Nec Europe Ltd.

Nec Corporation

Yahoo Holdings, Inc.

Saverio Niccolini

Felipe Huici

Jan Seedorf

Maurizio Dusi

Andrea Di Pietro

Giuseppe Bianchi

Marcus Brunner

Mohamed Ahmed

Riccardo Paolillo

Michele Orru

Roman Schlegel

Stefan Schmid

Flavio Junqueira

Sandra Tartarelli

Giulio Picierro

Thilo Ewald

Takahide Sugita

Martin Stiemerling

Vincent Leroy

Berkant Barla Cambazoglu

Sofia Nikitaki

Nico D'Heureuse

Marco Serafini

Ivan Kelly

Stella Spagna

Christian Vitale

Diego Costantini

Michele Orru'

A method for analyzing a data flow includes: (a) extracting packet information of a packet, (b) determining a status of the packet based on the extracted packet information by applying at least one probabilistic filter to the packet and storing the packet for later inspection based on the status of the packet indicating that the packet is out-of sequence, and (c) inspecting the stored packet based on inspection rules. Upon a partial match of an inspection rule with the extracted packet information, a result of the inspection is temporarily stored. Already stored packets are inspected based on the already stored packets being in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted. The at least one probabilistic filter includes a connection Bloom filter and a sequence Bloom filter.

Method and system for analyzing a data flow

A method for analyzing a data flow includes extracting packet information of a packet of the data flow, determining the status of the packet and the status of the data flow based on the extracted packet information and storing the packet for later inspection when the status of the packet and/or the status of the data flow indicate that the packet is out-of sequence, and inspecting the packet and/or the stored packet based on inspection rules. Upon a partial match of at least one of the inspection rules with the extracted packet information, a result of the inspection of the packet is temporarily stored. Already stored packets are inspected when they are in-order with already inspected packets. Upon a total match of at least one of the inspection rules, a predetermined action is performed and the stored result is deleted.

A search engine for finding objects that correspond to a search request, including an input module for receiving a keyword query from a user, and a search module being configured to map the keyword query to the identifiers of objects that semantically match the keyword or the plurality of keywords contained in the keyword query, and to generate a search result that contains a listing of matching object identifiers, is characterized in that the search module is further configured to generate the search result by considering network layer information about the user within the process of mapping the keyword query to identifiers of matching objects, wherein the network layer information include sophisticated information the search module receives from a dedicated entity.

Search engine and method for performing a search for objects that correspond to a search request

A method for caching objects at one or more cache servers of a content delivery network (CDN) includes: determining, by a processor, attributes of objects of a set of objects; calculating, by the processor, an efficiency metric for each object of the set of objects based on the attributes of each object, wherein the attributes of each object include an expected future popularity associated with the object; selecting, by the processor, a subset of objects from the set of objects for caching based on calculated efficiency metrics; and caching the subset of objects at the one or more cache servers.

Efficient caching in content delivery networks based on popularity predictions

The invention is directed to a network, and method for operating a network, for allowing an effective traffic localization within an Application-Layer Traffic Optimization (ALTO), wherein an ALTO process is performed with regard to at least one application or resource consumer, and traffic information with respect to the at least one application or resource consumer will be provided and used within the ALTO process.

Method for operating a network and a network

For providing a simple monitoring mechanism with reduced resource and performance requirements a method for monitoring traffic in a network is claimed, wherein a monitoring activity of at least two monitoring probes of the network is coordinated by a coordinating element, wherein at least two nodes of the network are able to operate as coordinating elements and wherein the responsibility for coordinating the monitoring activity of the monitoring probes is split between the nodes according to a compressed representation of flow parameter keys. Further, an according network is described, preferably for carrying out the above mentioned method.

Method for monitoring traffic in a network and a network

A method for probabilistic processing of data, wherein the data is provided in form of a data set S composed of multidimensional n-tuples of the form (x, . . . , x), is characterized in that an n-dimensional data structure is generated by way of providing a bit matrix, providing a number K of independent hash functions Hthat are employed in order to address the bits in the matrix, and inserting the n-tuples (x, . . . , x) into the bit matrix by computing the hash values H(x) for all values x of the n-tuple for each of the number K of independent hash functions H, and by setting the resulting bits [H(x), . . . , H(x)] of the matrix. Furthermore, a respective system is disclosed.

Method and system for probabilistic processing of data using a bit matrix, tuples, and hash values

For allowing a very flexible scheduling of data flows within an OpenFlow (OF) switch a method for operating an OpenFlow switch within a network includes using the OpenFlow switch to direct arriving data flows out of different ports of the OpenFlow switch. The method is characterized in that a scheduling mechanism for performing at least one scheduling task is assigned to the OpenFlow switch, wherein a metric will be used to assign weights to the arriving data flows and wherein the data flows will then be scheduled based on the assigned weights and based on a scheduling policy. Further, a corresponding OpenFlow switch and a corresponding network are described, preferably for carrying out the above mentioned method.

Method for operating an openflow switch within a network, an openflow switch and a network

A method and system for detecting anomaly of user behavior in a network with a hierarchical topology, including a plurality of users, at least two bridges to each of which at least one user is connected to and wherein the bridges are configured to be operable to connect the corresponding users to the network, and at least one predetermined profiling network entity, the method includes the steps of:

Method and system for detecting anomaly of user behavior in a network

A method for detecting attacks to multimedia systems, wherein a communication path (1) is established within the multimedia system by a multimedia communication flow between a communication source and a communication destination, is characterized in that at least two devices (3, 4, 8) are provided along the communication path (1), each the device (3, 4, 8) acting as inspection device (2) that is enabled to inspect the multimedia communication flow that transits the inspection device (2), and that the results of the single inspections are accumulated along the communication path (1). Furthermore, a multimedia system with attack detection functionality is described.

Method for detecting attacks to multimedia systems and multimedia system with attack detection functionality

A method for monitoring a network, wherein the network has a connected graph topology, in particular a tree structure, including a plurality of monitoring nodes that collect network measurement data, a plurality of mediator nodes each performing at least the task of aggregating network measurement data received from different monitoring nodes and/or other mediator nodes, and at least one root entity that receives network measurement data and/or aggregated network measurement data from the mediator nodes, is characterized in that the aggregation of network measurement data is performed by condensing network measurement data into a summarized probabilistic data structure. Furthermore, a network including a monitoring functionality is disclosed.

Method for monitoring a network and network including a monitoring functionality

A network distribution monitoring method is executed by a computer which configures each of a plurality of nodes, in a network which comprises the plurality of nodes which are connected with a management network. The network distribution monitoring method includes: generating a first detection message by detecting a first traffic on an object network of a corresponding one of a plurality of first predetermined applications, in each of first probe nodes of the plurality of nodes; transmitting the first detection message to a node determined from a first hash value to only a first function identifier showing a kind of the corresponding one or the first function identifier and address data of the first traffic; generating a first mediation processing result by performing first mediation processing on the first detection message to the plurality of first applications, in a first mediation node of the plurality of nodes; and storing a result of the first mediation processing in a first collector node of the plurality of nodes. In this way, the distribution monitoring system is provided in which it is possible to monitor the advanced function.

Distribution monitoring system, distribution monitoring method, and program

A method for verifying the identity of a communication partner, in particular in real-time communications, wherein a caller (A) sends a message towards a callee (B), and wherein the caller (A) attaches a self-signed certificate to the message, characterized in that the caller (A) and the callee (B) are part of a web-of-trust, wherein certificates of users within the web-of-trust are stored by one or more key-servers (), wherein trust relationships between users within the web-of-trust are employed to compute a trust-chain between the caller (A) and the callee (B) based upon the certificate attached to the message and upon the callee's certificate, and wherein the further processing of the message received by the callee (B) is based on the length of the derived trust-chain. Furthermore, a corresponding system is described.

Method and system for verifying the identity of a communication partner

A method for protecting SIP (Session Initiation Protocol)-based applications wherein SIP messages are analyzed and malicious SIP messages that potentially constitute a security risk for the SIP-based application are identified is discloses. Regarding a realization of a particularly high security [level] with means that are easy to implement&#x2014;a pre-definable number N of pre-configurable parameters&#x2014;identities&#x2014;is extracted from the SIP messages and that for each SIP message a comparison of the identities with the identities extracted from previous SIP message is performed, on the base of which a maliciousness level ML is assessed for every SIP message.

Method for protecting SIP-based applications

A method for identifying undesired telephone calls (Spit/Spam over IP), preferably in a VoIP network, in which the telephone calls coming in for a telephone subscriber, the callee, from at least one calling telephone subscriber, the caller, are subjected to a test or more precisely to a statistical analysis. The method is developed in such a manner that in the framework of the test for incoming calls, the time of the receipt of each call is determined and in each case the probability that the call is undesired is determined, where for the calculation of the probability the time of the receipt of the call, or a parameter dependent thereon, is related to the temporal distribution of previous undesired calls.

Growing community of inventors

Heidelberg, Germany

Saverio Niccolini