At&t Intellectual Property I, L.p.

University of Minnesota

Narus, Inc.

Fujitsu Corporation

Sprint Communications Comapny L.p.

Zhi-Li Zhang

Bo Han

Vijay Gopalakrishnan

Yang Zhang

Muhammad Bilal Anwer

Antonio Nucci

Supranamaya Ranjan

Sabyasachi Saha

Ruben Torres

Supratik Bhattacharyya

Aman M Shaikh

Marco Platania

Yiwei Thomas Hou

Joshua Reich

Hesham Mekky

Kuai Xu

Subhabrata Bapi Sen

Patrick Guy Haffner

Nicholas G Duffield

Sung-Ju Lee

Aleksandar Kuzmanovic

Yong Liao

Yu Jin

Marios Iliofotou

Han See Song

Ning Xia

Pengkui Luo

Zhenhai Duan

Systems and methods are disclosed for parallelizing service function chains. A method comprises receiving a sequential service function chain comprising a plurality of network functions, receiving a plurality of operations, determining at least two network functions are capable of being parallelized, aggregating operations of the plurality of operations associated with the at least two network functions into a network function segment, determining whether another network function is capable of being parallelized with the network function segment, based on the determining: aggregating an operation associated with the another network function into the network function segment when the another network function is capable of being parallelized with the network function segment, or pushing the network function segment as a completed segment of a hybrid service function chain when the another network function is not capable of being parallelized with the network function segment, and implementing the hybrid service function chain.

Controlling parallel data processing for service function chains

Systems, computer-readable media, and methods are disclosed for parallel data processing for service function chains with network functions spanning multiple servers. An example system includes a first server hosting a first network function of a service function chain, a second server hosting a second network function of the service function chain, a mirror function deployed in a first switch to replicate a plurality of packets received by the system and to send respective copies of the plurality of packets to the first network function and to at least one of the second network function and a third network function of the service function chain, and a merge function deployed in a second switch to merge respective outputs of the first network function and the at least one of the second network function and the third network function.

Parallel data processing for service function chains spanning multiple servers

The concepts and technologies disclosed herein are directed to a network-assisted Raft consensus protocol, referred to herein as 'NetRaft.' According to one aspect of the concepts and technologies disclosed herein, a system can include a plurality of servers operating in a server cluster, and a plurality of P4 switches corresponding to the plurality of servers. Each server of the plurality of servers can include a back-end that executes a complete Raft algorithm to perform leader election, log replication, and log commitment of a Raft consensus algorithm. Each P4 switch of the plurality of P4 switches can include a front-end that executes a partial Raft algorithm to perform the log replication and the log commitment of the Raft consensus algorithm. The back-end can maintain a complete state for responding to requests that cannot be fulfilled by the front-end. The requests can include read requests and/or write requests.

Network-assisted consensus protocol

The concepts and technologies disclosed herein are directed to parallelism for virtual network functions ('VNFs') in service function chains ('SFCs'). According to one aspect, a packet processing system can receive instructions to process, in parallel, at least a portion of a plurality of data packets associated with an SFC including a plurality of VNFs. The system can create a copy of at least the portion of the data packets. The system can send the copy of at least the portion of the data packets to at least two VNFs. The at least two VNFs can process, in parallel, the copy of at least the portion of the data packets. The system can receive, from the at least two VNFs, processed packets including the copy of at least the portion of the data packets and processed, in parallel, by the at least two VNFs. The system can combine the processed packets.

Parallelism for virtual network functions in service function chains

Network-assisted raft consensus protocol

A method for detecting malicious HTTP redirections. The method includes obtaining, based on a single client IP address, HTTP flows triggered by visiting a website, extracting a sequence of URLs where a downstream URL is extracted from a child HTTP request that is triggered by a parent HTTP request containing an immediate upstream URL, analyzing the URL sequence to generate a statistical feature, and classifying, based on the statistical feature, the HTTP flows as containing at least one malicious HTTP redirection triggered by visiting the website.

Detecting malicious HTTP redirections using user browsing activity trees

A method for detecting a malicious node in a network. The method includes obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name, generating, by a computer processor and using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm, determining, by the computer processor and using a pre-determined formula, a score representing statistical characteristics of the cluster, and assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.

Detecting suspicious network behaviors based on domain name service failures

In one embodiment, the present disclosure is a method and apparatus for classifying applications using the collective properties of network traffic. In one embodiment, a method for classifying traffic in a communication network includes receiving a traffic activity graph, the traffic activity graph comprising a plurality of nodes interconnected by a plurality of edges, where each of the nodes represents an endpoint associated with the communication network and each of the edges represents traffic between a corresponding pair of the nodes, generating an initial set of inferences as to an application class associated with each of the edges, based on at least one measured statistic related to at least one traffic flow in the communication network, and refining the initial set of inferences based on a spatial distribution of the traffic flows, to produce a final traffic activity graph.

Method and apparatus for classifying applications using the collective properties of network traffic in a traffic activity graph

A method for profiling user activity in a mobile network, including extracting user identifiers from application sessions identified from a mobile network, analyzing the application sessions to determine session blocks based on shared IP address and a minimum separation time threshold, extracting a traffic marker from the session blocks based on a user identifier, identifying a first portion of the session blocks based on the user identifier, wherein the first portion is associated with first mobile network activities of a user identified by the user identifier, identifying a second portion of the session blocks based on the traffic marker, wherein the second portion is associated with second mobile network activities of the user, and analyzing the first portion and the second portion to determine a measure of a mobile network activity of the user.

Quantifying privacy leakage in mobile networks

Growing community of inventors

Eden Prairie, MN, United States of America

Zhi-Li Zhang