value may be equal to and / or exceed the deviation score. A service performance risk may be a risk that one or more of the VNF applications are failing or are showing signs of impending failure, such that there is a risk that the services associated with the VNF are at risk of reaching an unacceptable performance level.

[0038] According to some examples, the failure may be caused by one or more CPUs / cores starting to fail or physical memory failure. The code analysis logic 340 may use a variety of data analysis techniques (which may include but are not limited to binary conversion, simulation, various heuristics, label matching) to determine whether the deviation is caused by a service performance risk, and determine whether the deviation is normal or expected for a given internal processing state of a VM executing one or more VNF applications that may or may not be failing. The reporting logic 330 may report the results of the analysis indicating the service performance risk to the management entity for further action. In other words, if the analysis indicates that the sample fingerprint indicates that the operation of the VM executing the one or more VNF applications when processing the workload is abnormal, a report of the service performance risk may be sent by the reporting logic 330 to the management entity.

[0039] In some examples, if the code analysis logic 340 determines that the sample fingerprint indicates that the operation is normal for a given VM executing the one or more VNF applications, the model update logic 350 may update at least one behavior model for the given VM and store the updated behavior model in the model 364. For these examples, the updated behavior model may be based on information in the VM event trace data 362, which is read or collected by the event read loop logic 310 and then used by the pre-processed features 322 of the fingerprint logic 320 to generate the sample fingerprint. In other words, the sample fingerprint becomes a reference fingerprint in the updated behavior model for comparison with the sample fingerprint generated later. Although the model update logic 350 is in Figure 3 160, but in alternative examples, the model update logic 350 may be located separately from the computing platform hosting the monitoring background process 160 and / or the CPU / core supporting the monitoring background process 160, or remotely. For these alternative examples, updating the behavior model may be extremely computationally intensive for the monitoring background process, and therefore the model update logic 350 may require a dedicated CPU / core and / or a dedicated remote computing platform in order to update the behavior model.

[0040] According to some examples, the behavior model for a given VM executing the one or more VNF applications processing the workload may not be included in the model 364. For these examples, the monitoring background process 160 may be in a learning phase. For this learning phase, the pre-processing feature 322 may generate a sample fingerprint, and the comparison feature 324 may indicate to the model update logic 350 to use the sample fingerprint and add the sample fingerprint to the model 364 to generate a new behavior model. The comparison feature 324 may then compare subsequent sample fingerprints based on this new behavior model.

[0041] Figure 4An example process 400 is illustrated. In some examples, the process 400 may be used to monitor the logic and / or features of a background process for collecting information of sample fingerprints associated with the behavior of one or more VNF applications being executed by a VM while processing a workload over a period of time. For these examples, as Figure 3 The elements of the monitoring background process 160 shown in FIG4 may be involved in the process 400. These elements of the monitoring background process 160 may include, but are not limited to, event tracking / PMI data 302, VM context / CPU data 304, event read loop logic 310, VM context buffer 360, fingerprint logic 320, code analysis logic 340, model update logic 350, or reporting logic 330. Further, Figure 1 The elements of the system 100 shown in FIG. Figure 2 The example scheme 200 shown in FIG. 4 may also involve the process 400. However, the example process 400 is not limited to using Figure 3 The elements of the monitoring background process 160 shown in Figure 1 The elements of the system 100 shown in Figure 2 An implementation of the example scheme 200 is shown in FIG.

[0042] Beginning with process 4.1, the event read loop logic 310 may be for a VM (such as Figure 1 1) to read or collect event / PMI data. In some examples, event / PMI data may be collected or read from event tracking / PMI data 302. Event tracking / PMI data 302 may include computing events or micro-architecture events received via event tracking data 202 and / or PMI 208 as CM 110-1 executes one or more of VNF apps 112-1 as they process workloads over a period of time.

[0043] Moving to process 4.2, event read loop logic 310 may read or collect context data for VM 110-1. In some examples, the context data may be collected from VM context / CPU data 304. VM context / CPU data may include what CPU / core among CPU / cores 130-1 to 130-4 has been assigned or allocated to support VM 110-1 and other associated information (e.g., timestamps and identifiers). VM context / CPU data may be collected via Figure 2 The VM / CPU context data 204 shown in FIG.

[0044] Moving to process 4.3, event read loop logic 310 may cause the collected or read event / PMI data and context data to be stored in VM context buffer 360. According to some examples, VM context buffer 360 may be specific to VM 110-1, and the event / PMI and context data may be stored in VM event trace data 362, such as Figure 3 As indicated in .

[0045] Moving to process 4 . 4 , the event read loop logic 310 may notify the fingerprint logic 320 that the data has been stored to the VM context buffer 360 .

[0046] Moving to process 4.5, the pre-processing feature 322 of the fingerprint logic 320 may collect data from the VM event trace data 362 to pre-process the data to generate a sample fingerprint.

[0047] Moving to process 4.6, comparison feature 324 of fingerprint logic 320 may compare the sample fingerprint generated by pre-processing feature 322 with a reference fingerprint obtained from model 364, taking into account the internal processing state of VM 110-1 obtained from the state information or indicated in VM event trace data 362. In some examples, comparison feature 324 may generate a deviation value based on the comparison of the sample fingerprint with the reference fingerprint.

[0048] Moving to process 4.7A, if the deviation value is less than the threshold deviation value, fingerprint logic 320 may instruct event read loop logic 310 to read or acquire additional data to generate a subsequent sample fingerprint, as described above for processes 4.1 through 4.5.

[0049] Moving to process 4.7B, if the deviation value is greater than the threshold deviation value, fingerprint logic 320 may indicate to code analysis logic 340 that additional analysis is required.

[0050] Moving to process 4.8B, the code analysis logic 340 may further analyze whether exceeding the threshold deviation value is normal or abnormal.

[0051] Moving to process 4.9B1, if the code analysis logic 340 determines that exceeding the threshold deviation value is due to normal operation of VM 110-1 when executing VNF app 112-1, the behavior model of VM 110-1 needs to be updated.

[0052] Moving to process 4.10B1, model update logic 350 may update the behavioral model of VM 110-1 so that comparison of subsequent sample fingerprints to the updated behavioral model does not require further analysis of what is considered normal operation.

[0053] Moving to process 4.9B2, if the code analysis logic 340 determines that exceeding the threshold deviation value is abnormal, it is necessary to report the abnormal operation of VM 110-1 when executing VNF app 112-1.

[0054] Moving to process 4.10B2, the reporting logic 330 can send a report to the management entity to report that the sampled or monitored behavior of the VM 110-1 when executing the VNF app 112-1 indicates abnormal behavior. In some examples, the report can indicate whether the service performance risk involves abnormal behavior.

[0055] Figure 5 An example block diagram of the device 500 is illustrated. Figure 5 The device 500 shown in FIG. 5 has a limited number of elements in a certain topology, but it can be appreciated that the device 500 can include more or fewer elements in alternative topologies as desired for a given implementation.

[0056] According to some examples, device 500 may be supported by circuitry 520. For these examples, circuitry 520 may be in a processor, a processor circuit, a CPU, or a core of a CPU of a computing system (e.g., Figure 1 For these examples, the processor, processor circuit, CPU, or CPU core may support monitoring background processes such as Figure 1-3 The monitoring background process 160 shown in FIG. 520 can be arranged to execute one or more software or firmware implemented modules, components or logic 522- a (Module, component, or logic are used interchangeably in this context). It is worth noting that the “ a "and" b "and" c " and similar designators are intended to be variables representing any positive integer. Thus, for example, if an implementation sets a value of a=5, then module, component, or logic 522- a The full set of software or firmware may include logic 522-1, 522-2, 522-3, 522-4, or 522-5. The examples presented are not limited in this context, and different variables used throughout may represent the same or different integer values. Also, "logic", "module" or "component" may also include software / firmware stored in a computer-readable medium, and although the type of logic is not limited in this context, the ... Figure 5 , but this does not limit these types of logic to storage devices in distinct computer-readable media components (eg, separate memories, etc.).

[0057] According to some examples, as mentioned above, circuit 520 may include a processor, a processor circuit, a CPU, or a core of a CPU. Circuit 520 may generally be arranged to execute one or more software components 522-a. Circuit 520 may be all or at least a portion of any of a variety of commercially available processors, including, but not limited to: AMD® Athlon®, Duron®, and Opteron® processors; ARM® application, embedded, and security processors; IBM® and Motorola® DragonBall® and PowerPC® processors; IBM and Sony® Cell processors; Intel® Atom®, Celeron®, Core (2) Duo®, Core i3, Core i5, Core i7, Itanium®, Pentium®, Xeon®, Xeon Phi®, and XScale® processors; and similar processors. According to some examples, circuit 520 may be configured as an application specific integrated circuit (ASIC), and at least some of logic 522-a may be implemented as hardware elements of the ASIC. According to some examples, circuit 520 may be configured as a field programmable gate array (FPGA), and at least some logic 522 - a may be implemented as hardware elements of the FPGA.

[0058] According to some examples, the device 500 may include event read loop logic 522-1. The event read loop logic 522-1 may be executed by the circuit 520 to receive information of computing events collected when the VM executes one or more applications for processing the workload of the VNF over a period of time. For these examples, the event read loop logic 522-1 may receive information via VM event tracking data 505 and VM context / CPU data 510.

[0059] In some examples, the device 500 may include fingerprint logic 522-2. The fingerprint logic 522-2 may be executed by the circuit 520 to generate a sample fingerprint based on the computing events collected in the information received by the event read loop logic 522-1. As described in the following example, the fingerprint logic 522-2 may determine whether to cause a report to be sent to a management entity to indicate a service performance risk for the one or more application processing workloads based on the sample fingerprint.

[0060] According to some examples, fingerprint logic 522-2 may compare the sample fingerprint with a reference fingerprint contained in a behavior model. The behavior model may be contained in behavior model 515 (e.g., obtained from a memory coupled to circuit 520). The reference fingerprint may be based on expected computing events generated when the VM executes the one or more applications for processing the target workload of the VNF over a period of time. For these examples, fingerprint logic 522-1 may determine whether to cause a report to be sent to a management entity to indicate a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0061] In some examples, fingerprint logic 522 - 2 may generate a deviation value to indicate a difference between a sample fingerprint and a reference fingerprint, and then make a decision on whether to cause a report to be sent based on whether the deviation value exceeds a threshold deviation value.

[0062] According to some examples, the device 500 may also include reporting logic 522-3. The reporting logic 522-4 may be executed by the circuit 520 to send a report to a management entity to indicate a service performance risk. As mentioned above, the fingerprint logic 522-2 may cause a report to be sent to a management entity. The report may be included in the report 540 and may indicate to the management entity that there is a risk that one or more of the VNF applications have failed or are showing signs of impending failure, causing the service associated with the VNF to be at risk of reaching an unacceptable performance level.

[0063] In some examples, the device 500 may also include code analysis logic 522-4. If the fingerprint logic 522-2 determines that the deviation value of the comparison of the sample fingerprint with the reference fingerprint exceeds the threshold deviation value, the code analysis logic 522-4 may be executed by the circuit 520 to provide further analysis. For these examples, the code analysis logic 522-4 may determine whether the deviation value exceeds the threshold deviation value due to normal operation of the workload used for one or more application processing VNFs. Normal operation may be based at least in part on the internal processing state of the VM executing one or more VNF applications. The internal processing state of the VM can be obtained via the state information 530. If the code analysis logic 522-2 determines that the deviation value exceeds the threshold deviation value is not due to normal operation, the code analysis logic 522-2 may prompt the reporting logic 522-3 to send a report to the management entity to indicate a service performance risk.

[0064] According to some examples, the device 500 may also include model update logic 522-5. The model update logic 522-5 may be executed by the circuit 520 to update the behavior model used by the fingerprint logic 522-2. For these examples, if the code analysis logic 522-4 determines that the deviation value exceeds the threshold deviation value due to normal operation, the model update logic 522-5 may cause an update to the behavior model. The behavior model may be updated based on the received information of the computing events collected when the VM executes the one or more applications for processing the workload of the VNF over a period of time. The model update logic 522-5 may cause the updated behavior model to be stored in a memory coupled to the circuit 520 via the updated behavior model 550. In the example where the behavior model is updated at the device 500, the model update logic 522-5 may perform computing tasks associated with updating the behavior model. In an example in which the behavior model of the device 500 is remotely updated, the model update logic 522-5 may cause the behavior model to be updated by sending received information of computing events collected when the VM executes the one or more applications for use by the remote model update logic, and then receiving an updated behavior model from the remote model update logic after the remote model update logic is updated.

[0065] The various components of the device 500 and the devices or nodes implementing the device 500 can be coupled to each other communicatively through various types of communication media to coordinate operations. Coordination can involve a one-way or two-way exchange of information. For example, the components can transmit information in the form of signals transmitted on the communication medium. The information can be implemented as signals assigned to various signal lines. In such assignments, each message is a signal. However, further embodiments alternatively can use data messages. Such data messages can be sent across various connections. Example connections include parallel interfaces, serial interfaces, and bus interfaces.

[0066] Included herein is a set of logical flows representing example methodologies for executing novel aspects of the disclosed architecture. Although one or more of the methodologies illustrated herein are illustrated and described as a series of actions for purposes of simplicity of explanation, those skilled in the art will understand and appreciate that the methodology is not limited by the order of the actions. Some actions may occur in a different order and / or simultaneously with actions different from those illustrated and described herein as such. For example, those skilled in the art will understand and appreciate that the methodology can alternatively be represented as a series of related states or events, such as in a state diagram. In addition, all actions exemplified in the methodology may not be required for novel implementations.

[0067] The logic flow may be implemented in software, firmware, and / or hardware. In software and firmware embodiments, the logic flow may be implemented by computer executable instructions stored on at least one non-transitory computer readable medium or machine readable medium, such as an optical, magnetic, or semiconductor storage device. The embodiments are not limited in this context.

[0068] Figure 6 An example logic flow 600 is illustrated. The logic flow 600 may represent some or all operations performed by one or more logic, features, or means described herein, such as the device 600. More specifically, the logic flow 600 may be implemented by at least the event read loop logic 522-1, the fingerprint logic 522-2, the reporting logic 522-3, or the code analysis logic 522-4.

[0069] According to some examples, the logic flow 600 can receive information of computing events collected when a VM executes one or more applications for processing a workload of a VNF over a period of time at block 602. For these examples, the event read loop logic 522-1 can receive the information.

[0070] In some examples, the logic flow 600 can generate a sample fingerprint based on the collected computing events at block 604. For these examples, the fingerprint logic 522-2 can generate the sample fingerprint.

[0071] According to some examples, the logic flow 600 may determine whether to report a service performance risk for the one or more application processing workloads based on the sample fingerprint at block 606. For these examples, the fingerprint logic 522-2 or the code analysis logic 522-4 may cause the reporting logic 522-3 to report a service performance risk based on the various types of comparisons or analyses mentioned previously.

[0072] Figure 7 An example storage medium 700 is illustrated. Figure 7 As shown in , the first storage medium includes storage medium 700. Storage medium 700 may include an article of manufacture. In some examples, storage medium 700 may include any non-transitory computer-readable medium or machine-readable medium, such as an optical, magnetic or semiconductor storage device. Storage medium 700 may store various types of computer-executable instructions, such as instructions for implementing logic flow 600. Examples of computer-readable or machine-readable storage media may include any tangible medium capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and the like. Examples of computer-executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like. Examples are not limited to this context.

[0073] Figure 8 An example computing platform 800 is illustrated. In some examples, such as Figure 8 As shown in , computing platform 800 may include processing component 840 , other platform components 850 , or communication interface 860 .

[0074] According to some examples, the processing component 840 can perform processing operations or logic of the device 500 and / or the storage medium 700. The processing component 840 can include various hardware elements, software elements, or a combination of the two. Examples of hardware elements can include devices, logic devices, components, processors, microprocessors, circuits, processor circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, etc.), integrated circuits, ASICs, programmable logic devices (PLDs), digital signal processors (DSPs), FPGAs, memory cells, logic gates, registers, semiconductor devices, chips, microchips, chipsets, etc. Examples of software elements can include software components, programs, applications, computer programs, applications, device drivers, system programs, software development programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof. Determining whether to use hardware elements and / or software elements to implement an example can vary according to any number of factors, such as desired computational rates, power levels, thermal tolerances, processing cycle budgets, input data rates, output data rates, memory resources, data bus speeds, and other design or performance constraints, as desired for a given example.

[0075] In some examples, other platform components 850 may include common computing elements, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components (e.g., digital displays), power supplies, etc. Examples of memory units or memory devices may include, without limitation, various types of computer-readable and machine-readable storage media in the form of one or more higher speed memory units, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon oxide nitride oxide silicon (SONOS) memory, magnetic or optical cards, device arrays (such as redundant array of independent disks (RAID) drives), solid-state memory devices (e.g., USB memory), solid-state drives (SSDs), and any other type of media suitable for storing information.

[0076] In some examples, the communication interface 860 may include logic and / or features that support the communication interface. For these examples, the communication interface 860 may include one or more communication interfaces that operate according to various communication protocols or standards to communicate on a direct or network communication link. Direct communication may occur via the use of a communication protocol or standard described in one or more industrial standards (including descendants and variants) (such as those associated with the PCIe specification). Network communication may occur via the use of a communication protocol or standard (such as those described in one or more Ethernet standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE). For example, one such Ethernet standard promulgated by the IEEE may include, but is not limited to, IEEE 802.3-2012, a carrier sense multiple access (CSMA / CD) access method and physical layer specification with collision detection (hereinafter referred to as the "IEEE 802.3" specification) released in December 2012. Network communication may also occur according to one or more OpenFlow specifications (such as the OpenFlow hardware abstraction API specification). Network communication may also occur according to the Infiniband architecture specification.

[0077] Computing platform 800 may be implemented in a server or client computing device. Thus, the functionality and / or specific configuration of computing platform 800 described herein may be included or omitted in various embodiments of computing platform 800, as appropriately desired for a server or client computing device.

[0078] The components and features of computing platform 800 may be implemented using any combination of discrete circuits, application specific integrated circuits (ASICs), logic gates, and / or single chip architectures. Further, features of computing platform 800 may be implemented using microcontrollers, programmable logic arrays, and / or microprocessors, or any combination of the foregoing where appropriate. Note that hardware, firmware, and / or software elements may be collectively or individually referred to herein as "logic" or "circuitry."

[0079] It should be understood that in Figure 8 The exemplary computing platform 800 shown in the block diagram of the embodiment may represent an example of a functional description of many potential implementations. Therefore, the division, omission or inclusion of block functions depicted in the drawings does not imply that the hardware components, circuits, software and / or elements used to implement these functions are necessarily divided, omitted or included in the embodiment.

[0080] This disclosure / application provides the following technical solutions:

[0081] 1. A device comprising:

[0082] Memory; and

[0083] a processor circuit coupled to the memory to execute logic for:

[0084] receiving information of computing events collected while a virtual machine (VM) executes one or more applications for processing a workload of a virtual network function (VNF) over a period of time;

[0085] generating a sample fingerprint based on the collected computing events; and

[0086] A determination is made based on the sample fingerprint whether to report a service performance risk for the one or more applications processing the workload.

[0087] 2. The device of claim 1, comprising the logic for performing the following operations:

[0088] comparing the sample fingerprint to a reference fingerprint contained in a behavioral model stored in the memory, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; and

[0089] A determination is made whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0090] 3. The device according to technical solution 2, comprising the logic for performing the following operations:

[0091] generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; and

[0092] Whether to report a service performance risk is determined based on whether the deviation value exceeds a threshold deviation value.

[0093] 4. The device of claim 3, comprising the logic for performing the following operations:

[0094] determining that the deviation value exceeds the threshold deviation value; and

[0095] Determine whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload used by the one or more applications to process the VNF.

[0096] 5. The device according to technical solution 4, comprising the logic for performing the following operations:

[0097] If the deviation value exceeds the threshold deviation value and is not caused by normal operation, the service performance risk is reported.

[0098] 6. The device of claim 4, comprising the logic for performing the following operations:

[0099] causing an update to the behavior model based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation, the behavior model being updated based on received information of computing events collected while the VM was executing the one or more applications for processing the workload of the VNF over the period of time; and

[0100] The updated behavior model is caused to be stored in the memory.

[0101] 7. The device of technical solution 1, comprising the logic for performing the following operations:

[0102] determining a risk of not reporting service performance based on the memory not containing a behavioral model including a reference fingerprint;

[0103] creating a behavior model including the sample fingerprint as the reference fingerprint; and

[0104] The created behavior model is caused to be stored in the memory.

[0105] 8. In the device as described in technical solution 1, the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or a core assigned to support the VM, and the computing events include instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss.

[0106] 9. The device as described in technical solution 8 includes the computing events collected by the CPU or core assigned to support the VM via one or more of precise event-based sampling (PEBS), processor tracing (PT), embedded trace microunit (EMT) or branch target storage (BTS).

[0107] 10. In the device as described in Technical Solution 1, the VNF includes a VNF for providing services, and the services include firewall services, domain name services (DNS), cache services, or network address translation (NAT) services.

[0108] 11. In the device as described in Technical Solution 1, the memory includes one or more of a volatile memory or a non-volatile memory.

[0109] 12. A method comprising:

[0110] receiving, at a processor circuit, information of computing events collected while a virtual machine (VM) executes one or more applications for processing a workload of a virtual network function (VNF) over a period of time;

[0111] generating a sample fingerprint based on the collected computing events; and

[0112] A determination is made based on the sample fingerprint whether to report a service performance risk for the one or more applications processing the workload.

[0113] 13. The method according to technical solution 12, comprising:

[0114] comparing the sample fingerprint to a reference fingerprint contained in a behavioral model, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; and

[0115] A determination is made whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0116] 14. The method according to technical solution 13, comprising:

[0117] generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; and

[0118] Whether to report a service performance risk is determined based on whether the deviation value exceeds a threshold deviation value.

[0119] 15. The method according to technical solution 14, comprising:

[0120] determining that the deviation value exceeds the threshold deviation value;

[0121] determining whether the deviation value exceeding the threshold deviation value is due to normal operation of the one or more applications processing the workload of the VNF; and

[0122] If the deviation value exceeds the threshold deviation value and is not caused by normal operation, the service performance risk is reported.

[0123] 16. The method according to technical solution 15, comprising:

[0124] The behavioral model is updated based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation, and the behavioral model is updated based on received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over the period of time.

[0125] 17. The method according to technical solution 12, comprising:

[0126] determining a risk of not reporting service performance based on not having a behavioral model containing a reference fingerprint;

[0127] creating a behavior model including the sample fingerprint as the reference fingerprint; and

[0128] Stores the created behavior model.

[0129] 18. As described in technical solution 12, the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or core assigned to support the VM, and the computing events include instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss.

[0130] 19. At least one machine-readable medium comprising a plurality of instructions that, in response to being executed by a system, cause the system to:

[0131] receiving information of computing events collected while a virtual machine (VM) executes one or more applications for processing a workload of a virtual network function (VNF) over a period of time;

[0132] generating a sample fingerprint based on the collected computing events; and

[0133] A determination is made based on the sample fingerprint whether to report a service performance risk for the one or more applications processing the workload.

[0134] 20. The at least one machine-readable medium of technical solution 19, comprising the instructions for causing the system to perform the following operations:

[0135] comparing the sample fingerprint to a reference fingerprint contained in a behavioral model, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; and

[0136] A determination is made whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0137] 21. The at least one machine-readable medium of technical solution 20, comprising the instructions for causing the system to perform the following operations:

[0138] generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; and

[0139] Whether to report a service performance risk is determined based on whether the deviation value exceeds a threshold deviation value.

[0140] 22. The at least one machine-readable medium of technical solution 21, comprising the instructions for causing the system to perform the following operations:

[0141] determining that the deviation value exceeds the threshold deviation value;

[0142] determining whether the deviation value exceeding the threshold deviation value is due to normal operation of the one or more applications processing the workload of the VNF; and

[0143] If the deviation value exceeds the threshold deviation value and is not caused by normal operation, the service performance risk is reported.

[0144] 23. The at least one machine-readable medium of technical solution 22, comprising the instructions for causing the system to perform the following operations:

[0145] causing an update to the behavior model based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation, the behavior model being updated based on received information of computing events collected while the VM was executing the one or more applications for processing the workload of the VNF over the period of time; and

[0146] The updated behavior model is caused to be stored in memory.

[0147] 24. The at least one machine-readable medium of technical solution 19, comprising the instructions for causing the system to perform the following operations:

[0148] determining a risk of not reporting service performance based on not having a behavioral model containing a reference fingerprint;

[0149] creating a behavior model including the sample fingerprint as the reference fingerprint; and

[0150] Causing the created behavior model to be stored in memory.

[0151] 25. As described in at least one machine-readable medium of technical solution 19, the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or core assigned to support the VM, and the computing events include instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss.

[0152] One or more aspects of at least one example may be implemented by representative instructions stored on at least one machine-readable medium representing various logic within the processor, which when read by a machine, computing device or system causes the machine, computing device or system to fabricate logic for performing the techniques described herein. Such representations, known as "IP cores", may be stored on a tangible, machine-readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that actually make the logic or processor.

[0153] Various examples can be implemented using hardware elements, software elements, or a combination of the two. In some examples, hardware elements can include devices, components, processors, microprocessors, circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, etc.), integrated circuits, ASICs, PLDs, DSPs, FPGAs, memory cells, logic gates, registers, semiconductor devices, chips, microchips, chipsets, etc. In some examples, software elements can include software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, APIs, instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof. Determining whether to use hardware elements and / or software elements to implement examples can be changed according to any number of factors, such as desired computing rate, power level, heat resistance, processing cycle budget, input data rate, output data rate, memory resources, data bus speed, and other design or performance constraints, as desired for a given implementation.

[0154] Some examples may include an article of manufacture or at least one computer-readable medium. The computer-readable medium may include a non-transitory storage medium for storing logic. In some examples, the non-transitory storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and the like. In some examples, the logic may include various software elements, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, APIs, instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination thereof.

[0155] According to some examples, a computer-readable medium may include a non-transitory storage medium for storing or saving instructions, which, when executed by a machine, a computing device, or a system, causes the machine, a computing device, or a system to perform methods and / or operations according to the described examples. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. The instructions may be implemented according to a predefined computer language, manner, or syntax for directing a machine, a computing device, or a system to perform a function. The instructions may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled, and / or interpreted programming language.

[0156] Some examples may be described using the expression "in one example" or "example" along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the example is included in at least one example. The appearances of the phrase "in one example" in various places in the specification are not necessarily all referring to the same example.

[0157] Some examples may be described using the expressions "coupled" and "connected" along with their derivatives. These terms are not necessarily intended to be synonyms for each other. For example, descriptions using the terms "connected" and / or "coupled" may indicate that two or more elements are in direct physical or electrical contact with each other. However, the terms "coupled" or "coupled to" may also mean that two or more elements are not in direct contact with each other, but still operate or interact with each other in coordination.

[0158] The following examples pertain to additional examples of the technology disclosed herein.

[0159] Example 1. An example device includes a memory and a processor circuit coupled to the memory. For these examples, the processing circuit can execute logic. The logic can receive information about computing events collected when a VM executes one or more applications for processing a workload of a VNF over a period of time. The logic can also generate a sample fingerprint based on the collected computing events. The logic can also determine whether to report a service performance risk for one or more application processing workloads based on the sample fingerprint.

[0160] Example 2. The apparatus of Example 1, wherein the logic may further compare the sample fingerprint with a reference fingerprint contained in a behavior model stored in the memory. The reference fingerprint may be based on expected computing events generated when the VM executes the one or more applications for processing the target workload of the VNF over a period of time. The logic may also determine whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0161] Example 3. The device described in Example 2, wherein the logic may further generate a deviation value indicating a difference between the sample fingerprint and the reference fingerprint, and the logic may further determine whether to report a service performance risk based on whether the deviation value exceeds a threshold deviation value.

[0162] Example 4. In the device described in Example 3, the logic may also determine that the deviation value exceeds a threshold deviation value, and determine whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload for one or more application processing VNFs.

[0163] Example 5. The apparatus described in Example 4, wherein the logic may further: report a service performance risk if the deviation value exceeds a threshold deviation value and is not caused by normal operation.

[0164] Example 6. The apparatus of Example 4, wherein the logic may also cause an update to the behavior model based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation. The behavior model may be updated based on received information of computing events collected when the VM executes one or more applications for processing the workload of the VNF over a period of time. The logic may also cause the updated behavior model to be stored in the memory.

[0165] Example 7. The apparatus of Example 1, wherein the logic may further determine not to report the service performance risk based on the memory not containing a behavior model including the reference fingerprint. The logic may further create a behavior model including the sample fingerprint as the reference fingerprint, and cause the created behavior model to be stored in the memory.

[0166] Example 8. For the device described in Example 1, the information of computing events collected when the VM executes the one or more applications may include computing events occurring at a CPU or core assigned to support the VM, wherein the computing events include instruction retirement, branch prediction miss, cache miss, or translation lookaside buffer miss.

[0167] Example 9. The apparatus of Example 8, wherein computing events are collected by a CPU or core assigned to support a VM via use of one or more of PEBS, PT, EMT, or BTS.

[0168] Example 10. In the device described in Example 1, the VNF can provide services, including firewall services, DNS, cache services, or NAT services.

[0169] Example 11. The device described in Example 1, wherein the memory may include one or more of volatile memory or non-volatile memory.

[0170] Example 12. In the apparatus described in Example 11, the volatile memory may include RAM, DRAM, DDR SDRAM, SRAM, TRAM, or ZRAM. The non-volatile memory may include a phase change memory using a chalcogenide phase change material, a flash memory, a ferroelectric memory, a SONOS memory, a polymer memory, a ferroelectric polymer memory, FeTRAM, FeRAM, a bidirectional memory, a nanowire, an electrical EEPROM, a phase change memory, a memristor, or an STT-MRAM.

[0171] Example 13. An example method may include: receiving, at a processor circuit, information of computing events collected when a VM executes one or more applications for processing a workload of a VNF over a period of time. The method may also include: generating a sample fingerprint based on the collected computing events. The method may also include: determining whether to report a service performance risk for the one or more application processing workloads based on the sample fingerprint.

[0172] Example 14. The method of Example 13 may further include: comparing the sample fingerprint with a reference fingerprint included in the behavior model. The reference fingerprint may be based on expected computing events generated when the VM executes the one or more applications for processing the target workload of the VNF over a period of time. The method may further include: determining whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0173] Example 15. The method of Example 14 may further include generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint. The method may further include determining whether to report a service performance risk based on whether the deviation value exceeds a threshold deviation value.

[0174] Example 16. The method described in Example 15 may also include: determining that the deviation value exceeds a threshold deviation value, and determining whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload used for the one or more application processing VNFs.

[0175] Example 17. The method of Example 16 may further include: reporting a service performance risk if the deviation value exceeds the threshold deviation value and is not caused by normal operation.

[0176] Example 18. The method described in Example 16 may also include: updating a behavioral model based on a determination that a deviation value exceeding a threshold deviation value is due to normal operation, wherein the behavioral model is updated based on received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over a period of time.

[0177] Example 19. The method of Example 13 may further include: determining not to report the service performance risk based on not having a behavior model including the reference fingerprint. The method may further include: creating a behavior model including the sample fingerprint as a reference fingerprint, and storing the created behavior model.

[0178] Example 20. The method described in Example 13, wherein the information of computing events collected when the VM executes the one or more applications may include computing events occurring at a CPU or core assigned to support the VM, the computing events including instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss.

[0179] Example 21. The method of Example 20 may also include computing events collected by a CPU or core assigned to support the VM via use of one or more of PEBS, PT, EMT, or BTS.

[0180] Example 22. In the method described in Example 13, the VNF can provide firewall services, DNS, cache services, or NAT services.

[0181] Example 23. An example. At least one machine-readable medium may contain a plurality of instructions, which in response to being executed by a system may cause the system to perform a method according to any one of Examples 13 to 22.

[0182] Example 24. An example apparatus may include means for performing the method of any of Examples 13 to 22.

[0183] Example 25. An example at least one machine-readable medium may contain a plurality of instructions that, in response to being executed by a system, may cause the system to receive information about computing events collected when a VM executes one or more applications for processing a workload of a VNF over a period of time. The instructions may also cause the system to generate a sample fingerprint based on the collected computing events. The instructions may also cause the system to determine whether to report a service performance risk for the one or more application processing workloads based on the sample fingerprints.

[0184] Example 26. At least one machine-readable medium of Example 25, wherein the instructions may further cause the system to compare the sample fingerprint with a reference fingerprint contained in the behavior model. The reference fingerprint may be based on expected computing events generated when the VM executes the one or more applications for processing the target workload of the VNF over a period of time. The instructions may further cause the system to determine whether to report a service performance risk based on the comparison of the sample fingerprint with the reference fingerprint.

[0185] Example 27. The at least one machine-readable medium of Example 26, wherein the instructions may further cause the system to generate a deviation value indicating a difference between the sample fingerprint and the reference fingerprint. The instructions may further cause the system to determine whether to report a service performance risk based on whether the deviation value exceeds a threshold deviation value.

[0186] Example 28. At least one machine-readable medium as described in Example 27, wherein the instructions may also cause the system to determine that the deviation value exceeds a threshold deviation value, and determine whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload used for the one or more application processing VNFs.

[0187] Example 29. The at least one machine-readable medium of Example 28, wherein the instructions may further cause the system to report a service performance risk if the deviation value exceeds a threshold deviation value that is not due to normal operation.

[0188] Example 30. The at least one machine-readable medium of Example 28, wherein the instructions may further cause the system to cause an update to the behavior model based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation. The behavior model may be updated based on received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over a period of time. The instructions may further cause the system to cause the updated behavior model to be stored in a memory.

[0189] Example 31. The at least one machine-readable medium of Example 25, wherein the instructions may further cause the system to determine not to report the service performance risk based on not having a behavior model that includes the reference fingerprint. The instructions may further cause the system to create a behavior model that includes the sample fingerprint as a reference fingerprint, and cause the created behavior model to be stored in a memory.

[0190] Example 32. At least one machine-readable medium described in Example 25, the information of computing events collected when the VM executes the one or more applications may include computing events occurring at a CPU or core assigned to support the VM, the computing events including instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss.

[0191] Example 33. The at least one machine-readable medium of Example 32, wherein the computing events can be collected by a CPU or core assigned to support a VM via use of one or more of PEBS, PT, EMT, or BTS.

[0192] Example 34. At least one machine-readable medium described in Example 25, the VNF can provide services, wherein the services include firewall services, DNS, cache services, or NAT services.

[0193] It is emphasized that the abstract of the present disclosure is provided to comply with 37 CFR Section 1.72 (b), which requires an abstract that will allow the reader to quickly ascertain the nature of the technical disclosure. It is advocated with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, it can be seen in the foregoing detailed description that various features are aggregated together in a single example for the purpose of streamlining the present disclosure. This method of the present disclosure is not interpreted as reflecting the intention that the examples of the claimed rights require more features than the features explicitly set forth in each claim. On the contrary, as reflected in the following claims, the subject matter of the invention lies in less than all the features of a single disclosed example. Therefore, the following claims are hereby incorporated into the detailed description, wherein each claim represents itself as a separate example. In the appended claims, the terms "including" and "wherein" are used as the plain English equivalents of the corresponding terms "including" and "wherein", respectively. In addition, the terms "first", "second", "third", etc. are used only as annotations and are not intended to impose numerical requirements on their objects.

[0194] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A monitoring device, comprising: Memory; as well as a processor circuit coupled to the memory, the processor circuit being configured to execute logic, the logic being configured to: Receiving information of computing events collected when a virtual machine VM executes one or more applications for processing a workload of a virtual network function VNF over a period of time, the computing events comprising instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss; generating a sample fingerprint based on the collected computing events; comparing the sample fingerprint to a reference fingerprint contained in a behavior model stored in the memory, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; determining that the deviation value exceeds a threshold deviation value; determining whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload for the one or more applications to process the VNF; as well as If the deviation value exceeding the threshold deviation value is not due to normal operation, a service performance risk for the one or more applications processing the workload is reported, or, based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation, the behavioral model is updated.

2. The monitoring device of claim 1, comprising the logic for performing the following operations: When the updating of the behavior model is caused based on the determination that the deviation value exceeding the threshold deviation value is due to normal operation, the updated behavior model is caused to be stored in the memory, wherein the behavior model is updated based on the received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over the period of time.

3. The monitoring device of claim 1, comprising the logic for performing the following operations: determining a risk of not reporting service performance based on the memory not containing a behavioral model including a reference fingerprint; creating a behavior model including the sample fingerprint as the reference fingerprint; and The created behavior model is caused to be stored in the memory. 4 . The monitoring device of claim 1 , wherein the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or a core allocated to support the VM.

5. The monitoring device of claim 4, comprising the computing events collected by the CPU or core assigned to support the VM via one or more of precise event-based sampling PEBS, processor trace PT, embedded trace microunit EMT, or branch target storage BTS.

6. The monitoring device as described in claim 1, wherein the VNF includes a VNF for providing services, and the services include firewall services, domain name services DNS, cache services or network address translation NAT services.

7. The monitoring device of claim 1, wherein the memory comprises one or more of a volatile memory or a non-volatile memory.

8. The monitoring device according to claim 7 comprises the volatile memory, wherein the volatile memory comprises a random access memory RAM, a dynamic RAM DRAM, a double data rate synchronous dynamic RAM DDR SDRAM, a static random access memory SRAM, a thyristor RAM TRAM or a zero capacitor RAM ZRAM, wherein the non-volatile memory comprises a phase change memory using a chalcogenide phase change material, a flash memory, a ferroelectric memory, a silicon oxide nitride oxide silicon SONOS memory, a polymer memory, a ferroelectric polymer memory, a ferroelectric transistor random access memory FeTRAM or FeRAM, a bidirectional memory, a nanowire, an electrically erasable programmable read-only memory EEPROM, a phase change memory, a memristor or a spin transfer torque-magnetoresistive random access memory STT-MRAM.

9. A monitoring method comprising: receiving, at the processor circuit, information of computing events collected when the virtual machine VM executes one or more applications for processing a workload of the virtual network function VNF over a period of time, the computing events comprising instruction retirement, branch miss prediction, cache miss, or translation lookaside buffer miss; generating a sample fingerprint based on the collected computing events; comparing the sample fingerprint to a reference fingerprint contained in a behavior model, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; determining that the deviation value exceeds a threshold deviation value; determining whether the deviation value exceeding the threshold deviation value is caused by normal operation of the workload for the one or more applications to process the VNF; as well as If the deviation value exceeds the threshold deviation value and is not due to normal operation, a service performance risk for the one or more applications processing the workload is reported, or the behavior model is updated based on a determination that the deviation value exceeds the threshold deviation value and is due to normal operation.

10. The monitoring method as described in claim 9, when the behavior model is updated based on the determination that the deviation value exceeding the threshold deviation value is due to normal operation, the behavior model is updated based on the received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over the period of time.

11. The monitoring method according to claim 9, comprising: determining a risk of not reporting service performance based on not having a behavioral model containing a reference fingerprint; Creating a behavior model including the sample fingerprint as the reference fingerprint; as well as Stores the created behavior model.

12. The monitoring method of claim 9, wherein the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or core allocated to support the VM.

13. The monitoring method of claim 12, comprising the computing events collected by the CPU or core assigned to support the VM using one or more of precise event-based sampling PEBS, processor trace PT, embedded trace microunit EMT, or branch target storage BTS.

14. The monitoring method according to claim 9, wherein the VNF includes a VNF for providing firewall service, domain name service DNS, cache service or network address translation NAT service.

15. At least one machine-readable medium comprising a plurality of instructions which, in response to being executed by a system, cause the system to perform a monitoring method according to any one of claims 9 to 14.

16. A monitoring device comprising components for executing the monitoring method according to any one of claims 9 to 14.

17. A monitoring device comprising: means for receiving, at a processor circuit, information of computing events collected when a virtual machine VM executes one or more applications for processing a workload of a virtual network function VNF over a period of time, the computing events comprising instruction retirements, branch miss predictions, cache misses, or translation lookaside buffer misses; means for generating a sample fingerprint based on the collected computing events; means for comparing the sample fingerprint to a reference fingerprint contained in a behavioral model, the reference fingerprint being based on expected computing events generated when the VM executes the one or more applications for processing a target workload of the VNF; means for generating a deviation value indicating a difference between the sample fingerprint and the reference fingerprint; means for determining that the deviation value exceeds a threshold deviation value; means for determining whether the deviation value exceeding the threshold deviation value is due to normal operation of the workload for the one or more applications to process the VNF; as well as A component for reporting a service performance risk for the one or more applications processing the workload if the deviation value exceeding the threshold deviation value is not due to normal operation, or a component for updating the behavioral model based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation.

18. The monitoring device of claim 17, when the behavior model is updated based on a determination that the deviation value exceeding the threshold deviation value is due to normal operation, the behavior model is updated based on received information of computing events collected when the VM executes the one or more applications for processing the workload of the VNF over the period of time.

19. The monitoring device according to claim 17, comprising: component for determining a risk of not reporting service performance based on not having a behavioral model containing a reference fingerprint; A component for creating a behavior model including the sample fingerprint as the reference fingerprint; as well as A component used to store the created behavior models.

20. The monitoring device of claim 17, wherein the information of computing events collected when the VM executes the one or more applications includes computing events occurring at a central processing unit (CPU) or a core allocated to support the VM.

21. The monitoring device of claim 20, comprising the computing events collected by the CPU or core assigned to support the VM using one or more of precise event-based sampling PEBS, processor trace PT, embedded trace microunit EMT, or branch target storage BTS.

22. The monitoring device according to claim 17, wherein the VNF includes a VNF for providing a firewall service, a domain name service DNS, a cache service, or a network address translation NAT service.

Images