International Business Machines Corporation

Andreas Kind

Clark Debs Jeffries

Patrick Droz

Paul T Hurley

Michael Steven Siegel

Marco C Heddes

Marc Philippe Stoecklin

Brahmanand Kumar Gorti

Bernhard Jansen

Marc Stoecklin

Ilias Iliadis

Joseph Franklin Logan

Thomas R Locher

Brian E Carpenter

Xenofontas Dimitropoulos

Yu Zhang

Roman Alexander Pletka

Lin Y Yang

Ioannis Koltsidas

Robert Haas

Jan Van Lunteren

Elli Androulaki

Tao Yu

Ke Wei Sun

Daniel Nikolaus Bauer

Michail Vlachos

Tian Cheng Liu

Francesco Fusco

Bernard Metzler

Marc Ph Stoecklin

Xiao Zhong

Peini Liu

Olaf W Zimmermann

Soenke V Mannal

Hoyt Edwin Bowen, Jr

Lukas Kencl

Zhang Yu

Jeroen Massar

Dimitrios Dechouniotis

Christos-Xenofontas Dimitropoulos

Ed Bowen

Soenke Mannal

A user computing device generates a token while the user computing device is in an offline mode and not connected to an external network. The token includes information of an amount of cryptocurrency to be transferred from a user account to a receiving account and information of a first password for enabling the transfer. The token is signed by the user computing device with a private key while in the offline mode and the signed token is stored by the user computing device on a portable device. A receiving device receiving the signed token from the portable user storage device, authenticates a user corresponding to the user account based on the signed token, receives a second password, compares the first and second passwords for enabling the transfer, and transfers the amount of cryptocurrency from the user account to the receiving account based on the information included in the token.

Network system and method for transferring cryptocurrencies between a user account and a receiving account

A method and apparatus for managing remote devices. In one embodiment of the present invention, there is provided a method of managing a remote device, comprising: obtaining a first identifier based on a name sequence in state information of the remote device, the first identifier being for indicating a template that provides the state information; obtaining a second identifier based on a numerical value sequence in the state information; sending a state access notification that comprises at least the first identifier and the second identifier; and providing the state information based on the first identifier and the second identifier in response to having received a result of activating the state access notification. In one embodiment of the present invention, there is provided an apparatus for managing a remote device.

Managing remote devices

Network flow records from various administrative domains are provided to a network monitoring entity. The network monitoring entity analyzes the network flow records in a way to locate a source of malicious network flow.

Operating a network monitoring entity

Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising one of the source and destination IP addresses for the flow and one of (a) the other of the source and destination IP addresses and (b) direction data indicative of the flow direction across the network boundary. A tree data structure is generated representing the IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with at least one node in common. Weights are assigned to nodes in the tree in dependence on occurrences of the represented IP addresses in at least a subset of the flow data. The IP address range of the network is then detected by identifying, in dependence on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to permit distinction between IP addresses inside and outside the network in operation of the device, e.g. for filtering or traffic classification.

Automatic address range detection for IP networks

Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising the source or destination IP addresses for the flow and one of: the other of the source or destination IP addresses; or direction data identifying the flow direction across the network boundary. A tree is generated representing IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with a node in common. Weights are assigned to nodes in the tree based on occurrences of the represented IP addresses in the flow data. The IP address range of the network is detected by identifying, based on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to differentiate IP addresses inside and outside the network.

A data traffic monitor for determining a heavy distinct hitter (HDH) in a data stream, the data stream comprising a plurality of element-value (e,v) pairs, includes a HDH module, the HDH module configured to receive the plurality of (e,v) pairs from the data stream; and a counter block in communication with the HDH module, the counter block comprising a plurality of hash functions, and further comprising a respective pair of distinct counting primitives associated with each hash function of the plurality of hash functions, wherein each of the plurality of (e,v) pairs is added to one of the distinct counting primitives of the respective pair of distinct counting primitives for each of the plurality of hash functions in each of the plurality of counter blocks.

Determining heavy distinct hitters in a data stream

An apparatus and method for analyzing a network flow. The apparatus includes a parser for extracting flow identification information from the network flow, a flow metering unit, and a programmable controller. The parser and flow metering unit are controlled in parallel by the programmable controller, the programmable controller is implemented as state machine, and the state machine includes a transition rule memory, a rule selector, and a state register. The rule selector is configured for receiving an external input signal and an internal input signal from the state register. The rule selector is also configured for observing the internal and external input signal via the transition rule memory.

Apparatus and method for analyzing a network

A method for providing a compressed index for a stream of binary data records comprises steps of indexing a field from each record in a bitmap index, compressing stored bits in each column of the bitmap index by replacing a group of successive bits with a code and outputting the code. There is provided at least one of a first code for replacing a sequence of a first filling, a literal and a second filling, and a second code for replacing a sequence of a first literal, a filling and a second literal. In this context, a filling is a sequence of bits with the same value and a literal is a sequence of bits with different values.

Network analysis

A method for determining a heavy distinct hitter (HDH) in a data stream by a data traffic monitor, the data stream comprising a plurality of element-value (e,v) pairs, includes receiving the plurality of (e,v) pairs from the data stream by an HDH module in the data traffic monitor, the HDH module being in communication with a counter block, the counter block comprising a plurality of hash functions, and further comprising a respective pair of distinct counting primitives associated with each hash function of the plurality of hash functions; and adding each of the plurality of (e,v) pairs to one of the distinct counting primitives of the respective pair of distinct counting primitives for each of the plurality of hash functions in the counter block.

The present invention provides a system and method for time-series with compression accuracy as a function of time. Briefly described, in architecture, one embodiment of the system, among others, can be implemented as follows. The system includes a computer with a processor. The system performs a method receiving a data set on the computer, utilizing a plurality of filter banks to transform the data set into a plurality coefficients, wherein each coefficient is associated with a basis function, and quantizing the plurality of coefficients, wherein the quantization maps the plurality of coefficients into certain value ranges. Then, system further performs determining a threshold based upon each coefficient effect on a time domain, disregarding the coefficient that fall below the threshold, and storing any remaining coefficients as compressed data for the data set.

Apparatus and method for time-series storage with compression accuracy as a function of time

A method and system for managing asynchronous transfer mode (ATM) traffic in a computer system is disclosed. The computer system is used in sending, receiving, or sending and receiving a plurality of ATM flows. Each ATM flow has a plurality of ATM cells, a minimum ATM bandwidth guarantee, and a maximum ATM bandwidth. The method and system include determining whether excess bandwidth exists for the ATM flows. The method and system also include gracefully increasing a portion of the ATM cells transmitted for each ATM flow during periods of excess bandwidth. The portion of the ATM cells transmitted is not more than the maximum ATM bandwidth limit. If an ATM flow presents a sufficient offered load, the portion of the ATM cells transmitted in the flow is not less than a minimum ATM bandwidth guarantee.

Controlling ATM traffic using bandwidth allocation technology

A method for managing attacks in a computer system is disclosed. The computer system is used in sending, receiving, or sending and receiving a plurality of packets, which include a plurality of administrative packets. The method includes determining whether a congestion of the administrative packets exists. Congestion of the administrative packets indicates that a potential attack exists. The method also includes discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists. The portion of the plurality of packets is sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee.

Method for managing of denial of service attacks using bandwidth allocation technology

Methods, systems and computer program products for detecting flow-level network traffic anomalies via abstraction levels. An exemplary embodiment includes a method for detecting flow-level network traffic anomalies in a computer network, the method including obtaining current distributions of flow level traffic features within the computer network, computing distances of the current distributions' components from a distributions model, comparing the distances of the current distributions to distance baselines from the distributions model, determining if the distances are above a pre-determined thresholds and in response to one or more of the distances being above the pre-determined thresholds in one or more distributions, identifying the current condition to be abnormal and providing indications to its nature.

Methods, systems and computer program products for detecting flow-level network traffic anomalies via abstraction levels

For determining a malicious workload pattern, the following steps are conducted. A training set of workload patterns is collected during a predetermined workload situation. A subset of the training set is being determined as an archetype set, the archetype set being considered to be representative of the predetermined workload situation. A threshold value dependent on the training set and the archetype set, and an evaluation value dependent on a given workload pattern and the archetype set are calculated. The given workload pattern is determined to be malicious if the evaluation value fulfils a given condition with respect to the threshold value.

Method, device and computer program product for determining a malicious workload pattern

A method for probabilistic lossy counting includes: for each element in a current window, determining whether an entry corresponding to a current element is present in a table; in the event an entry corresponding to the current element is present in the table, incrementing a frequency counter associated with the current element; otherwise, inserting an entry into a table, wherein inserting an entry comprises: calculating a probabilistic error bound &#x394; based on an index i of the current window; and inserting the probabilistic error bound &#x394; and a frequency counter into an entry corresponding to the current element in the table; and at the end of the current window, removing all elements from the table wherein the sum of the frequency counter and probabilistic error bound &#x394; associated with the element is less than or equal to the index of the current window.

Growing community of inventors

Kilchberg, Switzerland

Andreas Kind