At&t Intellectual Property I, L.p.

At+t Corp.

At&t Technical Services Company, Inc.

American Telephone and Telegraph Company, At&t Technologies, Inc.

Richard Hellstern

John Babu Medamana

Arvind S Chakravarti

Hossein Eslambolchi

Anestis Karasaridis

Patrick Michael Velardo, Jr

Rensheng Wang Zhang

Yonatan Aharon Levy

Yaron Koral

Eric Noel

Swapna Buccapatnam Tirumala

Ganesh Subramaniam

Ali Mohammad Kujoory

Hrair Aldermeshian

John Joseph Sikora

Robert Archibald

Raymond L Kimber

Creating and using learning models to identify botnet traffic can include obtaining netflow data associated with a connecting device that is communicating with a carrier network. The netflow data can represent communications associated with the connecting device. Data features associated with the communications can be extracted. The data features can include statistical information associated with the communications. A learning model based on the data features extracted from the netflow data can be trained. A prediction using the learning model can be generated, and an action based on the prediction can be taken.

Creating and using learning models to identify botnet traffic

A method may include a processing system having at least one processor obtaining a first plurality of domain name system traffic records, generating an input aggregate vector from the first plurality of domain name system traffic records, where the input aggregate vector comprises a plurality of features derived from the first plurality of domain name system traffic records, and applying an encoder-decoder neural network to the input aggregate vector to generate a reconstructed vector, where the encoder-decoder neural network is trained with a plurality of aggregate vectors generated from a second plurality of domain name system traffic records. In one example, the processing system may then calculate a distance between the input aggregate vector and the reconstructed vector, and apply at least one remedial action associated with the first plurality of domain name system traffic records when the distance is greater than a threshold distance.

Unsupervised encoder-decoder neural network security event detection

Concepts and technologies disclosed herein are directed to internet traffic classification via time-frequency analysis. According to one aspect of the concepts and technologies disclosed herein, a security classification scheme can be implemented to identify potentially malicious activities from normal internet traffic. The security classification scheme can exploit the distinctive characteristics of different types of traffic in both frequency domain and time domain to identify four different cases. Due to the separation of different types of traffic, the security classification scheme can lower the false alarm rate and improve network security. The security classification scheme can utilize a recursive discrete Fourier transform ('DFT') implementation to enhance computational efficiency. The security classification scheme can be deployed for real-time network traffic monitoring due to an efficient streaming design and can be effectively used to detect and predict when and where the suspicious activities occur within a monitored network.

Internet traffic classification via time-frequency analysis

A next generation performance network management system (') includes a first component () that monitors one or more attributes of network elements (--and) as well as peripheral devices (and) and interconnecting links () to establish an historic trend for each monitored element. A second performance management system component () monitors, on a near real-time basis, critical attributes of elements identified from historic trends as undergoing performance degradation: If such performance degradation persist, as detected by such near real-time monitoring, then the network operator can repair or replace the element in question to maintain network performance.

Proactive predictive preventative network management technique

A next generation performance network management system (') includes a first component () that monitors one or more attributes of network elements (and) as well as peripheral devices (and) and interconnecting links () to establish an historic trend for each monitored element. A second performance management system component () monitors, on a near real-time basis, critical attributes of elements identified from historic trends as undergoing performance degradation. If such performance degradations persist, as detected by such near real-time monitoring, then the network operator can repair or replace the element in question to maintain network performance.

The invention provides methods and systems for providing priority processing to critical data as the data is transmitted across a network. A plurality of Internet protocol (IP) packets, each of which contains data and priority information, are received at a first router. The data contained in the IP packets is then encapsulated into frame relay frames containing the priority information. The frame relay frames are transmitted from the first router to a frame relay network in a manner determined by the priority information included in the frame relay frames. The frame relay frames are then transmitted across a frame relay network to a second router in a manner determined by the priority information included in the frame relay frames.

End-to-end prioritized data delivery on networks using IP over frame relay

Individual components (12) in a tube (14) are successively removed and then riented for pickup by first positioning the tube, whose ends are opened, in a horizontal orientation such that the components in the tube are upside down. Thereafter, a component is at least partially expelled from one end of the tube by directing a stream of gas (e.g., air) into the other end of the tube. The component partially expelled from the tube is then withdrawn from the tube to locate the component between a pair of jaws (124) capable of rotation about an arc of 180.degree.. The jaws then engage the component and thereafter rotate it 180.degree. before positioning the component right side up.

Growing community of inventors

Cranbury, NJ, United States of America

Richard Hellstern