At&t Intellectual Property I, L.p.

At+t Corp.

David Hoeflin

Yonatan Aharon Levy

Xiaowen Mang

Anestis Karasaridis

Danielle Liu

Willa Kay Ehrlich

Yury Bakshi

Leonard L Lu

Chaim Spielman

Stephen K Wood

Zhuangbo Tang

Duncan Kirkwood Sparrell

Daniel F Hurley

Carl Brian Rexroad

Harold Orr McCaskey

Manuel Ortiz

Ratna Chakka

Eric Fermon

A method and apparatus for performing traffic engineering, e.g., allocating bandwidth, on a wireless access network are disclosed. For example, the method determines a number of subscriber stations (SSs) that a Base Station (BS) is capable of supporting in accordance with at least one performance objective for voice traffic, wherein the at least one performance objective for voice traffic comprises a type of codec. The method then allocates bandwidth by the base station in accordance with the number of subscriber stations that the base station is capable of supporting.

Method and apparatus for allocating bandwidth for a network

A method includes receiving at a cache server a content request from a client system, determining that the cache server is overloaded in response to receiving the content request, and in response to determining that the cache server is overloaded, returning to the client system a domain redirection response including a load status of the cache server.

System and method for routing content based on real-time feedback

A method controls the routing of service requests to a plurality of servers using a first routing distribution algorithm. The method includes waiting a first period of time for a designated server to respond to a service request, transmitting the service request to the designated server a second time, and waiting a second period to time for the designated server to respond to the service request assigned to the designated server, the second period of time being longer than the first period of time. The method also includes determining that the designated server has failed, rerouting the service request to a different server, and routing the service requests to the plurality of servers using a second routing distribution algorithm.

Method of generating round robin service order lists for improving service performance during server failures

A system and method for receiving a plurality of values related to providing services on a network, determining at least one constraint value based on the plurality of values, performing a distribution analysis using the plurality of values and the at least one constraint value and outputting a result derived from the distribution analysis.

System and method for data modeling

A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers. Bot likelihood scores are determined for the resulting IP-address-aggregate-categories based on historically known bot IP addresses.

Bot-network detection based on simple mail transfer protocol (SMTP) characteristics of e-mail senders within IP address aggregates

A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.

System and method for detecting remotely controlled E-mail spam hosts

Methods for providing alerts in a network are disclosed. Some methods include collecting network traffic data corresponding to multiple subsets of network addresses during a predefined time interval. A suspect subset of the subsets of network addresses that corresponds to anomalous network activity may be identified based on the network traffic data and using at least one of multiple anomaly detection metrics. A source network address within the suspect subset of network addresses that corresponds to the anomalous network activity is identified. An alert corresponding to the source network address may be generated.

Methods, devices and computer program products for actionable alerting of malevolent network addresses based on generalized traffic anomaly analysis of IP address aggregates

Described is a system and method for receiving first data corresponding to usage of a network, receiving second data corresponding to usage of the network, comparing the first data to the second data and providing an indication of a network event when the second data varies from the second data greater than a predetermined threshold.

System and method for monitoring network activity

A method and apparatus for providing bandwidth allocation for a network are disclosed. For example, the method receives data from a plurality of subscribers for transmission, and allocates a minimum reserved bandwidth to each of the plurality of subscribers. The method then allocates a portion of a shareable bandwidth to at least one of the plurality of subscribers in accordance with a weight factor.

Method and apparatus for providing a weighted bandwidth allocation for a network

A method and apparatus for detecting compromised host computers (e.g., Bots) are disclosed. For example, the method identifies a plurality of suspicious hosts. Once identified, the method analyzes network traffic of the plurality suspicious hosts to identify a plurality suspicious hub-servers. The method then classifies the plurality of candidate Bots into at least one group. The method then identifies members of each of the at least one group that are connected to a same controller from the plurality suspicious controllers, where the members are identified to be part of a Botnet.

Growing community of inventors

Middletown, NJ, United States of America

David Hoeflin