Alcatel Lucent

Cisco Technology, Inc.

Alcatel-lucent USA Inc.

Tian Bu

Aiyou Chen

Samphel Norden

Jin Cao

Li Erran Li

Thomas Y Woo

Scott Corey Miller

Susan Wu Sanders

Girish P Chandranmenon

Harish Doddala

Tej Redkar

Ramachandran Ramjee

Pak-Ching Lee

Ruth S Gayde

Moritz M Steiner

Xiaochun Mei

Puneet Anand

Yao Zhao

Georg Hampel

Swathi Bhat

Jia Xu

Scott Alan Vander Wiel

Kathleen Ellen Moczulewski

Alex Ibrahim Moukalled

Anand Prabhu Subramanian

Li (Erran) Li

Anupam Jindal

Yi Hong

Ruth Schaefer Gayde

Scott Miller

The disclosed technology relates identifying causes of an observed outcome. A system is configured to receive an indication of a user experience problem, wherein the user experience problem is associated with observed operations data including an observed outcome. The system generates, based on the observed operations data, a predicted outcome according to a model, determines that the observed outcome is within range of the predicted outcome, and identifies a set of candidate causes of the user experience problem when the observed outcome is within range of the predicted outcome.

Root cause discovery engine

Techniques for generating a hierarchical representation of a set of monitoring events. In some cases, an example system may generate a tree structure based on a set of monitoring events. The tree structure may be generated by: (i) extracting a set of feature values from the monitoring events, where the feature values may correspond to a defined set of event features, (ii) computing a set of entropy measures, each associated with one of the event features over all of the monitoring events, (iii) selecting an event feature for partitioning the events based on the entropy measures, (iv) dividing the events into subsets based on values of the selected feature, and (v) recursively partitioning the subsets based on entropy-selected features until a tree structure is formed.

Hierarchical event representation in extended detection and response systems

In one embodiment, a method for user performance journey monitoring is disclosed. The method illustratively comprises receiving, by a process, user journey information associated with an application and a plurality of application end users, the user journey information indicative of navigation paths of the application end users among a plurality of nodes configured to perform at least a part of the application; receiving, by the process, performance metric information indicative of performance of the plurality of nodes configured to perform at least the part of the application; correlating, by the process, the user journey information with the performance metric information based on one or more query criteria; and storing, by the process, the correlated user journey information and performance metric information in an application end user journey database indexed by the one or more query criteria.

Out of box user performance journey monitoring

A software-defined network overlay capability is configured to control one or more overlay networks using software-defined networking (SDN) in which control functions and forwarding functions are separated. The software-defined network overlay capability may be configured to vertically move packets across network layers, e.g., into an overlay network (e.g., into a tunnel via encapsulation), out of an overlay network (e.g., out of a tunnel via decapsulation), or the like. The software-defined network overlay capability may be configured to move packets from native forwarding infrastructure into an overlay network, between overlay networks (e.g., into a first overlay network from a second overlay network without leaving the second overlay network, out of a first overlay network and into a second overlay network, out of a first overlay network while remaining within a second overlay network, or the like), from an overlay network onto native forwarding infrastructure, or the like.

Software-defined network overlay

A method and computer product are presented for identifying Internet worm propagation based upon changes in packet arrival rates at a network connection. First, unsolicited (i.e., packets that were not requested by the receiver) traffic is separated from solicited traffic at the network connection. The unsolicited traffic arrival patterns are monitored and analyzed for any changes. Once changes in the unsolicited traffic arrival patterns are detected, the changes are mathematically analyzed to detect growth trends. The presence of growth trends that follow certain key characteristics indicate whether the changes are due to worm propagation.

Evaluation of a fast and robust worm detection algorithm

The present invention relates to a correlation module for correlating IP layer traffic and wireless layer network elements in a network. According to an example embodiment, the correlation module includes an RNC analyzer, a Gn snoop unit, and/or a mapping unit. The RNC analyzer is configured to collect wireless layer network element information from at least one RNC. The Gn snoop unit is configured to collect wireless layer network element information and IP layer traffic information from at least one Gn interface between a serving GPRS support node and a gateway GPRS support node. The mapping unit is configured to map the IP layer traffic and the wireless layer network elements in the network based on the collected IP layer traffic information and the collected wireless layer network element information. A method of correlating IP layer traffic and wireless layer network elements in a network is also disclosed.

Method and system for correlating IP layer traffic and wireless layer elements in a UMTS/GSM network

Wireless state information collected or inferred from a 3G wireless network is used to detect and prevent malicious attacks against the network.

Methods and devices for defending a 3G wireless network against malicious attacks

Novel, Internet-related architectures, methods and devices are proposed that are based on a fundamentally different philosophy: hosts (e.g., source and destination nodes) are given the ability to specify their access control policies to the network they are a part of, and the network enforces these policies. The architecture proposed is mobility friendly to the ever increasing number of mobile hosts and is scalable as well.

Methods and systems for providing controlled access to the internet

Various exemplary embodiments relate to a method and related network node including one or more of the following: identifying, at the network node, a packet associated with a first address; determining, at the network node, that an alternate address mapping is unknown to the network node for the first address; generating a request message based on at least a portion of the packet; transmitting the request message to a different node; receiving a response message, the response message including a second address, wherein the second address is an alternative address for the first address; and storing the first address and the second address together as an alternate address mapping.

Mapping private and public addresses

The transmission of data from base stations to users (and their devices) in a wireless network is made using proportional fairness without sacrificing throughput by taking in to account fairness considerations at the time the devices are associated with a base station.

Methods and devices for associating users to base stations in third generation wireless networks using fairness considerations

An apparatus and method for improving synchronization between threads in a multi-core processor system are provided. An apparatus includes a memory, a first processor core, and a second processor core. The memory includes a shared ring buffer for storing data units, and stores a plurality of shared variables associated with accessing the shared ring buffer. The first processor core runs a first thread and has a first cache associated therewith. The first cache stores a first set of local variables associated with the first processor core. The first thread controls insertion of data items into the shared ring buffer using at least one of the shared variables and the first set of local variables. The second processor core runs a second thread and has a second cache associated therewith. The second cache stores a second set of local variables associated with the second processor core. The second thread controls extraction of data items from the shared ring buffer using at least one of the shared variables and the second set of local variables.

Method and apparatus for using a shared ring buffer to provide thread synchronization in a multi-core processor system

A method, apparatus, and computer-readable storage medium for generating a mobile flow record for a mobile flow of a mobile node are provided. A method includes receiving information associated with signaling traffic of the mobile node, receiving information associated with bearer traffic of the mobile node, and generating the mobile flow record by correlating the information associated with signaling traffic of the mobile node and the information associated with bearer traffic of the mobile node. The mobile flow record includes IP layer information associated with the mobile flow and wireless layer information associated with the mobile flow.

Growing community of inventors

Basking Ridge, NJ, United States of America

Tian Bu