The use of containers in cloud computing has been steadily increasing. With the emergence of Kubernetes, the management of applications inside containers (or pods) is simplified. Kubernetes allows automated actions like self-healing, scaling, rolling back, and updates for the application management. At the same time, security threats have also evolved with attacks on pods to perform malicious actions. Out of several recent malware types, cryptomining has emerged as one of the most serious threats with its hijacking of server resources for cryptocurrency mining. During application deployment and execution in the pod, a cryptomining process, started by a hidden malware executable can be run in the background, and a method to detect malicious cryptomining software running inside Kubernetes pods is needed. One feasible strategy is to use machine learning (ML) to identify and classify pods based on whether or not they contain a running process of cryptomining. In addition to such detection, the system administrator will need an explanation as to the reason(s) of the ML's classification outcome. The explanation will justify and support disruptive administrative decisions such as pod removal or its restart with a new image. In this article, we describe the design and implementation of an ML-based detection system of anomalous pods in a Kubernetes cluster by monitoring Linux-kernel system calls (syscalls). Several types of cryptominers images are used as containers within an anomalous pod, and several ML models are built to detect such pods in the presence of numerous healthy cloud workloads. Explainability is provided using SHAP, LIME, and a novel auto-encoding-based scheme for LSTM models. Seven evaluation metrics are used to compare and contrast the explainable models of the proposed ML cryptomining detection engine.

Task progressive learning is often required where the training data become available in batches over the time. Such learning has the characteristic of using an existing model trained over a set of tasks to learn a new task while maintaining the accuracy of older tasks. Artificial Neural Networks (ANNs) have a higher capacity for progressive learning than other traditional machine learning models due to the availability of a large number of ANN parameters. A progressive model that uses a fully connected ANN suffers from long training time, overfitting, and excessive resource usage. It is therefore necessary to generate the ANN incrementally as new tasks arrive and new training is needed. In this paper, an incremental algorithm is presented to dynamically generate a compact neural network by pruning and expanding the synaptic weights based on the learning requirements of the new tasks. The algorithm is implemented, analyzed, and validated using the cloud network security datasets, UNSW and AWID, as well as the image dataset, MNIST.

Cloud network monitoring data is dynamic and distributed. Signals to monitor the cloud can appear, disappear or change their importance and clarity over time. Machine learning (ML) models tuned to a given data set can therefore quickly become inadequate. A model might be highly accurate at one point in time but may lose its accuracy at a later time due to changes in input data and their features. Distributed learning with dynamic model selection is therefore often required. Under such selection, poorly performing models (although aggressively tuned for the prior data) are retired or put on standby while new or standby models are brought in. The well-known method of Ensemble ML (EML) may potentially be applied to improve the overall accuracy of a family of ML models. Unfortunately, EML has several disadvantages, including the need for continuous training, excessive computational resources, requirement for large training datasets, high risks of overfitting, and a time-consuming model-building process. In this paper, we propose a novel cloud methodology for automatic ML model selection and tuning that automates model building and selection and is competitive with existing methods. We use unsupervised learning to better explore the data space before the generation of targeted supervised learning models in an automated fashion. In particular, we create a Cloud DevOps architecture for autotuning and selection based on container orchestration and messaging between containers, and take advantage of a new autoscaling method to dynamically create and evaluate instantiations of ML algorithms. The proposed methodology and tool are demonstrated on cloud network security datasets.

Serverless or functions as a service runtimes have shown significant benefits to efficiency and cost for event-driven cloud applications. Although serverless runtimes are limited to applications requiring lightweight computation and memory, such as machine learning prediction and inference, they have shown improvements on these applications beyond other cloud runtimes. Training deep learning can be both compute and memory intensive. We investigate the use of serverless runtimes while leveraging data parallelism for large models, show the challenges and limitations due to the tightly coupled nature of such models, and propose modifications to the underlying runtime implementations that would mitigate them. For hyperparameter optimization of smaller deep learning models, we show that serverless runtimes can provide significant benefit.

With technology scaling and complexity, better error detection and correction mechanisms within chips and systems are becoming increasingly important in order to provide sufficient protection against both soft and hard errors. Verifying the correctness of error detection circuits and ensuring they provide enough design coverage is a hard problem which usually involves substantial amount of manual work. This problem is even more challenging in the presence of different design methodologies, such as with the inclusion of third party IP blocks where functional descriptions of logic designs may not be available. This paper addresses the problem by proposing a completely automated RTL-based verification flow for error detection and correction circuits. Several related challenges are solved: first, that of identification of potential error detection circuits in logic designs where no functional description or methodology hints are given. Second, identification of structures of the latches that are potentially protected by such error detection circuits. Third, using formal verification for ensuring that the implemented circuits for resiliency indeed detect all single bit errors in the latches they are intended to cover. The approach is described with parity detection as an example, although it is extensible to other coding methods such as ECC and state orthogonality checking. Novel algorithms are given and results on industrial designs are presented.

The rapid pace of integration, emergence of low power, low cost computing elements, and ubiquitous and ever-increasing bandwidth of connectivity have given rise to data center and cloud infrastructures. These infrastructures are beginning to be used on a massive scale across vast geographic boundaries to provide commercial services to businesses such as banking, enterprise computing, online sales, and data mining and processing for targeted marketing to name a few. Such an infrastructure comprises of thousands of compute and storage nodes that are interconnected by massive network fabrics, each of them having their own hardware and firmware stacks, with layers of software stacks for operating systems, network protocols, schedulers and application programs. The scale of such an infrastructure has made possible service that has been unimaginable only a few years ago, but has the downside of severe losses in case of failure. A system of such scale and risk necessitates methods to (a) proactively anticipate and protect against impending failures, (b) efficiently, transparently and quickly detect, diagnose and correct failures in any software or hardware layer, and (c) be able to automatically adapt itself based on prior failures to prevent future occurrences. Addressing the above reliability challenges is inherently different from the traditional reliability techniques. First, there is a great amount of redundant resources available in the cloud from networking to computing and storage nodes, which opens up many reliability approaches by harvesting these available redundancies. Second, due to the large scale of the system, techniques with high overheads, especially in power, are not acceptable. Consequently, cross layer approaches to optimize the availability and power have gained traction recently. This session will address these challenges in maintaining reliable service with solutions across the hardware/software stacks. The currently available commercial data-center and cloud infrastructures will be reviewed and the relative occurrences of different causalities of failures, the level to which they are anticipated and diagnosed in practice, and their impact on the quality of service and infrastructure design will be discussed. A study on real-time analytics to proactively address failures in a private, secure cloud engaged in domain-specific computations, with streaming inputs received from embedded computing platforms (such as airborne image sources, data streams, or sensors) will be presented next. The session concludes with a discussion on the increased relevance of resiliency features built inside individual systems and components (private cloud) and how the macro public cloud absorbs innovations from this realm.

We present a nonintrusive concurrent error detection (CED) method for protecting the control logic of a contemporary floating-point unit (FPU). The proposed method is based on the observation that control logic errors lead to extensive data path corruption and affect, with high probability, the exponent part of the IEEE-754 floating-point representation. Thus, exponent monitoring can be utilized to detect errors in the control logic of the FPU. Predicting the exponent involves relatively simple operations; therefore, our method incurs significantly lower overhead than the classical approach of duplicating the control logic of the FPU. Indeed, experimental results on the openSPARC T1 processor using SPEC2006FP benchmarks show that as compared to control logic duplication, which incurs an area overhead of 17.9 percent of the FPU size, our method incurs an area overhead of only 5.8 percent yet still achieves detection of over 93 percent of transient errors in the FPU control logic. Moreover, the proposed method offers the ancillary benefit of also detecting 98.1 percent of the data path errors that affect the exponent, which cannot be detected via duplication of control logic. Finally, when combined with a classical residue code-based method for the fraction, our method leads to a complete CED solution for the entire FPU which provides a coverage of 94.1 percent of all errors at an area cost of 16.32 percent of the FPU size.

We present a non-intrusive concurrent error detection (CED) method for protecting the control logic of a contemporary floating point unit (FPU). The proposed method is based on the observation that control logic errors lead to extensive datapath corruption and affect, with high probability, the exponent part of the IEEE 754 floating point representation. Thus, exponent monitoring can be utilized to detect errors in the control logic of the FPU. Predicting the exponent involves relatively simple operations, therefore our method incurs significantly lower overhead than the classical approach of duplicating the control logic of the FPU. Indeed, experimental results on the openSPARC T1 processor show that, as compared to control logic duplication, which incurs an area overhead of 17.9% of the FPU size, our method incurs an area overhead of only 5.8% yet still achieves detection of over 95% of transient errors in the FPU control logic. Moreover, the proposed method offers the ancillary benefit of also detecting 98.1% of datapath errors that affect the exponent, which cannot be detected via duplication of control logic. Finally, when combined with a classical residue code-based method for the fraction, our method leads to a complete CED solution for the entire FPU which provides a coverage of 94.4% of all errors at an area cost of 16.32% of the FPU size.

This paper provides: 1) a very brief motivation and technological trend data to show why hard and soft errors are expected to be of increasing concern in the future; 2) a summary review of chip-level error tolerance practices today-with a brief reference to IBM's POWER6 and POWER7 designs; 3) open research challenges and current solution approaches of promise, based on published literature; and 4) concluding remarks.

Next generation system designs are challenged by multiple "walls": among them, the inter-related impediments offered by power dissipation limits and reliability are particularly difficult ones that all current chip/system design teams are grappling with. In this paper, we first describe the attendant challenges in integrated (multi-dimensional) pre-silicon modeling and the solution approaches being pursued. Later, we focus on leading edge solutions for power, thermal and failure-rate mitigation that have been proposed in our R&D work over the past decade.

A method for statistical fault injection (SFI) into arbitrary latches within a full system hardware-emulated model is validated against particle-beam-accelerated SER testing for a modern microprocessor. As performed on the IBM POWER6 microprocessor, SFI is capable of distinguishing between error handling states associated with the injected bit flip. Methodologies to perform random and targeted fault injection are presented.

We describe an implicit technique for enumerating structural choices in circuit optimization. The restructuring technique relies on the symbolic statements of functional decomposition which explores behavioral equivalence of circuit signals through rewiring and resubstitution. Using rigid, yet practical, formulation a rich variety of restructuring candidates is computed symbolically and applied incrementally to produce circuit changes with predictable structural effects. The restructuring technique is used to obtain much improved delays of the already optimized circuits along with their area savings. It is also applied to analyze benefits of optimizing circuit topology at the early steps of synthesis targeting its routability.

Integrated logic synthesis and physical design (physical synthesis) continues to play a very important role in high performance microprocessor design methodologies. In this paper, we present the integrated physical synthesis timing closure methodology used in the current generation microprocessors. Physical synthesis techniques were aggressively used as part of logic and placement optimizations for performance, power and area. The design turn around times were significantly reduced and timing convergence was consistently acheived.

Routability or wiring congestion in a very large scale integration chip is becoming increasingly important as chip complexity increases. Congestion has a significant impact on performance, yield, and chip area. Although advances in placement algorithms have attempted to alleviate this problem, the inherent structure of the logic netlist has a significant impact on the routability irrespective of the placement algorithm used. Placement algorithms find optimal assignments of locations to the logic and do not have the ability to change the netlist structure. Significant decisions regarding the circuit structure are made early in synthesis during the technology-independent logic-optimization step. Optimizations in this step use literal count as a metric for optimization and do not adequately capture the intrinsic entanglement of the netlist. Two circuits with identical literal counts may have significantly different congestion characteristics after placement. In this paper, we postulate that a property of the network structure called adhesion can make a significant contribution to routing congestion. We then provide a metric to measure this property. We evaluate the utility of adhesion as measured by this metric to estimate and optimize postrouting congestion early in the design flow. A heuristic for measuring adhesion is evaluated as well.

Routability or wiring congestion in a VLSI chip is becoming increasingly important as chip complexity increases. Congestion has a significant impact on performance, yield and chip area. Although advances in placement algorithms have attempted to alleviate this problem, the inherent structure of the logic netlist has a significant impact on the routability irrespective of the placement algorithm used. Placement algorithms find optimal assignment of locations to the logic and do not have the ability to change the netlist structure. Significant decisions regarding the circuit structure are made early in synthesis such as during the technology independent logic optimization step. Optimizations in this step use literal count as a metric for optimization and do not adequately capture the intrinsic entanglement of the netlist. Two circuits with identical literal counts may have significantly different congestion characteristics post placement. In this paper, we motivate that a property of the network structure called adhesion can make a significant contribution to routing congestion. We then provide a metric to measure this property. We also show that adhesion as measured by this metric can be used in addition to literal counts to estimate and optimize post routing congestion early in the design flow.

Article Share on Mixed multi-threshold differential cascode voltage switch (MT-DCVS) circuit styles and strategies for low power VLSI design Authors: W. Chen IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile , W. Hwang IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile , P. Kudva IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile , G. Gristede IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile , S. Kosonocky IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile , R. Joshi IBM T. J. Watson Research Center, Yorktown Heights, NY IBM T. J. Watson Research Center, Yorktown Heights, NYView Profile Authors Info & Claims ISLPED '01: Proceedings of the 2001 international symposium on Low power electronics and designAugust 2001 Pages 263–266https://doi.org/10.1145/383082.383156Online:06 August 2001Publication History 6citation4,358DownloadsMetricsTotal Citations6Total Downloads4,358Last 12 Months3Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my Alerts New Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Novel methodology and algorithms to seamlessly integrate logic synthesis and physical placement through a transformational approach are presented. Contrary to most placement algorithms that minimize a global cost function based on an abstract representation of the design, we decomposed the placement function into a set of transforms and coupled them directly with incremental timing, noise, and/or power analyzers. This coupling results in a direct and more accurate feedback on optimizations for placement actions. These placement transforms are then integrated with traditional logic synthesis transforms leading to a converging set of optimizations based on the concurrent manipulation of boolean, electrical, as well as physical data. Experimental results indicate that the proposed approach creates an efficient converging design flow that eliminates placement and synthesis iteration. It results in timing improvements, and maintains other global placement measures such as wire congestion and wire length. The flexibility of the transformational approach allows us to easily add, extend and support more sophisticated algorithms that involve critical as well as non-critical regions and target a variety of metrics including noise, yield and manufacturability:.

A novel technique to significantly improve the performance of a design by the movement of sets of gates during or after timing driven placement is proposed. A method to identify optimal set of circuit (gate) movements to enhance timing is presented. Experimental results with a min-cut placement tool indicate that the proposed approach of direct manipulation of circuit locations, significantly improves the timing of large partitions of a chip.

Most high-level synthesis tools for asynchronous circuits take descriptions in concurrent hardware description languages and generate networks of macromodules or handshake components. In this paper, we propose a peephole optimizer for these networks. Our peephole optimizer first deduces an equivalent blackbox behavior for the network using Dill's trace-theoretic parallel composition operator. It then applies a new procedure called burst-mode reduction to obtain burst-mode machines from the deduced behavior. In a significant number of examples, our optimizer achieves gate-count improvements by a factor of five, and speed (cycle-time) improvements by a factor of two. Burst-mode reduction can be applied to any macromodule network that is delay insensitive as well as deterministic. A significant number of asynchronous circuits, especially those generated by asynchronous high-level synthesis tools, fall into this class, thus making our procedure widely applicable.

This paper presents an algorithm to select a good set of gate sizes for the primitive gates of a standard cell library. A measurement error on a gate is dened to quantify the discrepancy resulting from replacing the size required by a synthesis sizing algorithm with a size available in a discrete cell library. The criterion for gate size selection is a set of gate sizes that minimizes the cumulative error of a prescribed measurement. Optimal solutions to the gate size selection problem targetting size and delay measurements are presented for cases when the probability distribution and the delay equations are simple. A realistic probability distribution is obtained using a sample space of gates derived fromagroup of designs that is synthesized under the semi-custom synthesis methodology [1]. A \\delay-match " (minimizing delay error) and a \\sizematch" (minimizing size error) set of gate sizes are obtained numerically, and are subsequently realized as discrete cell libraries. The previous group of designs are synthesized using the two selected cell libraries and two other cell libraries, one with \\equal-spacing " of cell sizes and the other with \\exponential-spacing " of cell sizes. The \\size-match " library gives the best overall slack and area results. 1

The matrix transposition operation is a necessary step in several image/video compression and decompression algorithms, in particular the discrete cosine transform (DCT) and its inverse (IDCT), and some distributed arithmetic applications. These algorithms have to be performed at high data-rates, and with a minimum of power dissipation for portable applications. The authors describe how the clocked solution is usually implemented, and present two new asynchronous architectures that perform matrix transposition. These architectures, one based on two phase signaling, one based on four phase signaling, have better characteristics than the clocked solution in terms of latency and power, at no cost in area or throughput. They discuss the characteristics of these three architectures and evaluate the relative advantages of each one.

Article Free Access Share on A technique for synthesizing distributed burst-mode circuits Authors: Prabhakar Kudva IBM T. J. Watson Research Center, Yorktown Heights IBM T. J. Watson Research Center, Yorktown HeightsView Profile , Ganesh Gopalakrishnan Department of Computer Science, University of Utah Department of Computer Science, University of UtahView Profile , Hans Jacobson Department of Computer Science, University of Utah Department of Computer Science, University of UtahView Profile Authors Info & Claims DAC '96: Proceedings of the 33rd annual Design Automation ConferenceJune 1996 Pages 67–70https://doi.org/10.1145/240518.240532Published:01 June 1996Publication History 13citation201DownloadsMetricsTotal Citations13Total Downloads201Last 12 Months11Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

This paper addresses the problem of realizing hazard-free singleoutput Boolean functions through a network of customized complex CMOS gates tailored to a given asynchronous controller specification.A customized CMOS gate network can either be a single CMOS gate or a multilevel network of CMOS gates.It is shown that hazard-free requirements for such networks are less restrictive than for simple gate networks.Analysis and efficient synthesis methods to generate such networks under a multiple-input change assumption (MIC) will be presented.

Most high level synthesis tools for asynchronous circuits take descriptions in concurrent hardware description languages and generate networks of macromodules or handshake components. In this paper we describe a peephole optimizer for such macromodule networks that often effects area and/or time improvements. Our optimizer first deduces an equivalent black-box behavior for the given network of macromodules using Dill's trace-theoretic parallel composition operator. It then applies a new procedure called burst-mode reduction to obtain burst-mode machines, which can be synthesized into gate networks using available tools. Since burst-mode reduction can be applied to any macromodule network that is delay-insensitive as well as deterministic, our optimizer covers a significant number of asynchronous circuits, especially those generated by asynchronous high level synthesis tools.>

Asynchronous/self-timed circuits are beginning to attract renewed attention as a promising means of dealing with the complexity of modern VLSI designs. Very few analysis techniques or tools are available for estimating their performance. We adapt the theory of generalized timed Petri-nets (GTPN) for analyzing and comparing asynchronous circuits ranging from purely control-oriented circuits to those with data dependent control. Experiments with the GTPN analyzer are found to track the observed performance of actual asynchronous circuits, thereby offering empirical evidence towards the soundness of the modeling approach.>

An adaptive control scheme for the tip position control of a single-link flexible manipulator handling unknown changing loads and its experimental verification are presented. The scheme essentially comprises a least-squares identification algorithm and a self-tuning pole-placement controller. The controller uses a novel recursive algorithm which constrains the control signal not to respond immediately to any sudden changes in the control gains due to changes in the parameter estimate vector. Another salient feature of the present work is the observation of a 'ringing effect' transient during payload release and its resolution. This was achieved by a resetting of the parameter estimate vector to its no-load value, prior to payload release. A performance comparison of the new adaptive control with a constant-gain pole placement controller as well as a standard self-tuning pole placement controller clearly demonstrates its superior ability in handling unknown changing loads.>

General schemes for the adaptive control and identification of multivariable systems whose entire state vectors are accessible for measurement are developed. A model reference approach is used here, and Lyapunov's direct method is employed to ensure the convergence of these schemes. An added feature is the simplicity of the stable adaptive laws, which depend explicitly on the state variables of the plant and a model, and on the plant input. Computer simulation results of several examples are included to illustrate the effectiveness of the proposed schemes.

The extension of some of the results contained in Part I [1] to the case when only the plant outputs rather than all its state variables are accessible for measurement is discussed. A unified approach to the synthesis of an adaptive observer is presented whereby the plant state and parameters are simultaneously estimated. Uniform asymptotic stability of the scheme is proved using Lyapunov's direct method. The information provided by the adaptive observer is used to synthesize an adaptive controller for the plant. While all the principal results obtained here are for the case of a single-input single-output plant, extensions to special classes of multivariable systems is indicated.