Performance modeling for SOA security appliance

• US 8,886,779 B2
• Filed: 10/19/2007
• Issued: 11/11/2014
• Est. Priority Date: 10/19/2007
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Liu, Lei
• Primary Examiner(s): BAROT, BHARAT
• Application Number:
  US11/875,628
• Publication Number:
  US 20090106012A1
• Time in Patent Office: 2,580 Days
• Field of Search: 709223-226, 703/2, 703/13, 703/21, 700 28- 29
• US Class Current: 709/223
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A device, system, and method are directed towards optimizing a security apparatus within a Service-Oriented Architecture (SOA). Performance data is gathered for the SOA. A plurality of queuing performance models are generated based on a plurality of components comprising a user land, a kernel, and a Central Processing Unit (CPU). The generation may be based on an incremental online training based on the gathered data, on a simulation based on the gathered data, on a probability distribution function, on an operational law, or the like. Derivative points are determined based on the plurality of queuing performance models. The derivative points are maximized by tuning at least one parameter of the user land, at least one parameter of the kernel, and/or at least one parameter of the CPU within at least another simulation and/or increment of the online training. The security apparatus is optimized based on the at least one parameters.

Claims

1. A method for simulating a security apparatus within a service oriented architecture (SOA), comprising:

gathering performance data for the SOA;

generating, based on the performance data, a first queuing performance model to model resource usage by at least one user of the SOA;

generating, based on the performance data, a second queuing performance model to model a kernel of the SOA;

generating, based on the performance data, a third queuing performance model for a Central Processing Unit (CPU) of the SOA; and

generating a Queuing Network model by interconnecting the first queuing performance model, the second queuing performance model, and the third queuing performance model,

wherein the Queuing Network model simulates the security apparatus within the SOA.

2. The method of claim 1, further comprising:

performing an incremental online training of the first, second, and third queuing performance models.

3. The method of claim 1, wherein generating the first queuing performance model comprises:

simulating a plurality of input packets, an arrival rate, and a schedule of use of the at least one user of the SOA.

4. The method of claim 1, wherein generating the first, second, and third queuing performance models is further based on a Quality of Service (QoS) factor.

5. The method of claim 1, wherein generating the second queuing performance model comprises:

simulating a memory usage, a schedule, a policy of use, and a CPU allocation of the kernel.

6. The method of claim 1, wherein the security apparatus is configured to perform at least one selected from a group comprising encrypting, decrypting, forwarding, transforming, signing, and enforcing a policy.

7. The method of claim 1, wherein an output of at least one of the first, second, and third queuing performance models is an input to at least another one of the first, second, and third queuing performance models.

8. The method of claim 1, wherein, within the Queuing Network model, the first, second, and third queuing performance models are interconnected in a recurrent network.

9. The method of claim 1, wherein generating the third queuing performance model comprises:

simulating an instruction set, an execution request, and an allocated percentage of CPU usage for an application executing on the CPU.

10. An apparatus for simulating a security apparatus within a service oriented architecture (SOA), comprising:

an interface for receiving performance data for; and

a processor configured to perform operations comprising;

generating, based on the performance data, a first queuing performance model to model resource usage by at least one user of the SOA;

generating, based on the performance data, a second queuing performance model to model a kernel of the SOA;

generating, based on the performance data, a third queuing performance model for a Central Processing Unit (CPU) of the SOA; and

generating a Queuing Network model by interconnecting the first queuing performance model, the second queuing performance model, and the third queuing performance model,

wherein the Queuing Network model simulates the security apparatus within the SOA.

11. The apparatus of claim 10, further comprising:

incrementally training the first, second, and third queuing performance models based on the performance data.

12. The apparatus of claim 10, wherein generating the first queuing performance model comprises:

simulating a plurality of input packets, an arrival rate, and a schedule of use of the at least one user of the SOA.

13. The apparatus of claim 10, wherein the processor is further configured to perform:

training a neural network on a training set of inputs and outputs for the Queuing Network model.

14. The apparatus of claim 10, wherein generating the second queuing performance model comprises:

simulating a memory usage, a schedule, a policy of use, and a CPU allocation of the kernel.

15. The apparatus of claim 10, wherein the security apparatus is configured to perform at least one selected from a group comprising encrypting, decrypting, forwarding, transforming, signing, and enforcing a policy.

16. The apparatus of claim 10, wherein an output of at least one of the first, second, and third queuing performance models is an input to at least another one of the first, second, and third queuing performance models.

17. A processor readable medium for simulating a security apparatus within a service oriented architecture (SOA), comprising instructions when executed by a processor performs operations comprising:

gathering performance data for the SOA;

generating, based on the performance data, a first queuing performance model to model resource usage by at least one user of the SOA;

generating, based on the performance data, a second queuing performance model to model a kernel of the SOA;

generating, based on the performance data, a third queuing performance model for a Central Processing Unit (CPU) of the SOA; and

generating a Queuing Network model by interconnecting the first queuing performance model, the second queuing performance model, and the third queuing performance model,

wherein the Queuing Network model simulates the security apparatus within the SOA.

18. The processor readable medium of claim 17, wherein generating the first, second, and third queuing performance models is further based on a Quality of Service (QoS) factor.

19. The processor readable medium of claim 17, wherein generating the first, second, and third queuing performance models is further based on a probability distribution function of the states of the SOA.