Abstract: A system for passive estimation of throughput in an electronic network is disclosed. The system may include an plurality of mobile devices configured to operate in the network and may further include an electronic data processor. The processor may be configured to access flow records for data flows associated with the mobile devices during a predetermined time interval. Additionally, the processor may be configured to annotate the flow records with an application field and a content provider field. The processor may also be configured to determine a flow type of each data flow based on the application field and the content provider field of the flow records. Furthermore, the processor may be configured to generate a throughput index that only includes non-rate-limited flow types. Moreover, the processor may be configured to estimate maximum throughput for each data flow having non-rate-limited flow types in the throughput index.

Abstract: A method and system for detecting the transmission of preidentified content, such as copyrighted material, over an Internet Service Provider (ISP) network. A set of rules is provided to identify one or more traffic flow profiles of data streams transmitting preidentified content. Preferably the rules are adaptively created through analysis of actual ISP data in conjunction with data suggesting an initial set of profile characteristics. The rules are applied to data streams being transmitted in the ISP network, so that data streams fitting one or more of the profiles are identified. A database contains, e.g., as digital signatures or fingerprints, one or more items of content whose transmission is sought to be detected. Data streams identified as matching a profile are analyzed to determine if their content matches an item of content in the database, and if so, an action is taken which may include interrupting the transmission, suspending an ISP account, or reporting the transmission.

Abstract: A method, computer readable medium and apparatus for performing content aware optimized tunneling in a communication network are disclosed. For example, the method authenticates a user endpoint device, establishes a tunnel to the user endpoint device if the user endpoint device is authenticated, analyzes content of a data packet transmitted through the tunnel to determine if the tunnel should be re-directed, and re-directs the tunnel to a gateway general packet radio services support node light based upon the content of the data packet.

Abstract: A method, a computer readable medium and an apparatus for providing a dynamic inactivity timer are disclosed. For example, the method monitors a timer for a time threshold associated with a burst of a plurality of bursts of packets, and determines if the timer for the time threshold associated with the burst has expired. The method predicts an inter-burst time for the burst, if the timer for the time threshold associated with the burst has expired and sets the dynamic inactivity timer in accordance with the inter-burst time for the burst.

Abstract: A method, a computer readable medium and an apparatus for inferring state transitions in a wireless communications network are disclosed. In one embodiment, the method infers a state promotion procedure. In another embodiment, the method infers a state demotion procedure.

Abstract: A system includes an information storage module and an inspection module. The information storage module is configured to store a plurality of tags. Each tag is associated with a known set of traffic types of a plurality of known sets of traffic types. The inspection module is configured to compare a traffic flow to a set of traffic types to determine a matching set of traffic types, request a tag from the information storage module, and mark the traffic flow with the tag. The tag corresponds to the matching set of traffic types.

Abstract: Statistical methods are used to observe packet flow arrival processes and to infer routing changes from those observations. Packet flow arrivals are monitored using NetFlow or another packet flow monitoring arrangement. Packet flow arrivals are quantified by counting arrivals per unit time, or by measuring an inter-arrival time between flows. When a change in packet flow arrivals is determined to be statistically significant, a change in network routing protocol is reported.

Abstract: A network includes a cache server and a network aware server that operates to determine an optimization between a cost of retrieving content from a communication network and a cost of caching content at the cache server. The optimization is determined as a minimum of a sum of a transit cost, a backbone cost, and a caching cost. The transit cost includes a money cost per data unit. The backbone cost includes a money cost per data unit and time unit. The caching cost includes a money cost per server unit. In response to determining the optimization, the network aware server sends a content identifier to the cache server, and the cache server receives the content identifier, determines a source of a content item, and if the source is the same as the content identifier, then cache the content item.

Abstract: A method, computer readable medium and apparatus for performing a demotion in a cellular communications network are disclosed. For example, the method receives a packet indicating that a batching transfer is completed, determines if a background packet was received after receiving the packet indicating that the batching transfer is completed and demotes a state of a state machine implemented by a radio network controller to a lower state if the background packet was not received.

Abstract: A computer implemented method includes identifying a universal resource locator and characterizing a traffic pattern associated with the universal resource locator. The traffic pattern can include referrer information, referring information, advertising network relationship information, and any combination thereof. The method can further include classifying the universal resource locator into a risk category based on the traffic pattern.

Abstract: A method, computer readable medium and apparatus for normalizing cellular communications network data are disclosed. For example, the method collects a data packet from the cellular communications network, modifies a time stamp of the data packet in accordance with a promotion delay time from the time stamp of the data packet to create a normalized data packet and processes the normalized data packet to optimize state machine configurations.

Abstract: Systems and methods for increasing the power and resource efficiency of a mobile network device are presented herein. More particularly, described herein is a novel Tail Optimization Protocol (TOP) and/or other mechanisms, systems and methods for enabling cooperation between a mobile device and an associated radio access network to eliminate idle periods (e.g., tails) when possible. Various systems and methods described herein can leverage the ability of applications and/or their associated connections to accurately predict a long tail time, from which a mobile device can notify an associated cellular network on such an imminent tail in order to allow the cellular network to immediately release tail resources. Various other aspects provided herein realize TOP via fast dormancy and/or other similar notification mechanisms, which enable a handset or other device to notify a cellular network for immediate resource release.

Abstract: A device includes a processor configured to determine a number of users in each of a plurality of wireless telephone cells of a trajectory in a wireless telephone network. The processor is also configured to determine handoff data between each adjacent pair of the wireless telephone cells, and to determine a first number of users traveling along the trajectory in the wireless telephone network while on a telephone call. The processor also calculates a total number of users associated with the trajectory in the wireless telephone network based on the handoff data between each adjacent pair of the wireless telephone cells, and based on the first number of users traveling along the trajectory while on the telephone call.

Abstract: An Internet service provider includes a cache server and a network aware server. The network aware server is operable to determine an optimization between a cost of retrieving content from a network and a cost of caching content from the network at the first cache server and then send a content identifier to the cache server. The cache server is operable to receive the content identifier, and determine the source of a content item. If the source is the same as the content identifier, then the cache server caches the content item.

Abstract: Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a desired quantity of flow record to sample, receiving a plurality of network flow record each summarizing a network flow of packets, calculating a hash for each flow record of based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, generating a priority from the calculated hash for each respective flow record, and sampling exactly the desired quantity of flow records, selecting flow records having a highest priority first. In one aspect, the method further partitions the plurality of flow records into groups based on flow origin and destination, generates an individual priority for each partitioned group, and separately samples exactly the desired quantity of flow records from each partitioned group, selecting flows having a highest individual priority first.

Abstract: A method, computer readable medium and system for automatically tracking content in a peer-to-peer environment are disclosed. For example, the method monitors a number of times each content title of a plurality of content titles are downloaded in the peer-to-peer environment, adds one or more content titles of the plurality of content titles that are downloaded above a predetermined threshold to a list, downloads each one of the one or more content titles in the list via the peer-to-peer environment and verifies that each one of the one or more content titles that are downloaded matches at least one content title in the list.

Abstract: Methods and apparatus to communicatively couple virtual private networks to virtual machines within distributive computing networks are disclosed. A disclosed example method includes receiving a request to provision a virtual machine from a virtual private network, determining a host for the virtual machine within a distributive computing network, creating the virtual machine within the host, communicatively coupling the virtual machine to a virtual local area network switch within the distributive computing network, configuring a portion of a router to be communicatively coupled to the virtual machine via the virtual local area network switch by specifying an address space within the router associated with at least one of the virtual machine or the virtual private network communicatively coupled to the router, and communicatively coupling the portion of the router to the virtual private network.

Abstract: Methods, systems, and computer-readable media for providing network-based audience measurement are provided. Data packets are intercepted between a client computer and a content server. Unique subscribers and content names are identified based on the data packets. One or more audience measurement metrics are computed based on the unique subscribers and the content names.

Abstract: Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value.

Abstract: A method and apparatus for inferring if an IP address allocation in a remote network is static or dynamic are disclosed. For example, the method contacts at least one remote peer to peer endpoint using a peer to peer application to obtain an IP address of the at least one remote peer to peer endpoint. The method then analyzes characteristics of the at least one remote peer to peer endpoint over a predefined period of time to infer whether the presence of static IP address allocation exists for the at least one remote peer to peer endpoint.