At&t Intellectual Property I, L.p.

The State University of New York

At&t Technical Services Company, Inc.

Eric Noel

Carolyn Roche Johnson

Mark A Ratcliffe

Patrick Michael Velardo, Jr

Venson Shaw

Rittwik Jana

Mazin E Gilbert

Vijay Gopalakrishnan

Anestis Karasaridis

Yaron Koral

Guangtian Liu

Yury Bakshi

Rensheng Wang Zhang

Swapna Buccapatnam Tirumala

Kitming Wendy Tang

Jaewook Yu

Danielle Liu

Richard Hellstern

Stephen Chou

A method may include a processing system having at least one processor obtaining a first plurality of domain name system traffic records, generating an input aggregate vector from the first plurality of domain name system traffic records, where the input aggregate vector comprises a plurality of features derived from the first plurality of domain name system traffic records, and applying an encoder-decoder neural network to the input aggregate vector to generate a reconstructed vector, where the encoder-decoder neural network is trained with a plurality of aggregate vectors generated from a second plurality of domain name system traffic records. In one example, the processing system may then calculate a distance between the input aggregate vector and the reconstructed vector, and apply at least one remedial action associated with the first plurality of domain name system traffic records when the distance is greater than a threshold distance.

Unsupervised encoder-decoder neural network security event detection

A system for designing and executing control loops in a cloud environment includes a control platform implemented in the cloud environment having a data collection, analytics and events module, a policy module and an application controller module. The system includes a business process management application coupled to the control platform having a control loop designer module for designing a control loop template and a workflow engine for distributing the control loop template. The business process management application is coupled to the data collection analytics and events module of the control platform as well as the policy module in the application controller module to control platform. The control loop is activated by the control platform.

System and method for designing and executing control loops in a cloud environment

A processing system having at least one processor may obtain domain name system (DNS) traffic records of a DNS platform, the DNS traffic records associated with a source device having a first status and that is submitting DNS queries, where a first-tier DNS authoritative server of the DNS platform is configured to forward the DNS queries from the source device to at least a first second-tier DNS authoritative server of the DNS platform designated for the first status. The processing system may further detect anomalous DNS traffic records from the DNS traffic records, identify a change of the source device from a first status to a second status, based upon the detecting the anomalous DNS traffic records, and reconfigure the first-tier DNS authoritative server to redirect the DNS queries from the source device to at least a second second-tier DNS authoritative server designated for the second status.

Multi-tiered server architecture to mitigate malicious traffic

A method may include a processing system assigning samples of network traffic data to positions in a list, where each of the samples is assigned a cluster identifier corresponding to the respective position, and traversing the list, where for each position, the processing system: increments an order indicator, and when the cluster identifier is not less than the order indicator, computes a distance between a sample assigned to the position and other samples, records a cluster identifier of another sample when a distance between the sample and the other sample is less than a threshold distance, and assigns a minimum cluster identifier that is recorded to all of the samples with cluster identifiers that are recorded. The processing system may determine clusters from cluster identifiers in the list after the traversing and identify at least one cluster as representing anomalous network traffic data.

Network security event detection via normalized distance based clustering

A system and method for managing virtual machines in a network. A plurality of virtual machine (VM) requests are received. At least one resource requirement associated with the requests is selected. The plurality of VM requests are grouped into a plurality of request groupings based on a measurement of the at least one resource requirement. The plurality of VM requests are assigned to at least one server through utilization of the request groupings.

Systems and methods for management of virtual machine resources in a network environment through localized assignment of virtual machines having complimentary resource requirements

A method and apparatus for providing subscriber load distribution in networks are disclosed. For example, the method receives capacity data and user equipment (UE) resource consumption data from a plurality of devices that process call control signaling messages within the communication network. The method receives a first request from one of the plurality of devices to re-register one or more selected user equipment, and selects at least one available device from the plurality of devices. The method then re-registers the one or more selected user equipment on the at least one available device.

Method and apparatus for providing a centralized subscriber load distribution

A method, computer readable medium and apparatus for clearing hang calls in a communication network are disclosed. For example, the method detects a failure of an adjacent call stateful network element in a signaling path, identifies one or more calls that are affected by the failure of the adjacent call stateful network element, tests a media path of the one or more calls for activity and clears the one or more calls that are affected by the failure of the adjacent call stateful network element if the media path of the one or more calls is inactive.

Method and apparatus for clearing hang calls

Management of a network may be accomplished by adjusting timer settings and/or retry criteria. For example, communications and management from an end-to-end perspective of entities in a network may be conducted; timers and/or retry criteria may be adjusted dynamically based on network traffic load; timers and/or retry criteria may be adjusted dynamically based on overload conditions; feedback mechanisms may be implemented to allow downstream network elements to inform upstream network elements about the health status and/or load condition of the network; and/or differentiated timer and retry criteria/mechanisms may be implemented.

Long term evolution mobility network timer and retry management

A method and apparatus for handling an overload condition in a communication network are disclosed. For example, the method calculates a call target rate by at least one core signaling network element for at least one edge signaling network element. The method then sends the call target rate by the at least one core signaling network element to the at least one edge signaling network element, when a total queueing delay of the at least one core signaling network element exceeds a predefined high threshold in a measurement interval, wherein the call target rate is used by the at least one edge signaling network element in an overload control that throttles signaling traffic.

Method and apparatus for providing queue delay overload control

The performance of a radio frequency identification (RFID) system is improved by a protocol that eliminates collisions between signals generated by a) RFID tags that the RFID reader has already identified as being in its interrogation zone and b) RFID tags that are newly arrived and thus that the reader has not yet identified. This is illustratively accomplished by the use of separate identification and access frames. It is during the identification frame that newly arrived tags become identified by the reader. Although there may be collisions during the identification frame, those collisions are only among newly arrived tags. The already-identified tags communicate with the reader during respective time slots of the access frame, so that they neither collide with each other nor with the newly arrived tags.

Growing community of inventors

Holmdel, NJ, United States of America

Eric Noel