Alcatel Lucent

Alcatel-lucent USA Inc.

Nokia Technologies Oy

Lucent Technologies Inc.

Nokia of America Corporation

Jin Cao

Aiyou Chen

Li Erran Li

Tian Bu

Chitra Phadke

Viswanath Poosala

Scott Corey Miller

Susan Wu Sanders

Mansoor Ali Khan Alicherry

Yihao Lisa Zhang

Harsha S Nagesh

Huseyin Uzunalioglu

Don X Sun

Lawrence E Menten

William S Cleveland

Scott Alan Vander Wiel

Bin Yu

Pak-Ching Lee

Jeffery J Spiess

Alasdhair R Campbell

Ran He

R Drew Davis

Jingyuan Yang

Sining Chen

Nan Jiang

A computer system may use machine learning to determine functional zones within a geographical region. The computer system may determine position data and functional data for locations within a geographical region. The computer system may use machine learning to determine functional zones with a two-stage clustering approach. During the first stage, the computer system may determine geoclusters by clustering locations based on the position data. During the second stage, the computer system may determine functional zones by clustering the geoclusters based on the functional data.

Identifying functional zones within a geographic region

The present disclosure describes systems and methods that provide a hybrid framework for augmenting statistical anomaly detection with contextual features, machine learning and human Subject Matter Expert (SME) input to learn significant characteristics of true anomalies for which alerts should be generated. The framework presented herein is domain agnostic and independent of the underlying statistical anomaly detection technique or the machine learning algorithm. The framework described herein is therefore applicable and adaptable to a number of real world service provider systems and applications, such as, for example, detecting network performance degradation in a service provider network or detecting anomalous conditions from data received from a sensor while filtering out false positives.

Systems and methods for anomaly detection

The method includes receiving a plurality of calls from users of the communication network, the plurality of calls having a non-homogenous arrival rate that is defined by first arrival rate information, transforming the first arrival rate information into second arrival rate information, the second arrival rate information having a homogenous arrival rate, and detecting at least one first anomaly of the received plurality of calls using the second arrival rate information. A network node may be configured to perform this method.

System and method for anomaly detection for non-homogenous arrival rate

A capability is provided for detecting congestion in a communication network. A congestion condition is detected for the network based on resource utilization information associated with the network and a set of user quality-of-experience (QoE) indicators associated with the network. An indication of congestion in the network is detected based on resource utilization information associated with the network and a determination as to whether or not to generate detect a congestion condition for the network is made based on one or more user QoE indicators associated with the network. An indication of congestion in the network is detected based on resource utilization information associated with the network and a determination as to whether or not to generate a congestion alert for the indication of congestion in the network is made based on one or more user QoE indicators associated with the network.

Congestion detection based on resource utilization information and user quality-of-experience indicators

In one embodiment, a counting method of the invention uses an adaptive sketching-update process to compress an unknown cardinality into a counter value that counts the number of binary ones in a hashed bitmap vector. The sketching-update process is probabilistic in nature and uses bit-flip probabilities that are adaptively decreased as the counter value increases. Parameters of the sketching-update process are selected so that the relative error of cardinality estimates obtained based on the counter values is relatively small and substantially constant over a relatively wide range of cardinalities, e.g., from one to about one million. Due to the latter property, the counting method can advantageously be implemented in the form of embedded software that relies on a relatively small, fixed amount of memory.

Adaptive distinct counting for network-traffic monitoring and other applications

A method and apparatus are provided for incrementally tracking quantiles in the presence of multiple record types. A method for performing incremental quantile tracking includes receiving a first data record of a first record type and a second data record of a second record type, and updating a quantile probability for a quantile value, based on the first record type of the first data record and the second record type of the second data record, to obtain a new quantile probability for the quantile value.

Incremental quantile tracking of multiple record types

A capability for incremental tracking of multiples quantiles is provided. A method for performing an incremental quantile update using a data value of a received data record includes determining an initial distribution function, updating the initial distribution function to form a new distribution function based on the received data value, generating an approximation of the new distribution function, and determining new quantile estimates from the approximation of the new distribution function. The initial distribution function includes a plurality of initial quantile estimates and a respective plurality of initial probabilities. The new distribution function includes a plurality of quantile points identifying the respective initial quantile estimates and a respective plurality of new probabilities associated with the initial quantile estimates. The approximation of the new distribution function is generated by connecting pairs of adjacent quantile points using linear approximations of regions between the pairs of adjacent quantile points.

Method and apparatus for incremental tracking of multiple quantiles

In one embodiment, a method for detecting malicious software agents, such as domain-flux botnets. The method applies a co-clustering algorithm on a domain-name query failure graph, to generate a hierarchical grouping of hosts based on similarities between domain names queried by those hosts, and divides that hierarchical structure into candidate clusters based on percentages of failed queries having at least first- and second-level domain names in common, thereby identifying hosts having correlated queries as possibly being infected with malicious software agents. A linking algorithm is used to correlate the co-clustering results generated at different time periods to differentiate actual domain-flux bots from other domain-name failure anomalies by identifying candidate clusters that persist for relatively long periods of time. Persistent candidate clusters are analyzed to identify which clusters have malicious software agents, based on a freshness metric that characterizes whether the candidate clusters continually generate failed queries having new domain names.

System and method for detection of domain-flux botnets and the like

In one embodiment, a method of monitoring a network. The method includes: receiving, from each host of a set of two or more hosts of the network, a corresponding vector of M components constructed based on data packets received at the host during a time period, M being an integer greater than 1; and, based on the constructed vectors, using an expectation-maximization algorithm to estimate a cardinality distribution for the hosts in the set, wherein constructing a vector includes updating a component of the vector of the corresponding host in response to the corresponding host receiving a data packet, the updating including selecting the component for updating by hashing one or more fields of the data packet received by the corresponding host.

Estimating cardinality distributions in network traffic

In one embodiment, a method of monitoring a network. The method includes, at each node of a fixed set, constructing a corresponding vector of M components based on data packets received at the node during a time period, M being an integer greater than 1, the fixed set being formed of some nodes of the network; and, based on the constructed vectors, estimating how many of the received data packets have been received by all of the nodes of the set or estimating how many flows of the received data packets have data packets that have passed through all of the nodes of the set. The constructing includes updating a component of the vector of one of the nodes in response to the one of the nodes receiving a data packet. The updating includes selecting the component for updating by hashing a property of the data packet received by the one of the nodes.

Efficient probabilistic counting scheme for stream-expression cardinalities

A method is provided, according to which data are collected on downstream packet losses at a single point in a network. From from the collected data, packet loss rates are estimated on at least two subnetworks downstream of the collection point. The respective subnetworks may differ by one or more links.

Estimation method for loss rates in a packetized network

In one embodiment, a method of monitoring a network. The method includes, at each node of a set, constructing a corresponding vector of M components based on a stream of data packets received at the node during a time period, the set including a plurality of nodes of the network, M being greater than 1; and estimating a value of a byte traffic produced by a part of the packets based on the constructed vectors, the part being the packets received by every node of the set. The constructing includes updating a component of the vector corresponding to one of the nodes in response to the one of the nodes receiving a data packet. The updating includes selecting a component of the vector to be updated by hashing a property of the received data packet.

Probabilistic aggregation over distributed data streams

A network-equipment-implemented method and apparatus for tracking durations of flows received at a network node in consecutive intervals utilizes two counting bloom filters in ping-pong operation to reduce memory and processing. Identifiers for flows that exceed a predetermined duration or number of intervals are stored in a long-duration flow-identifier table. Hash functions used within the counting bloom filters and optionally used in the long-duration flow-identifier table are chosen to minimize the probability of false positives in the detection of long-duration flows. In some embodiments, flows are sampled to conserve memory and processing resources at the risk of missing detection of some long-duration flows.

Tracking network-data flows

Methods and apparatuses are provided for detecting traffic patterns in a data network. A sequential hashing scheme can be utilized that has D hash arrays. Each hash array i, wherein 1&#x2266;i&#x2266;D, includes Mindependent hash tables each having K buckets, with each of the buckets having an associated traffic total. Each of the keys corresponds with a single bucket of each of the Mindependent hash tables of each hash array i. The keys of the data network are partitioned into D words. As traffic is received for a key, a traffic total of each bucket that corresponds with a key is updated. The hash arrays can then be utilized to identify high traffic buckets of the independent hash tables having a traffic total greater than a threshold value. The high traffic buckets can be used to detect significant traffic patterns of the data network.

Scalable methods for detecting significant traffic patterns in a data network

A method is provided for determining a bandwidth allocation needed to provide a specified QOS requirement that takes appropriate account of statistical variations for packet streams in a transmission link. In particular, a statistical model of the packet stream is formed using fractional sum difference statistical models and the model is evaluated in respect to synthetically generated traffic streams. The bandwidth allocation approach is specified in terms of the bandwidth, &#x3b2;, required for a traffic load, &#x3c4;, subject to the requirements of a maximum queuing delay, &#x3b4;, and a packet loss limitation parameter, &#x3c9;. Accordingly, that bandwidth allocation approach is implemented as a statistical model for &#x3b2; as a function of &#x3c4;, &#x3b4; and &#x3c9;.

Growing community of inventors

Edison, NJ, United States of America

Jin Cao