Alcatel Lucent

Alcatel-lucent USA Inc.

Samphel Norden

Tian Bu

Thomas Y Woo

Scott Corey Miller

Girish P Chandranmenon

Katherine Hua Guo

Ruth S Gayde

Kathleen Ellen Moczulewski

Alex Ibrahim Moukalled

Ruth Schaefer Gayde

Scott Miller

The present invention relates to a correlation module for correlating IP layer traffic and wireless layer network elements in a network. According to an example embodiment, the correlation module includes an RNC analyzer, a Gn snoop unit, and/or a mapping unit. The RNC analyzer is configured to collect wireless layer network element information from at least one RNC. The Gn snoop unit is configured to collect wireless layer network element information and IP layer traffic information from at least one Gn interface between a serving GPRS support node and a gateway GPRS support node. The mapping unit is configured to map the IP layer traffic and the wireless layer network elements in the network based on the collected IP layer traffic information and the collected wireless layer network element information. A method of correlating IP layer traffic and wireless layer network elements in a network is also disclosed.

Method and system for correlating IP layer traffic and wireless layer elements in a UMTS/GSM network

Wireless state information collected or inferred from a 3G wireless network is used to detect and prevent malicious attacks against the network.

Methods and devices for defending a 3G wireless network against malicious attacks

To address the problem of providing network-based security to mitigate and detect cheating in peer-to-peer (P2P) gaming architecture, an architecture suite called architectures with coordinator obfuscation for resilient P2P gaming networks (ACORN) is presented that uses a combination of low overhead, per-packet access authentication, moving-coordinator and cheat detection mechanisms to effectively mitigate security threats.

ACORN: providing network-level security in P2P overlay architectures

A method, apparatus, and computer-readable storage medium for generating a mobile flow record for a mobile flow of a mobile node are provided. A method includes receiving information associated with signaling traffic of the mobile node, receiving information associated with bearer traffic of the mobile node, and generating the mobile flow record by correlating the information associated with signaling traffic of the mobile node and the information associated with bearer traffic of the mobile node. The mobile flow record includes IP layer information associated with the mobile flow and wireless layer information associated with the mobile flow.

Method and apparatus for mobile flow record generation and analysis

Network architecture and related methods for maintaining traffic flow between clients and an end-server during a Denial of Service (DoS) attack are described herein. The network architecture includes a set of overlay nodes coupled between clients and a server. Each overlay node is able to rank and probe other nodes for purposes of selecting a best path for routing traffic to the end-server to resist a denial of service of attack. Probing is performed to detect overlay nodes having better performance based on one or more performance metrics (i.e., load, jitter, latency, loss rate). For instance, in one implementation probing detects lightly loaded overlay paths for purposes of routing traffic to the end-server, so as to maintain connectivity between the end-server and clients even under DoS attacks.

Network architecture and related methods for surviving denial of service attacks

In a wireless network, an architecture for wireless attack resistance (AWARE) detects power-drain denial-of-service (DoS) attacks by generating statistical measures relating the power consumption by a mobile unit and data transmitted to and from the mobile unit during normal operations of the wireless network. The AWARE architecture compares those statistical measures to current measures to detect a DoS attack if the current measure differs from the statistical measure by more than a specified threshold. If a DoS attack is detected, then the AWARE architecture can inhibit communications with the mobile unit to prevent the mobile from consuming too much power. The statistical measure may be an energy efficiency ratio relating the number of bits of data transmitted to or from the mobile unit over a specified time interval to the amount of power consumed by the mobile unit during that time interval.

Growing community of inventors

West Orange, NJ, United States of America

Samphel Norden