At&t Intellectual Property I, L.p.

Willa Kay Ehrlich

David Hoeflin

Danielle Liu

Zhi Cui

Chaim Spielman

Stephen K Wood

Daniel F Hurley

Qinggang Zhou

Duc Phan

Marcus Wright

Jo A Frabetti

David Gross

Anestis Karasaridis

Carl Brian Rexroad

Jeanette LaRosa

Elissa Backas

Manuel Ortiz

Myra E Agostino

Farhan Mir

Yangyi Lu

Ratna Chakka

Eric Fermon

The described technology is generally directed towards methods for data latency evaluation. The techniques disclosed herein can provide useful information about when a data consumer can expect to receive data. Methods can create and compare data latency cumulative probability distributions comprising probabilities associated with different latency values, at various different levels of completeness.

Data latency evaluation

A processing system including at least one processor may obtain a first set of performance records of a database system, train a machine learning model in accordance with the first set of performance records, where the machine learning model that is trained in accordance with the first set of performance records is configured to predict a latency of a query transaction for a designated time period, present a user interface with a plurality of settings of the database system that are user-adjustable, where the plurality of settings is associated with at least a portion of the first set of performance records, calculate a first predicted latency of a query transaction at the designated time period via the machine learning model in accordance with a set of values of the plurality of settings, and present the first predicted latency via the user interface.

Reducing database system query transaction delay

Optimizing neighbor cell relationships for improving handover performance by interpreting handover failures is presented herein. A method can include receiving data representing a time series of failures of outgoing handovers corresponding to a wireless access point device, and determining, based on a determined condition corresponding to a metric, that a source cell of the wireless access point device is associated with an anomalous cell relation corresponding to the time series of the failures of the outgoing handovers in response to quantifying the time series based on the metric. In various examples, the quantifying can include quantifying the time series with respect to: a volume of the failures during a period of time, an entropy calculated on a probability distribution of the failures by determined relations between the source cell and target cells, and/or an entropy calculated on a probability distribution of determined outgoing handover outcomes.

Anomaly correlation mechanism for analysis of handovers in a communication network

A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers. Bot likelihood scores are determined for the resulting IP-address-aggregate-categories based on historically known bot IP addresses.

Bot-network detection based on simple mail transfer protocol (SMTP) characteristics of e-mail senders within IP address aggregates

A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.

System and method for detecting remotely controlled E-mail spam hosts

Methods for providing alerts in a network are disclosed. Some methods include collecting network traffic data corresponding to multiple subsets of network addresses during a predefined time interval. A suspect subset of the subsets of network addresses that corresponds to anomalous network activity may be identified based on the network traffic data and using at least one of multiple anomaly detection metrics. A source network address within the suspect subset of network addresses that corresponds to the anomalous network activity is identified. An alert corresponding to the source network address may be generated.

Methods, devices and computer program products for actionable alerting of malevolent network addresses based on generalized traffic anomaly analysis of IP address aggregates

A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate. In turn, the present method raises an alarm if the traffic aggregate's traffic share ratio to be evaluated exceeds or falls below the traffic share ratio threshold defined for the traffic aggregate.

Method and apparatus for volumetric thresholding and alarming on internet protocol traffic

Growing community of inventors

Highland Park, NJ, United States of America

Willa Kay Ehrlich