| Patent application number | Description | Published |
|---|
| 20090016234 | METHODS AND APPARATUS FOR DETECTION OF HIERARCHICAL HEAVY HITTERS - An efficient streaming method and apparatus for detecting hierarchical heavy hitters from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks. | 01-15-2009 |
| 20090073891 | METHODS AND APPARATUS FOR SPACE EFFICIENT ADAPTIVE DETECTION OF MULTIDIMENSIONAL HIERARCHICAL HEAVY HITTERS - The present invention develops an efficient streaming method for detecting multidimensional hierarchical heavy hitters from massive data streams and enables near real time detection of anomaly behavior in networks. | 03-19-2009 |
| 20090161570 | OPTIMAL COMBINATION OF SAMPLED MEASUREMENTS - Two regularized estimators that avoid the pathologies associated with variance estimation are disclosed. The regularized variance estimator adds a contribution to estimated variance representing the likely error, and hence ameliorates the pathologies of estimating small variances while at the same time allowing more reliable estimates to be balanced in the convex combination estimator. The bounded variance estimator employs an upper bound to the variance which avoids estimation pathologies when sampling probabilities are very small. | 06-25-2009 |
| 20090254638 | Topology Aware Content Delivery Network - A method of assigning a server to a client system includes determining an ingress point of the client system and identifying possible egress points for the client system. The method further includes selecting the server from a plurality of servers to reduce network cost and delivery time. | 10-08-2009 |
| 20090303879 | Algorithms and Estimators for Summarization of Unaggregated Data Streams - The invention relates to streaming algorithms useful for obtaining summaries over unaggregated packet streams and for providing unbiased estimators for characteristics, such as, the amount of traffic that belongs to a specified subpopulation of flows. Packets are sampled from a packet stream and aggregated into flows and counted by implementation of: (a) Adaptive Sampled NetFlow ( | 12-10-2009 |
| 20090303901 | Algorithms and Estimators for Summarization of Unaggregated Data Streams - The invention relates to streaming algorithms useful for obtaining summaries over unaggregated packet streams and for providing unbiased estimators for characteristics, such as, the amount of traffic that belongs to a specified subpopulation of flows. Packets are sampled from a packet stream and aggregated into flows and counted by implementation of Adaptive Sample-and-Hold ( | 12-10-2009 |
| 20090316590 | Sampling and Analyzing Packets in a Network - The preferred embodiments of the present invention can include sampling packets transmitted over a network based on the content of the packets. If a packet is sampled, the sampling unit can add one or more fields to the sampled packet that can include a field for a number of bytes contained in the packet, a packet count, a flow count, a sampling type, and the like. The sampled packets can be analyzed to discern desired information from the packets. The additional fields that are added to the sampled packets can be used during the analysis. | 12-24-2009 |
| 20100138529 | Variance-Optimal Sampling-Based Estimation of Subset Sums - The present invention relates to a method of obtaining a generic sample of an input stream. The method is designated as VAR | 06-03-2010 |
| 20100146100 | Flexible Application Classification - A system includes an information storage module and an inspection module. The information storage module is configured to store a plurality of tags. Each tag is associated with a known set of traffic types of a plurality of known sets of traffic types. The inspection module is configured to compare a traffic flow to a set of traffic types to determine a matching set of traffic types, request a tag from the information storage module, and mark the traffic flow with the tag. The tag corresponds to the matching set of traffic types. | 06-10-2010 |
| 20100150004 | METHODS AND APPARATUS TO BOUND NETWORK TRAFFIC ESTIMATION ERROR FOR MULTISTAGE MEASUREMENT SAMPLING AND AGGREGATION - Methods and apparatus to bound network traffic estimation error for multistage measurement sampling and aggregation are disclosed. An example method disclosed herein comprises determining a hierarchical sampling topology representative of multiple data sampling and aggregation stages, the hierarchical sampling topology comprising a plurality of nodes connected by a plurality of edges, each node corresponding to at least one of a data source and a data aggregation operation, and each edge corresponding to a data sampling operation characterized by a generalized sampling threshold, selecting a first generalized sampling threshold from a set of generalized sampling thresholds associated with a respective set of edges originating at a respective set of descendent nodes of a target node undergoing network traffic estimation, and transforming a measured sample of network traffic into a confidence interval for a network traffic estimate associated with the target node using the first generalized sampling threshold and an error parameter. | 06-17-2010 |
| 20100150005 | SYSTEM AND METHOD FOR DETERMINATION OF ROUTING INFORMATION IN A NETWORK - A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network. | 06-17-2010 |
| 20100157809 | SYSTEM AND METHOD FOR SPATIALLY CONSISTENT SAMPLING OF FLOW RECORDS AT CONSTRAINED, CONTENT-DEPENDENT RATES - Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a desired quantity of flow record to sample, receiving a plurality of network flow record each summarizing a network flow of packets, calculating a hash for each flow record of based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, generating a priority from the calculated hash for each respective flow record, and sampling exactly the desired quantity of flow records, selecting flow records having a highest priority first. In one aspect, the method further partitions the plurality of flow records into groups based on flow origin and destination, generates an individual priority for each partitioned group, and separately samples exactly the desired quantity of flow records from each partitioned group, selecting flows having a highest individual priority first. | 06-24-2010 |
| 20100161791 | SYSTEM AND METHOD FOR SAMPLING NETWORK TRAFFIC - Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value. | 06-24-2010 |
| 20110013525 | Indirect measurement methodology to infer routing changes using statistics of flow arrival processes - Statistical methods are used to observe packet flow arrival processes and to infer routing changes from those observations. Packet flow arrivals are monitored using NetFlow or another packet flow monitoring arrangement. Packet flow arrivals are quantified by counting arrivals per unit time, or by measuring an inter-arrival time between flows. When a change in packet flow arrivals is determined to be statistically significant, a change in network routing protocol is reported. | 01-20-2011 |
| 20110072127 | Network Aware Application Management - A method of managing a network application includes identifying a network path for the network application, obtaining network performance measurements along the network path, obtaining application performance information for the network application, and extracting infrastructure specific information for the infrastructure supporting the network application. The method further includes correlating the application performance information, network performance measurements, and the infrastructure specific information to identify a performance issue affecting the network application, and modifying the application behavior, the network behavior, or any combination thereof in response to the performance issue. | 03-24-2011 |
| 20110122792 | METHODS AND APPARATUS FOR DETECTION OF HIERARCHICAL HEAVY HITTERS - An efficient streaming method and apparatus for detecting hierarchical heavy hitters from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks. | 05-26-2011 |
| 20110134768 | NETWORK ANALYSIS USING NETWORK EVENT DATA - A system that incorporates teachings of the present disclosure may include, for example, network device having a controller to combine network data sources enabling simplified database queries across a plurality of data sources, normalize the data from the plurality of data sources, continuously collect routing information between two routers of interest, selectively and automatically extract network data involving network events and routing, determine a temporal correlation among identified network events, determine a spatial correlation among identified network events, and troubleshoot an interactive media service based on a combination of the temporal correlation and the spatial correlation determined between the defined edge routers. Other embodiments are disclosed. | 06-09-2011 |
| 20110153554 | Method for summarizing data in unaggregated data streams - A method for producing a summary A of data points in an unaggregated data stream wherein the data points are in the form of weighted keys (a, w) where a is a key and w is a weight, and the summary is a sample of k keys a with adjusted weights w | 06-23-2011 |
