Abstract:
A method that accepts a data file, iteratively tests different information units as record delimiters and field delimiters, and chooses as the data files record delimiter, R, and field delimiter, F, the information units that result in the lowest generalized entropy that is computed on fields created by use of the chosen delimiter pair R,F.
Abstract:
Certain exemplary embodiments provide a method that can comprise establishing a tunnel between a monitor and at least one router; sending a message to join a multicast transmission; and/or transmitting a packet via the tunnel to a router. The packet can comprise a source address of the network monitor and a destination address comprising a multicast address.
Abstract:
A packet loss estimation technique is disclosed that utilizes the sampled flow level statistics that are routinely collected in operational networks, thereby obviating the need for any new router features or measurement infrastructure. The technique is specifically designed to handle the challenges of sampled flow-level aggregation such as information loss resulting from packet sampling, and generally comprises: receiving a first record of sampled packets for a flow from a first network element; receiving a second record of sampled packets for the flow from a second network element communicating with the first network element; correlating sampled packets from the flow at the first network element and the second network element to a measurement interval; and estimating the packet loss using a count of the sampled packets correlated to the measurement interval.
Abstract:
An efficient streaming method and apparatus for detecting hierarchical heavy hitters from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks.
Abstract:
A system for protecting a network from a traffic surge includes a data collection module, an allocation module, and a traffic flow module. The data collection module is configured to obtain network utilization information for a plurality of traffic flows. The allocation module is configured to determine a bandwidth allocation to minimize a drop probability for the plurality of traffic flows. The traffic flow module is configured to preferentially drop network packets for a traffic flow exceeding the optimal bandwidth allocation.
Abstract:
Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value.
Abstract:
A method and apparatus for inferring if an IP address allocation in a remote network is static or dynamic are disclosed. For example, the method contacts at least one remote peer to peer endpoint using a peer to peer application to obtain an IP address of the at least one remote peer to peer endpoint. The method then analyzes characteristics of the at least one remote peer to peer endpoint over a predefined period of time to infer whether the presence of static IP address allocation exists for the at least one remote peer to peer endpoint.
Abstract:
A signature-based traffic classification method maps traffic into preselected classes of service (CoS). By analyzing a known corpus of data that clearly belongs to identified ones of the preselected classes of service, in a training session the method develops statistics about a chosen set of traffic features. In an analysis session, relative to traffic of the network where QoS treatments are desired (target network), the method obtains statistical information relative to the same chosen set of features for values of one or more predetermined traffic attributes that are associated with connections that are analyzed in the analysis session, yielding a statistical features signature of each of the values of the one ore more attributes. A classification process then establishes a mapping between values of the one or more predetermined traffic attributes and the preselected classes of service, leading to the establishment of QoS treatment rules.
Abstract:
A method and apparatus for creating one or more router configurations in a network are disclosed. For example, the method receives a request to create a router configuration, and retrieves automatically one or more templates in response to the request. The method then instantiates the router configuration by applying the one or more templates.
Abstract:
The present invention develops an efficient streaming method for detecting multidimensional hierarchical heavy hitters from massive data streams and enables near real time detection of anomaly behavior in networks.