At&t Intellectual Property I, L.p.

At+t Corp.

At&t Technical Services Company, Inc.

Patrick Michael Velardo, Jr

Anestis Karasaridis

Lawrence Richard Rabiner

Dennis Matthew Romain

Joel Goldman

Eric Noel

Rensheng Wang Zhang

Yaron Koral

Richard Hellstern

Swapna Buccapatnam Tirumala

Douglas M Nortz

Woodson Dale Wynn

Ashwin Sridharan

Stephen Chou

A method may include a processing system having at least one processor obtaining a first plurality of domain name system traffic records, generating an input aggregate vector from the first plurality of domain name system traffic records, where the input aggregate vector comprises a plurality of features derived from the first plurality of domain name system traffic records, and applying an encoder-decoder neural network to the input aggregate vector to generate a reconstructed vector, where the encoder-decoder neural network is trained with a plurality of aggregate vectors generated from a second plurality of domain name system traffic records. In one example, the processing system may then calculate a distance between the input aggregate vector and the reconstructed vector, and apply at least one remedial action associated with the first plurality of domain name system traffic records when the distance is greater than a threshold distance.

Unsupervised encoder-decoder neural network security event detection

Systems, methods and computer readable media are provided to control anycast traffic using a software defined network controller. Telemetry and event data is gathered from a plurality of service nodes in the network. The telemetry and event data sent by an event broker to an analytic application with a resource conditions at each of the plurality of service nodes is determined based on the telemetry and event data. Traffic routing change recommendations are provided to a software defined network controller based on resource conditions at each of the plurality of service nodes and a set of predetermined policies.

Method and apparatus to control anycast traffic using a software defined network controller

A processing system having at least one processor may obtain domain name system (DNS) traffic records of a DNS platform, the DNS traffic records associated with a source device having a first status and that is submitting DNS queries, where a first-tier DNS authoritative server of the DNS platform is configured to forward the DNS queries from the source device to at least a first second-tier DNS authoritative server of the DNS platform designated for the first status. The processing system may further detect anomalous DNS traffic records from the DNS traffic records, identify a change of the source device from a first status to a second status, based upon the detecting the anomalous DNS traffic records, and reconfigure the first-tier DNS authoritative server to redirect the DNS queries from the source device to at least a second second-tier DNS authoritative server designated for the second status.

Multi-tiered server architecture to mitigate malicious traffic

A method may include a processing system assigning samples of network traffic data to positions in a list, where each of the samples is assigned a cluster identifier corresponding to the respective position, and traversing the list, where for each position, the processing system: increments an order indicator, and when the cluster identifier is not less than the order indicator, computes a distance between a sample assigned to the position and other samples, records a cluster identifier of another sample when a distance between the sample and the other sample is less than a threshold distance, and assigns a minimum cluster identifier that is recorded to all of the samples with cluster identifiers that are recorded. The processing system may determine clusters from cluster identifiers in the list after the traversing and identify at least one cluster as representing anomalous network traffic data.

Network security event detection via normalized distance based clustering

Concepts and technologies disclosed herein are directed to internet traffic classification via time-frequency analysis. According to one aspect of the concepts and technologies disclosed herein, a security classification scheme can be implemented to identify potentially malicious activities from normal internet traffic. The security classification scheme can exploit the distinctive characteristics of different types of traffic in both frequency domain and time domain to identify four different cases. Due to the separation of different types of traffic, the security classification scheme can lower the false alarm rate and improve network security. The security classification scheme can utilize a recursive discrete Fourier transform ('DFT') implementation to enhance computational efficiency. The security classification scheme can be deployed for real-time network traffic monitoring due to an efficient streaming design and can be effectively used to detect and predict when and where the suspicious activities occur within a monitored network.

Internet traffic classification via time-frequency analysis

A system and method for bridging the POTS network and a packet network, such as the Internet, uses a set of access objects that provide the interfacing and functionality for exchanging address and payload information with the packet network, and for exchanging payload information with the payload subnetwork and signaling information with the signaling subnetwork of the POTS network. The system includes a communications management object that coordinates the transfer of information between the POTS network and the packet network; a payload object that transfers payload information between the system and the payload subnetwork of the first communications network; a signaling object that transfers signaling information between the system and the signaling subnetwork of the first communications network in accordance with a signaling protocol associated with the signaling subnetwork; and a packet object that transfers payload and address information between the system and the second communications network in accordance with a communications protocol associated with the second communications network. An alternative embodiment uses a plurality of payload, signaling and packet objects to provide a scalable system.

POTS/packet bridge

Pots/packet bridge

A method and apparatus are described for reducing, in communication signals received by a local network from a remote network (FAR-IN signals), that energy content that is attributable to echoes of signals transmitted into the local network (NEAR-IN signals). This is achieved, in part, by generating a time-varying TEMPLATE signal which represents the smoothed energy content of NEAR-IN signals delayed according to the echo path and attenuated by an estimated echo transmission loss. A non-linear processor passes the FAR-IN signal substantially without attenuation if it exceeds the threshold derived at least in part from the TEMPLATE, but attenuates the FAR-IN signal if it lies within a defined range below the threshold.

Growing community of inventors

Manalapan, NJ, United States of America

Patrick Michael Velardo, Jr