Nortel Networks Corporation

Solana Networks Inc.

Tropic Networks Inc.

Alcatel-lucent Canada Inc.

Cavesson Software LLC

Nabil Seddigh

Biswajit Nandy

Rupinder Singh Makkar

Peter Steven Pieda

Carl F Cao

Yajun Liu

Don W Bennett

Dabin Wang

Jamal Hadi Salim

Kevin Wong

Joseph Fook-Kong Thoo

Udo Mircea Neustadter

Hassan Halabian

Paul David Obeda

Nausheen Naz

Sudhakar Ganti

Cheng Yin Lee

Douglas Heath Patriarche

Ioannis Lambadaris

Donald William Arthur Bennett

Donald William Bennett

Biswayjit Nandy

Fozia A Zaidi

Richard A Houle

Craig Dillabaugh

Sabeel Ansari

Satheesa Nadaragh

Systems and methods for discovery and mapping of industrial control and SCADA networks are described herein. The disclosed systems and methods help operators ensure the cyber security of their SCADA network through accurate discovery, fingerprinting and mapping the industrial control network map, including PLCs (Programmable Logic Controller) and RTUs (Remote Terminal Unit), using passive techniques.

Method and system for discovery and mapping of a network topology

Disclosed is a methodto be used on collected network data flowassociated with a network; the methodincludes: an anomaly-detection operationincluding: (A) obtaining the collected network data flow; and (B) performing an iterative principal component analysis on the collected network data flowto detect an anomaly associated with the collected network data flow. The method may be used in a server and a network, and may also be implemented as a non-transitory computer-readable media. A corresponding system for detecting the anomaly in the network flow data is also provided.

Detection of anomaly in network flow data

A real-time network-analysis system comprises a network appliance and a plurality of management devices. The network appliance continuously monitors an object network and synthesizes a current network image comprising contemporaneous indicators of connectivity, occupancy, and performance of the object network. A management-client device may gain access to the network image for timely control and for use in producing long-term network-evolution plans. To enable the creation of a real-time network image, optimized topology synthesis algorithms are devised to minimize the computational effort. The real-time network-analysis system is adapted for use with an object network employing a variety of routing protocols, such as link-state protocols, and network-management protocols, such as the Simple-Network-Management protocol.

Real-time network analyzer

Methods and apparatus for topology discovery of a network having heterogeneous network devices are disclosed. A network appliance communicates with the network devices to acquire device descriptors and characterize the network devices accordingly. Topology discovery is based on device characteristics, media-access data, and encoded connectivity patterns, where each connectivity pattern is defined by devices of specific device types and respective media-access data. A topology deduction module of the network appliance synthesizes a network image starting with unconnected devices and progressively incorporating detected connectivity patterns.

Method and system for network topology discovery

An alert system for a communications network has a plurality of client devices and a plurality of alert servers each adapted to provide alerts to a respective subset of the client devices to provide scalability. Users at the client devices subscribe to receive alerts by selecting a scope of distribution of alerts. The selection involves selecting a type of alert to receive, a level of severity of alerts to receive, and a geographic scope. In response to receiving a request to issue an alert, an alert server notifies the other alert servers of the alert. Each alert server determines which client devices of the respective subset of client devices are to receive the alert. Each alert server then sends an alert message to its client devices that are to receive the alert.

Alerting method, apparatus, server, and system

A method for monitoring lightpaths in an optical network comprising nodes interconnected by wavelength-multiplexed links is disclosed. Each lightpath is identified by a respective optical signature. A node stores identifiers of optical signatures of lightpaths designated to traverse the node and identifiers of adjacent nodes. Each node also maintains a record of all optical signatures it detects. A command-line interface associated with a selected node tracks a selected lightpath, designated to traverse the selected node, by propagating messages in an upstream direction, a downstream direction, or both, requesting other nodes to provide information pertinent to the selected lightpath. The selected node may also send messages to all its neighboring nodes requesting each to indicated detection, or otherwise, of the selected lightpath. Thus, the method relies on localized information, maintained at each node, and cooperative exchange of data among nodes without interacting with a centralized network management facility.

Method and system for light path monitoring in an optical communication network

A system of hitless restart in a network, where at least one node in the network provides routing control distributed among ingress ports (ingress cards) and egress ports (egress cards), is disclosed. With distributed routing control, each ingress card has its own routing-control software and each egress card has its own routing-control software. When the routing-software at an ingress port or an egress port of a node is restarted, current connections traversing a restarting ingress card or a restarting egress card continue to function normally during a restart period without data loss. The disclosed system is tailored to a multi-protocol label switching (MPLS) network employing distributed-resource-reservation-protocol traffic engineering (RSVP-TE). The system relies on messaging between ingress card control planes, ingress card data planes, egress card control planes, and egress card data planes of a restarting node.

System and method for distributed resource reservation protocol-traffic engineering (RSVP-TE) hitless restart in multi-protocol label switching (MPLS) network

A multi-protocol label switching (MPLS) packet network, methods and traffic engineering extensions to label distribution protocol are provided, capable of carrying traffic of multiple classes of service over the same label switch path.

Label distribution protocol supporting multiple classes of service in a multi protocol label switching (MPLS) network, methods and MPLS network using thereof

A system and method for transmitting data in a data communications network, using a transmission control protocol, to provide reduced acknowledgment control traffic, error recovery and congestion control. A communications link is established between a transmitter and a receiver. Setting the communications link includes setting a network congestion window to an initial length. A sequence, or stream, of data packets is sent from the transmitter to the receiver. The receiver detects any missing packets, by examining the sequence numbers of the incoming packets, and sends negative acknowledgments, generally no more than four, to the transmitter identifying the missing data packet. When the transmitter receives a negative acknowledgment, it decreases the length of the congestion window, and re-transmits the missing packet. Detection and use of round-trip time, re-transmission time-out are provided.

System and method for a negative acknowledgement-based transmission control protocol

A system and method for data flow classification based on a configurable rule-engine, is presented herein. In accordance with an embodiment of the invention, the system includes a data flow managing mechanism configured to identify, track, and manage the data flows and a rule set, which includes a plurality of rules for comparing information contained within data flow with pre-specified values. The system also includes a configurable classification rule engine for classifying the data flows into one of a plurality of traffic classes based on results of the comparisons. The configurable classification rule engine is configured via a configuration file that specifies and allows for the modification and reconfiguration of the pre-specified values and information regarding the data flows, the rule set, and the traffic classes.

Configurable rule-engine for layer-7 and traffic characteristic-based classification

Different arrangements are provided for two-way RSVP reservations. The network resources needed for a two-way communication involving a first party and a second party are reserved via either a 3-way RSVP handshake or a 4-way handshake.

Method and system for a routing mechanism to support two-way RSVP reservations

Currently there are two techniques used to classify data packet flows, those techniques being static and dynamic. A proper combination of these two techniques can allow for the advantages of both techniques to be gained while reducing their respective disadvantages. With this combined flow classification method a flow is classified initially with the use of a static classification method while, at the same time, a dynamic classification method is initiated. If at any point during the dynamic classification method, the classifications derived from the static and dynamic algorithms converge, the flow's classification is henceforth assigned by the dynamic classification method. If a predetermined number of packets or length of time that would be required for the dynamic and static classification algorithms to converge is exceeded, the flow's classification, once again, is henceforth assigned by the dynamic classification method. This allows the initial classification of the flow to occur quickly with the static classification method and the accuracy of dynamic flow classification techniques to take over once such a classification is deemed accurate.

Apparatus and method for classifying data packet flows

A method as apparatus for controlling the number of egress points at an ingress node in a multicast tree in a differentiated services network is described. A resource management entity is provided in each edge node in the entity. The resource management entity in the ingress node stores data from a service level specification that specifies the bandwidth, type of service and a limit on the number of egress points that can be grafted to the ingress node. The grafting of egress points to the node is controlled by the limit. If a new egress point cannot be grafted to the ingress node, the downstream node requesting the graft is preferably provided with graft redirect options to permit the downstream node to graft to an existing branch of the multicast tree. The advantage is automated, dynamic control of the multicast tree so that service is delivered in accordance with a service level agreement that governs service delivery for the dynamic multicast tree.

Method and apparatus for controlling fanout of a multicast tree

Systems and methods applicable in the context of the TCP/IP suite of protocols explicitly are provided which allow for separate and preferential treatment of L -L control packets compared to the treatment of L data packets. This provides a performance gain at the cost of providing such preferential treatment for high error and long delay channels such as wireless links. Advantageously, channel utilization may be increased, for example by 5-50% depending on link conditions, on high error and long delay transmission links. More generally the invention distinguishes between control packets such as transport layer (for example, TCP, OSI Layer or L ) and application layer (for example, OSI Layer ) control packets and data packets, and transmits the control packets with higher reliability and lower delays. The benefit may be significant for IP applications where data objects transferred are small and are bursty, e.g., Web browsing and e-mail access.

Growing community of inventors

Kanata, Canada

Nabil Seddigh