Nec Corporation

Nec Europe Ltd.

Università Degli Studi Di Brescia

Maurizio Dusi

Saverio Niccolini

Francesco Gringoli

Giuseppe Bianchi

Giulio Picierro

Paolo Laffranchini

Riccardo Paolillo

Michele Orru

Luca Salgarelli

Christian Vitale

Manuel Crotti

Michele Orru'

A method for operating a distributed computing system includes transmitting, by a first node in a first level to an intermediate node in a second level, a first message and storing, by the first node, the first message. The method further includes receiving, by the intermediate node, the first message, generating a second message, and transmitting, to a third node, the second message. The method additionally includes receiving, by the intermediate node from the third node, a first acknowledgement message indicating that the second message was successfully received by the third node, and transmitting, by the intermediate node to the first node after receiving the first acknowledgement message, a second acknowledgement message. The method includes deleting, by the first node in response to receiving the second acknowledgment message, the stored first message.

Method for operating a distributed computing system and a distributed computing system

A method for analyzing a data flow includes: (a) extracting packet information of a packet, (b) determining a status of the packet based on the extracted packet information by applying at least one probabilistic filter to the packet and storing the packet for later inspection based on the status of the packet indicating that the packet is out-of sequence, and (c) inspecting the stored packet based on inspection rules. Upon a partial match of an inspection rule with the extracted packet information, a result of the inspection is temporarily stored. Already stored packets are inspected based on the already stored packets being in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted. The at least one probabilistic filter includes a connection Bloom filter and a sequence Bloom filter.

Method and system for analyzing a data flow

A method for operating a distributed computing system including a plurality of nodes connected in a general network topological sequential manner includes storing a first message on a first node; removing the first message from the first node only if an N-level acknowledgement message is received by the first node indicating that a second message based on the data of the first message was successfully received by a second node on a second level, wherein the difference between the values for the first and second level is a predefined value N; and saving a node state of at least the second node or a third node on a level higher than the first level before sending out an acknowledgement message to a node on a level below if an outgoing message towards the second node is generated based on the node state.

A method for analyzing a data flow includes extracting packet information of a packet of the data flow, determining the status of the packet and the status of the data flow based on the extracted packet information and storing the packet for later inspection when the status of the packet and/or the status of the data flow indicate that the packet is out-of sequence, and inspecting the packet and/or the stored packet based on inspection rules. Upon a partial match of at least one of the inspection rules with the extracted packet information, a result of the inspection of the packet is temporarily stored. Already stored packets are inspected when they are in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted.

A method and system for detecting anomaly of user behavior in a network with a hierarchical topology, including a plurality of users, at least two bridges to each of which at least one user is connected to and wherein the bridges are configured to be operable to connect the corresponding users to the network, and at least one predetermined profiling network entity, the method includes the steps of:

Method and system for detecting anomaly of user behavior in a network

A method to determine if an encrypted flow of packets (F) belongs to a predefined class of flows (&#x3c9;), comprises the steps of giving probability density functions (p(x|&#x3c9;)) of the values of two measurable variables in a plurality of encrypted flows of packets (F) belonging to the predefined class of flows (&#x3c9;), measuring the values (s,&#x394;t) of the two measurable variables, apply the measured values (s,&#x394;t) to the probability density functions (p(x|&#x3c9;)) to generate a sequence of values of probability density (p({right arrow over (x)}|&#x3c9;)), process the sequence of values of probability density (p({right arrow over (x)}|&#x3c9;)) to generate a reference value (S({right arrow over (x)}|&#x3c9;)), and compare such reference value (S({right arrow over (x)}|&#x3c9;)) to a threshold value (T) to determine whether the encrypted flow of packets (F) belongs to the predefined class of flows.

Growing community of inventors

Gadesco Pieve Delmona, Italy

Maurizio Dusi