Level 3 Communications, LLC

Sergey Yermakov

Travis Duane Ewert

Pete Joseph Caputo, Ii

Pete Joseph Captuo, Ii

In an embodiment, a computer implemented method receives flow data for one or more flows that correspond to a device-circuit pair. The method calculates a time difference for each flow that corresponds to a device-circuit pair. Based on the calculated time differences and the received flow data, the method updates a probability distribution model associated with the device-circuit pair. Then, the method determines whether a time bucket is complete or open based on the updated probability distribution model.

Creating aggregate network flow time series in network anomaly detection systems

In an embodiment, a method monitors a plurality of data streams passing through a router in the connectivity service provider environment, and for each of the data streams, periodically samples packets at the router. The method further generates a stream signature based at least on the payload of the sampled packets. The method further includes, for each generated stream signature, attaching information to the stream signature. Such information may, for example, include time-stamp information for the stream signature, or an identification of the router. The method may further comprise storing the stream signatures corresponding to the data streams in a database. The stored stream signatures may be compared to determine matching stream signatures. Matching signatures may identify data streams that carry identical or similar content.

Monitoring network traffic to determine similar content

In an embodiment, a computer implemented method receives flow data for a network flows. The method extracts a tuple from the flow data and calculates long-term and short-term trends based at least in part on the tuple. The long-term and short-term trends are compared to determine whether a potential network anomaly exists. If a potential network anomaly does exist, the method initiates a heavy hitter detection algorithm. The method forms a low-complexity intermediate stage of processing that enables a high-complexity heavy hitter detection algorithm to execute when heavy hitters are likely to be detected.

Low-complexity detection of potential network anomalies using intermediate-stage processing

A network customer may support a plurality of network connectivity services (such as an E-line). A network connectivity service may experience spikes of traffic, and therefore, spikes of bandwidth usage. Dynamic capacity allows a network connectivity service to increase its available bandwidth during such traffic spikes. A computer-implemented method is disclosed that facilitates identifying network customers that might be interested in purchasing dynamic capacity. The method comprises collecting bandwidth utilization data of network connectivity services supported by each network customer, and identifying those connectivity services that exhibit patterns (e.g., cogent peaks) in their utilization data indicating the network connectivity service is a candidate for dynamic capacity. A trained pattern recognition algorithm is applied on collected utilization data of all network connectivity services and identifies those connectivity services that match the patterns, within a range of tolerance, in their utilization.

Automatic customer bandwidth utilization analysis for promoting dynamic capacity

In an embodiment, a computer-implemented method receives and monitors performance metrics from network element. The method also includes receiving periodic control metrics corresponding to object instances. Performance metrics and control metrics provide information about operation of object instances. By monitoring the metrics, a network server is able to detect an operational flaw in the network. Monitoring the performance and control metrics in real time increases the speed of detecting any operational flaw in the network.

Network operational flaw detection using metrics

In an embodiment, a computer-implemented method compares metrics from different data flows to detect flaws in collection of data describing operation of a network. The method uses a first network data collection technique to collect a first metric describing a characteristic of a network interface. Using a second network data collection technique different from the first network data collection technique, a second metric describing the characteristic of the network interface is collected. The first metric is compared with the second metric to determine whether the first and second metrics are incongruous. When the first and second metrics are determined to be incongruous, a flaw is detected to exist in the first or second network data collection techniques.

Comparing metrics from different data flows to detect flaws in network data collection for anomaly detection

In an embodiment, a computer-implemented method provides a service on a network. The method includes the following steps: (a) requesting, on a router, executable instructions from a remote server, the executable instructions specifying how the router is to operate to provide a service requested for a user of the network; (b) receiving the instructions; (c) initializing, on the router, a thread to execute the received instructions; (d) determining that a configuration of the router has changed; and (e) when the configuration of the router is determined to have changed, executing, on the initialized thread, the instructions to apply the service in accordance with the change in the router's configuration.

Network service aware routers, and applications thereof

A method for providing a predicting bandwidth utilization for a customer of a connectivity service provider is disclosed. The method includes receiving bandwidth utilization data over time for a customer of a connectivity service provider. The method further includes training a machine learning model for the bandwidth utilization data during a time period based on the received data. In an embodiment, training the machine learning model includes determining a value for a parameter. The bandwidth utilization may be substantially periodic over the time period. Relying on the periodicity of the bandwidth utilization, the method further includes predicting, using the trained model, future bandwidth utilization over time.

Growing community of inventors

Littleton, CO, United States of America

Sergey Yermakov