Abstract:
A network testing method implemented in a software-defined network (SDN) is disclosed. The network testing method comprising providing a test scenario including one or more network events, injecting said one or more network events to the SDN using an SDN controller, and gathering network traffic statistics. A network testing apparatus used in a software-defined network (SDN) also is disclosed. The network testing apparatus comprising a testing system to provide a test scenario including one or more network events, to inject said one or more network events to the SDN using an SDN controller, and to gather network traffic statistics. Other methods, apparatuses, and systems also are disclosed.
Abstract:
A method implemented in a network apparatus used in a network is disclosed. The method comprises collecting information about network topology from a network controller, collecting information about data movement, deciding routing in the network according to the information about network topology and the information about data movement, and providing information about the routing to the network controller, wherein the network controller enforces the routing in the network. Other methods, apparatuses, and systems also are disclosed.
Abstract:
A method for system metric prediction and influential events identification by concurrently employing metric logs and event logs is presented. The method includes concurrently modeling multivariate metric series and individual events in event series by a multi-stream recurrent neural network (RNN) to improve prediction of future metrics, where the multi-stream RNN includes a series of RNNs, one RNN for each metric and one RNN for each event sequence and modeling causality relations between the multivariate metric series and the individual events in the event series by employing an attention mechanism to identify target events most responsible for fluctuations of one or more target metrics.
Abstract:
Methods and systems of training and using a neural network model include training a time series embedding model and a text embedding model with unsupervised clustering to translate time series and text, respectively, to a shared latent space. The time series embedding model and the text embedding model are further trained using semi-supervised clustering that samples training data pairs of time series information and associated text for annotation.
Abstract:
Methods and systems for training a neural network include collecting model exemplar information from edge devices, each model exemplar having been trained using information local to the respective edge devices. The collected model exemplar information is aggregated together using federated averaging. Global model exemplars are trained using federated constrained clustering. The trained global exemplars are transmitted to respective edge devices.
Abstract:
A method is provided. Intermediate audio features are generated from respective segments of an input acoustic time series for a same scene. Using a nearest neighbor search, respective segments of the input acoustic time series are classified based on the intermediate audio features to generate a final intermediate feature as a classification for the input acoustic time series. Each respective segment corresponds to a respective different acoustic window. The generating step includes learning the intermediate audio features from Multi-Frequency Cepstral Component (MFCC) features extracted from the input acoustic time series, dividing the same scene into the different windows having varying MFCC features, and feeding the MFCC features of each window into respective LSTM units such that a hidden state of each respective LSTM unit is passed through an attention layer to identify feature correlations between hidden states at different time steps corresponding to different ones of the different windows.
Abstract:
Systems and methods for preventing cyberattacks using a Density Estimation Network (DEN) for unsupervised anomaly detection, including constructing the DEN using acquired network traffic data by performing end-to-end training. The training includes generating low-dimensional vector representations of the network traffic data by performing dimensionality reduction of the network traffic data, predicting mixture membership distribution parameters for each of the low-dimensional representations by performing density estimation using a Gaussian Mixture Model (GMM) framework, and formulating an objective function to estimate an energy and determine a density level of the low-dimensional representations for anomaly detection, with an anomaly being identified when the energy exceeds a pre-defined threshold. Cyberattacks are prevented by blocking transmission of network flows with identified anomalies by directly filtering out the flows using a network traffic monitor.
Abstract:
A system for cross-modal data retrieval is provided which includes a neural network having a time series encoder and text encoder jointly trained based on a triplet loss relating to two different modalities of (i) time series and (ii) free-form text comments. A database stores training sets with feature vectors extracted from encodings of the training sets. The encodings are obtained by encoding the time series using the time series encoder and encoding the text comments using the text encoder. A processor retrieves the feature vectors corresponding to at least one of the modalities from the database for insertion into a feature space together with a feature vector corresponding to a testing input relating to at least one of a testing time series and a testing free-form text comment, determines a set of nearest neighbors from among the feature vectors based on distance criteria, and outputs testing results.
Abstract:
Methods and systems for mitigating a spoofing-based attack include calculating a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live information from the received packet. An expected travel distance between the source IP address and the target IP address is estimated based on a sparse set of known source/target distances. It is determined that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security action is performed responsive to the determination that the received packet has a spoofed source IP address.
Abstract:
A computer implemented method for network monitoring includes providing network packet event characterization and analysis for network monitoring that includes supporting summarization and characterization of network packet traces collected across multiple processing elements of different types in a virtual network, including a trace slicing to organize individual packet events into path-based trace slices, a trace characterization to extract at least 2 types of feature matrix describing those trace slices, and a trace analysis to cluster, rank and query packet traces based on metrics of the feature matrix.