Alcatel Lucent

Blackberry Corporation

Alcatel

Peter Mark Rabinovitch

Brian Everett McBride

Nazih Almalki

Robert Joseph Lombardi

Jasmin Mulaosmanovic

Michael Andrew Goldsmith

Aleksandar Papo

Stanley T Chow

Bassem Abdel-Aziz

Bashar Said Bou-Diab

Olivier Marce

Thomas Levy

Adrian Grah

Zlatko Krstulich

Milan Zoranovic

Wladyslaw Olesinski

Arnold Jansen

John Lawrence Jordan

Raluca Dragnea

Brian Everett Mcbride

Brian Mcbride

A method of operation and non-transitory computer readable medium are provided for a mobile communications device which includes memory storing program instructions and a processor coupled to a first input that passively collects input data and a second input that collects response data based on a challenge. A statistical behavioral model is generated based upon passively collected input data for the user. A level of assurance (LOA) is determined based upon the statistical behavioral model and the passively collected input data from the first input. The LOA is compared with a threshold and based on the comparison: the mobile device operation is enabled as a result of determining that the LOA meets or exceeds the threshold without requiring response data from the at least one second input, otherwise, the challenge is generated and the mobile device operation is enabled responsive to valid response data from the second input.

Mobile communications device providing heuristic security authentication features and related methods

A mobile communications device includes a plurality of first input devices capable of passively collecting input data, a second input device(s) capable of collecting response data based upon a challenge, and a processor capable of determining a level of assurance (LOA) that possession of the mobile communications device has not changed based upon a statistical behavioral model and the passively received input data, and comparing the LOA with a security threshold. When the LOA is above the security threshold, the processor may be capable of performing a given mobile device operation without requiring response data from the second input device(s). When the LOA falls below the security threshold, the processor may be capable of generating the challenge, performing the given mobile device operation responsive to valid response data, and adding recent input data to the statistical behavioral model responsive to receipt of the valid response data.

A system and method of processing data, including identifying a first data processing criteria, communicating the first data processing criteria from a data processing application to a network element, receiving sensor data from a plurality of sensors at the network element, operating on the sensor data at the network element to process the data according to the identified first data processing criteria, resulting in a first processed data result, transmitting the first processed data result from the network element to the data processing application, and processing the first processed data result at the data processing application resulting in a second processed data result. The criteria can be dynamically updated.

Method, system and service for structured data filtering, aggregation, and dissemination

A mobile communications device may include a plurality of first input devices capable of passively collecting input data, a second input device(s) capable of collecting response data based upon a challenge, and a processor capable of determining a level of assurance (LOA) that possession of the mobile communications device has not changed based upon a statistical behavioral model and the passively received input data, and comparing the LOA with a security threshold. When the LOA is above the security threshold, the processor may be capable of performing a given mobile device operation without requiring response data from the second input device(s). When the LOA falls below the security threshold, the processor may be capable of generating the challenge, performing the given mobile device operation responsive to valid response data, and adding recent input data to the statistical behavioral model responsive to receipt of the valid response data.

Communication session admission control systems and methods are disclosed. A state of a communication system is monitored, and admission of a communication session into the communication system is controlled based on a random admission control procedure and a current state of the communication system. Monitoring of the current state of equipment in the communication system, connections in the communication system, communication sessions in progress in the communication system, special monitoring sessions established in the communication system, and/or an overall state of the communication system can have several benefits. These benefits may include improving utilization of resources in the system, and providing a session admission control scheme that is capable of reacting to actual observed conditions and adapting to changing system topologies following a fault, for instance. Random admission control further avoids all or nothing session blocking, which can have the undesirable effect of prompting a high number of session retries.

Communication session admission control systems and methods

The invention detects stealth worm propagation by comparing the repeat elements in sets of destinations of a source in multiple time windows to a fitted distribution of same, stored as a benchmark plot. Measurements are performed over N time windows, wherein a representation of the set of destinations to which a respective source has sent packets is determined for each source, in each time window. The counting is performed using a hash table. Once N such sets of destinations have been obtained, the number Xof destinations that are common to N, N&#x2212;1, N&#x2212;2, . . . , 2, 1 windows is determined. Thus Xis the number of destinations that a particular source sent packets to in k time windows. Xis then compared to the corresponding value on the plot; anomalies indicate an attack from the respective source.

Worm detection by trending fan out

Packets of a certain type from a certain source are directed to a system that estimates the set of destinations and the number of new destinations for which that source has sent packets during a time window T. Instead of maintaining tables with the complete destination addresses for each source, the destination addresses are hashed and stored in a small bit array. The sets of destinations for a number of successive time windows are OR'ed for building cumulative tables C, where Cincludes all destinations that have been seen between Tand T. The new destinations are determined by counting the destinations set in Tbut not in C. Any change from the typical patterns can be suspected as being a slow scan.

Method and system for counting new destination addresses

Apparatus and methods for real-time traffic classification based on off-line determined traffic classification rules are provided. Traces of real traffic are obtained and subjected to statistical analysis. The statistical analysis identifies the multidimensional domain space of characteristic traffic parameters. Classification rules associated with the identified domains are derived and provided to traffic classification points for real-time traffic classification. Traffic classification points, typically edge network nodes, sample packets in aggregate streams with a predetermined probability. Statistical information regarding the sampled flows is tracked in a table, the number of time a flow was sampled providing a probabilistic measure of the flow's duration before the flow terminates. The table entries, which predominantly track high bandwidth flows, are subjected to the classification rules for real-time classification of the sampled flows. Optionally, rules include an action to be taken in respect of flows having characteristics matching thereof. Advantages are derived from low overhead on-line real-time classification of high-bandwidth flows at low overheads before flow termination.

Statistical trace-based methods for real-time traffic classification

A method for detecting anomalies in traffic patterns and a traffic anomalies detector are presented. The method and the detector are based on estimating the fan-in of a node, i.e. the number of distinct sources sending traffic to a node, based on infrequent, periodic sampling. Destinations with an abnormally large fan-in are likely to be the target of an attack, or to be downloading large amounts of material with a P2P application. The method and the anomalies detector are extremely simple to implement and exhibit excellent performance on real network traces.

Method for estimating the fan-in and/or fan-out of a node

A method and apparatus for assessing a communications' network adherence to Service Level Agreements (SLAs) is presented. The apparatus includes a arrival curve parameter derivation and arrival curve parameter reporting means. A arrival curve parameter generator may be implemented either in hardware for a predefined response in fitting arrival curves to cumulative content arrival variations, or in software for flexibility in the content traffic considered for assessment. The arrival curve generator may be associated with a physical port, a line card, or a network node. Arrival curve parameters defining arrival curves are employed by a Network Management System (NMS) in conjunction with communications network node and communications network service curves in performing SLA conformance assessments. The advantages are derived from a distributed content traffic characterization in terms of arrival curves, a reduced resource overhead in conveying arrival curve parameters without sacrificing SLA assessment thoroughness.

Network service level agreement arrival-curve-based conformance checking

The SATME method and system estimates source-to-destination traffic matrices using a simulated annealing algorithm, the traffic matrix estimation being represented as a probability distribution over the set of all possible matrices that satisfy a set of given constraints. The constraints explicitly encode information that the user knows about the network traffic as components of an objective function (a fitness function), that is then minimized using simulated annealing. With the method according to the invention, arbitrary constraints of any form can be included, and the case where there are no feasible solutions can be diagnosed by the objective function not converging to zero.

Simulated annealing for traffic matrix estimation

The FastSATME method and system estimate source-to-destination traffic matrices using a simulated annealing algorithm, the traffic matrix estimation being represented as a probability distribution over the set of all possible matrices that satisfy a set of given constraints. The constraints explicitly encode information that the user knows about the network traffic as components of an objective function (a fitness function), that is then minimized using simulated annealing. With the method according to the invention, arbitrary constraints of any form can be included. FastSATME works over a series of time steps. At the first time step FastSATME acts the same as SATME but in subsequent time steps, the estimate of the traffic matrix at time t is based on the estimate at t-1.

Fast simulated annealing for traffic matrix estimation

A cluster router architecture and methods for performing distributed routing are presented. The cluster router architecture includes off-the shelf Personal Computer (PC) hardware-based router cluster nodes interconnected in an intra-connection network in multiple dimensions. Each PC-based router cluster node is provided with the same routing functionality and a router-cluster-node-centric configuration enabling each router cluster node to provide routing responses for packets pending processing. Packet processing is divided into entry packet processing and routing response processing; special processing; and exit processing. Exit packet processing is performed by router cluster nodes transmitting packets into communication networks in which the cluster router participates. Packet processing is interrupted on determining that special processing is required in respect of a packet, and the packet is handed over to a corresponding special purpose router cluster node.

Growing community of inventors

Ottawa, Canada

Peter Mark Rabinovitch