At&t Intellectual Property I, L.p.

Princeton University

Dan Pei

Alexandre Gerber

Jia Wang

Lusheng Ji

Zihui Ge

He Yan

Ashley Flavel

Hiren Shah

Jennifer Yates

Oliver Spatscheck

Jeffrey Erman

Mohammad Taghi Hajiaghayi

Tongqing Qiu

Jacobus Erasmus Van Der Merwe

Thomas Bradley Scholl

Aman M Shaikh

Walter Willinger

Alex Snoeren

Ricardo Oliveira

Patrick Verkaik

Subhabrata Bapi Sen

Changhoon Kim

Zhuoqing Morley Mao

Carsten Lund

Ying Zhang

Beichuan Zhang

Tongquing Qiu

Lixia Zhang

Tonqing Qiu

MohammadTaghi Hajiaghayi

Example methods disclosed herein to prioritize anomalies in a communication network include classifying respective nodes in the communication network as normal, abnormal or indeterminate based on measurements received for the nodes. Disclosed example methods also include selecting a subset of the nodes classified as abnormal to be root cause abnormal nodes representing sources of the anomalies in the communication network, respective ones of the root cause abnormal nodes being abnormal nodes identified in the communication network and determined to have respective sets of direct descendent nodes having majorities of nodes classified as abnormal or indeterminate. Disclosed example methods further include combining respective anomaly sizes and anomaly scopes determined for the respective ones of root cause abnormal nodes based on the measurements to determine respective rankings for the root cause abnormal nodes, and outputting the respective rankings to prioritize the set of root cause abnormal nodes.

Hierarchical anomaly localization and prioritization

A method of placing prefix hijacking detection modules in a communications network includes selecting a set of candidate locations. For each candidate location, a detection coverage ratio with respect to a target Autonomous System is calculated. Based on the relative size of the coverage ratios, proposed locations for the prefix hijacking detection modules are determined.

Prefix hijacking detection device and methods thereof

Example methods disclosed herein to localize anomalies in a communication network include identifying a first set of abnormal nodes in the communication network, and including respective ones of the first set of abnormal nodes having a number of normal direct descendent nodes that is less than a combined number of abnormal direct descendent nodes and indeterminate direct descendent nodes in a set of candidate nodes. Such disclosed example methods also include iteratively selecting ones of the set of candidate nodes to include in a set of root cause abnormal nodes representing sources of the anomalies in the communication network. In such disclosed example methods, the ones of the set of candidate nodes are selected based on sizes of respective subsets of the abnormal nodes from the first set of abnormal nodes covered by the candidate nodes.

A technique for monitoring performance in a network uses passively monitored traffic data at the server access routers. The technique aggregates performance metrics into clusters according to a spatial hierarchy in the network, and then aggregates performance metrics within spatial clusters to form time series of temporal bins. Representative values from the temporal bins are then analyzed using an enhanced Holt-Winters exponential smoothing algorithm.

Passive and comprehensive hierarchical anomaly detection system and method

Method, system and computer-readable device to locate a prefix hijacker of a destination prefix within a one-hop neighborhood. The method includes generating one-hop neighborhoods from autonomous system-level paths associated with a plurality of monitors to a destination prefix. The method also includes determining a suspect set of autonomous system identifiers resulting from a union of the one-hop neighborhoods. The method further includes calculating a count and a distance associated with each autonomous system identifier in the suspect set of autonomous system identifiers. The count represents how often an autonomous system identifier appears in the one-hop neighborhoods. The distance represents a total number of autonomous system identifiers from the autonomous system identifier to autonomous system identifiers associated with the plurality of monitors. Yet further, the method includes generating a one-hop suspect set including autonomous system identifiers in the suspect set that have a greatest sum of the count and the distance.

System and method to locate a prefix hijacker within a one-hop neighborhood

Methods, apparatus and articles of manufacture for hierarchical anomaly localization and prioritization are disclosed. An example method disclosed herein comprises obtaining reported status for a plurality of nodes of a hierarchical topology, the reported status for a particular node being at least one of normal, abnormal or indeterminate, and determining a subset of root cause abnormal nodes, a root cause abnormal node included in the subset of root cause abnormal nodes having a total number of abnormal direct descendent nodes and indeterminate direct descendent nodes that is greater than a number of normal direct descendent nodes of the root cause abnormal node.

A communication network is operated by identifying at least one potential hijack autonomous system (AS) that can be used to generate a corrupt routing path from a source AS to a destination AS. For each of the at least one potential hijack AS the following operations are performed: identifying at least one regional AS that is configured to adopt the corrupt routing path from the source AS to the destination AS and determining a reflector AS set such that, for each reflector AS in the set, a source AS to reflector AS routing path and a reflector AS to destination AS routing path do not comprise any of the at least one regional AS. A reflector AS is then identified that is common among the at least one reflector AS set responsive to performing the identifying and determining operations for each, of the at least one potential hijack AS.

Methods, systems, and computer program products for protecting against IP prefix hijacking

Example methods, apparatus and articles of manufacture to perform root cause analysis for network events are disclosed. An example method includes retrieving a symptom event instance from a normalized set of data sources based on a symptom event definition; generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules.

Methods, apparatus and articles of manufacture to perform root cause analysis for network events

A network includes a cache server and a network aware server that operates to determine an optimization between a cost of retrieving content from a communication network and a cost of caching content at the cache server. The optimization is determined as a minimum of a sum of a transit cost, a backbone cost, and a caching cost. The transit cost includes a money cost per data unit. The backbone cost includes a money cost per data unit and time unit. The caching cost includes a money cost per server unit. In response to determining the optimization, the network aware server sends a content identifier to the cache server, and the cache server receives the content identifier, determines a source of a content item, and if the source is the same as the content identifier, then cache the content item.

Network aware forward caching

Certain exemplary embodiments can provide a method, which can comprise, based upon a quantified completeness of a determined topology of an interconnected set of Autonomous Systems of the Internet, at a user interface of an information device, automatically rendering a determined identity of a customer to which telecommunications products will be offered.

Devices, systems, and/or methods for determining internet topology

Method, system and computer-readable medium to locate a prefix hijacker of a destination prefix within a one-hop neighborhood on a network. The method includes generating one-hop neighborhoods from autonomous system (AS)-level paths of plural monitors to a destination prefix. The method also includes determining a suspect set of AS identifiers resulting from a union of the one-hop neighborhoods. The method further includes calculating a count and a distance associated with each AS identifier of the suspect set. The count indicates how often the AS identifier appeared in the one-hop neighborhoods. The distance indicates a total distance from the AS identifier to AS identifiers associated with the plural monitors. Yet further, the method includes generating a one-hop suspect set of AS identifiers from the suspect set that have highest counts and highest distances.

Growing community of inventors

Jersey City, NJ, United States of America

Dan Pei