Narus, Inc.

Politecnico Di Torino

Other

Cisco Technology, Inc.

Vodafone Group Plc.

Vodafone Omnitel N.v.

Huawei Technologies Co., Limited

Marco Mellia

Ram Keralapura

Ignacio Bermudez

Antonio Nucci

Marios Iliofotou

Dario Rossi

Massimo Perino

Michela Meo

Luigi Grimaudo

Stefano Traverso

Maurizio Matteo Munafo

Mario Baldi

Alok Tongaonkar

Sabyasachi Saha

Han Hee Song

Elena Baralis

Martino Trevisan

Idilio Drago

Hassan Esam Hassan Metwalley

Danilo Giordano

Giulia Milan

Lorenzo Del Sordo

Luca Vassio

Zied Ben Houidi

A method for detecting web tracking services during browsing activity performed by clients having associated client identifiers includes the steps of extracting key-value pairs contained into navigation data, looking for one-to-one correspondence between said client identifiers and the values contained in said keys and selecting the keys for which at least a client-value one-to-one correspondence for at least a predetermined number of clients is observed, the keys identifying the associated services as services performing tracking activities.

Method for detecting web tracking services

In an example embodiment, a Software Defined Networking (SDN) application identifies a domain based on a destination address of a packet that is associated with a primary service. The domain corresponds to the primary service, and the primary service is configured to trigger one or more support flows from one or more ancillary services. The SDN application identifies the one or more support flows based on the domain, and generates one or more rules for distribution to one or more network elements that handle packets of the one or more support flows from the one or more ancillary services.

Automatic rule generation for flow management in software defined networking networks

A method for analyzing a binary-based application protocol of a network. The method includes obtaining conversations from the network, extracting content of a candidate field from a message in each conversation, calculating a randomness measure of the content to represent a level of randomness of the content across all conversation, calculating a correlation measure of the content to represent a level of correlation, across all of conversations, between the content and an attribute of a corresponding conversation where the message containing the candidate field is located, and selecting, based on the randomness measure and the correlation measure, and using a pre-determined field selection criterion, the candidate offset from a set of candidate offsets as the offset defined by the protocol.

Automatic parsing of binary-based application protocols using network traffic

A method for analyzing a content delivery network. The method includes obtaining network traffic flows corresponding to user nodes accessing contents from a set of servers of the content delivery network, extracting a timing attribute from each network traffic flow associated with a server, where the timing attribute is aggregated into a timing attribute dataset of the server based on all network traffic flows associated with the server, generating a statistical measure of the timing attribute dataset as a portion of a feature vector representing the server, where the feature vector is aggregated into a set of feature vectors representing the set of servers, analyzing the set of feature vectors based on a clustering algorithm to generate a set of clusters, and generating, based on the set of clusters, a representation of server groups in the content delivery network.

Unsupervised methodology to unveil content delivery network structures

A method for analyzing an application protocol of a network. The method includes extracting non-alphanumeric tokens from conversations of the network, selecting frequently occurring non-alphanumeric token as a field delimiter candidate for dividing each conversation into a slice-set, analyzing slice-sets of the conversations to determine a statistical measure of matched slices for each conversation, and -o determine a field delimiter candidate score by aggregating the statistical measure of matched slices for all conversations, and selecting the non-alphanumeric token as the field delimiter of the protocol based on the field delimiter candidate score associated with the non-alphanumeric token.

Automatic parsing of text-based application protocols using network traffic data

A method for profiling network traffic of a network, including obtaining a plurality of flows comprising a plurality of client IP addresses, a plurality of server IP addresses, and a plurality of server ports, extracting a plurality of fully qualified domain names (FQDNs) from a plurality of DNS flows in the network traffic, analyzing correlation between the plurality of flows and the plurality of FQDNs to generate a result, and presenting the result to an administrator user of the network.

Discerning web content and services based on real-time DNS tagging

A method for classifying network traffic, including (1) processing a first working set portion of a flow batch for a first iteration by dividing the first working set portion into clusters and filtering a cluster by (i) identifying a first server port as most frequently occurring comparing to all other server ports in the cluster, (ii) in response to determining that a first frequency of occurrence of the first server port in the cluster exceeds a pre-determined threshold: (a) identifying the cluster as a dominatedPort cluster, (b) removing the cluster from the first working set portion to generate a remainder as a second working set portion, and (c) removing, from the cluster to be added to the second working set portion, one or more flows having different server port than the first server port, and (2) processing the second working set portion for a second iteration.

Self-learning classifier for internet traffic

The invention relates to a method and a system for detecting a single data flow in an aggregate packet data flow and identifying the application generating the single data flow, this single data flow being divided into messages, each message comprising a plurality of blocks, each block (g) having n bits for identifying 2block values (i). The method comprises the steps of providing, for each block value (i), an expected frequency value (E), measuring, for a predefined number (G) of blocks (g), the values Formula (I) of frequency with which each block (g) identifies each block value (i) so as to obtain a plurality of measured frequency values Formula (I), processing, for each block (g), the measured frequency values Formula (I) and the expected frequency values (E) in order to generate a frequency deviation value Formula (II) representative of the deviation of the measured frequency values Formula (I) with respect to the expected frequency values (E), and processing the frequency deviation values Formula (II) generated for each block (g) with at least one frequency deviation threshold value (&#x3c7;) in order to detect the single data flow and identify the application generating said single data flow.

Method and system for detecting a single data flow in an aggregate packet data flow and for identifying the application generating said single data flow

The invention concerns a method and an apparatus for detecting vocal data flow in a packet data flow characterised by at least two measurable variables (X5Y). A distribution function (P{x 1 C}, P{y I C}) is provided of the values of each variable (X5Y) in a vocal data flow, and the values (x,y) of each variable (X,Y) are measured in order to obtain a sequence of measured values (x, y) on a number (k) of blocks. Each measured value (x, y) is therefore applied to the respective distributiion function (P{x 1 C}, P{yI C}) in order to generate a sequence of likelihood values Formula (I) from which respective average likelihood values (E [B],E[B]) are generated. The average values are processed in order to generate a reference likelihood value (B) which, when compared with a threshold likelihood value (B) enables the presence of vocal data flow in a packet data flow to be detected.

Method and apparatus for detecting vocal data flow in a packet data flow

Growing community of inventors

Turin, Italy

Marco Mellia