Abstract: A method and system for identifying causes of performance metric changes in a network by selecting, from a pool of network event counters, a plurality of candidate counters relevant to a performance metric; grouping the candidate counters into clusters of similar counters; selecting, from each cluster, one or more representative counters; and fitting the selected representative counters to a model of the performance metric to determine thereby a set of representative counters most relevant to the performance metric.

Abstract: In one embodiment, a method for detecting malicious software agents, such as domain-flux botnets. The method applies a co-clustering algorithm on a domain-name query failure graph, to generate a hierarchical grouping of hosts based on similarities between domain names queried by those hosts, and divides that hierarchical structure into candidate clusters based on percentages of failed queries having at least first- and second-level domain names in common, thereby identifying hosts having correlated queries as possibly being infected with malicious software agents. A linking algorithm is used to correlate the co-clustering results generated at different time periods to differentiate actual domain-flux bots from other domain-name failure anomalies by identifying candidate clusters that persist for relatively long periods of time.

Abstract: According to an embodiment, a computing system includes at least one computing device including a processor configured to use a logistic regression model to provide an indication of a relationship between a user's position within an enterprise and how the user interacts with other users of an enterprise social network.

Abstract: An oxy-fuel burner that co-fires liquid fuel and gaseous fuel to create a more luminous flame. The characteristics of a liquid fuel spray and the gaseous fuel and primary oxidant gas flows, as well as the geometry of the burner is adapted to shroud the liquid fuel from the primary oxidant until it exits a precombustor and to prevent the liquid fuel from contacting the walls of the precombustor.

Abstract: In one embodiment, a method of monitoring a network. The method includes: receiving, from each host of a set of two or more hosts of the network, a corresponding vector of M components constructed based on data packets received at the host during a time period, M being an integer greater than 1; and, based on the constructed vectors, using an expectation-maximization algorithm to estimate a cardinality distribution for the hosts in the set, wherein constructing a vector includes updating a component of the vector of the corresponding host in response to the corresponding host receiving a data packet, the updating including selecting the component for updating by hashing one or more fields of the data packet received by the corresponding host.

Abstract: Burner assembly for use in industrial heating and melting applications of material susceptible to oxidation at elevated temperatures is comprised of a flow passage of oxidant surrounded by an annular flow passage of fuel whereby the oxidant is substantially contained inside the fuel layer up to at least 5 oxidant nozzle diameters downstream of the burner outlet in order to minimize contact between the oxidant and the furnace load.

Abstract: In one embodiment, a method of monitoring a network. The method includes, at each node of a fixed set, constructing a corresponding vector of M components based on data packets received at the node during a time period, M being an integer greater than 1, the fixed set being formed of some nodes of the network; and, based on the constructed vectors, estimating how many of the received data packets have been received by all of the nodes of the set or estimating how many flows of the received data packets have data packets that have passed through all of the nodes of the set. The constructing includes updating a component of the vector of one of the nodes in response to the one of the nodes receiving a data packet. The updating includes selecting the component for updating by hashing a property of the data packet received by the one of the nodes.

Abstract: A premix burner arrangement for safely oxygen-enriching a premix air-fuel combustion system is disclosed. In the disclosed burner arrangement, a first conduit is arranged and disposed to provide a first gas stream. The first gas stream is a self-reactive or self-flammable premixture comprising air and a combustible gas. At least one second conduit is arranged and disposed to provide a second gas stream circumferentially around the first gas stream. The second gas stream includes oxygen. The premix burner arrangement is configured to combust or react the first stream at a temperature at least 1000° F. greater than the temperature of the second stream. A method and combustion system including the premix burner arrangement are also disclosed.

Abstract: A heating method for heating vessels, the vessels having enclosed spaces therein and controlling air ingress into the enclosed spaces through gaps. The method includes providing a lid structure for the vessel having the enclosed space, the lid structure having a burner assembly mounted therein. The burner is configured to provide a predetermined flame diameter. The vessel and lid structure are mated such that the gap is formed between the vessel and the lid structure. Fuel and oxidant are discharged from the burner assembly under conditions to provide the predetermined flame diameter and impart a flame velocity sufficiently large to create an outward gas flow from the enclosed space through the gap and control air ingress.

Abstract: A method is provided, according to which data are collected on downstream packet losses at a single point in a network. From from the collected data, packet loss rates are estimated on at least two subnetworks downstream of the collection point. The respective subnetworks may differ by one or more links.

Abstract: In one embodiment, a method of monitoring a network. The method includes, at each node of a set, constructing a corresponding vector of M components based on a stream of data packets received at the node during a time period, the set including a plurality of nodes of the network, M being greater than 1; and estimating a value of a byte traffic produced by a part of the packets based on the constructed vectors, the part being the packets received by every node of the set. The constructing includes updating a component of the vector corresponding to one of the nodes in response to the one of the nodes receiving a data packet. The updating includes selecting a component of the vector to be updated by hashing a property of the received data packet.

Abstract: A method of heating a charge material by controlling heat flux in a tilt rotary furnace is disclosed. Combustion by the burner forms a heat release profile including a high heat flux region. The positioning of the high heat flux region is controllable by providing a controlled amount of secondary or staged oxidant. The burner is configured and controlled to position a region of high heat flux at a position corresponding to an area requiring greater heating, such as the area of maximum charge depth in the furnace to provide substantially uniform melting and heat distribution.

Abstract: In one embodiment, a method for detecting malicious software agents, such as domain-flux botnets. The method applies a co-clustering algorithm on a domain-name query failure graph, to generate a hierarchical grouping of hosts based on similarities between domain names queried by those hosts, and divides that hierarchical structure into candidate clusters based on percentages of failed queries having at least first- and second-level domain names in common, thereby identifying hosts having correlated queries as possibly being infected with malicious software agents. A linking algorithm is used to correlate the co-clustering results generated at different time periods to differentiate actual domain-flux bots from other domain-name failure anomalies by identifying candidate clusters that persist for relatively long periods of time.

Abstract: A network-equipment-implemented method and apparatus for tracking durations of flows received at a network node in consecutive intervals utilizes two counting bloom filters in ping-pong operation to reduce memory and processing. Identifiers for flows that exceed a predetermined duration or number of intervals are stored in a long-duration flow-identifier table. Hash functions used within the counting bloom filters and optionally used in the long-duration flow-identifier table are chosen to minimize the probability of false positives in the detection of long-duration flows. In some embodiments, flows are sampled to conserve memory and processing resources at the risk of missing detection of some long-duration flows.

Abstract: In one embodiment, a counting method of the invention uses an adaptive sketching-update process to compress an unknown cardinality into a counter value that counts the number of binary ones in a hashed bitmap vector. The sketching-update process is probabilistic in nature and uses bit-flip probabilities that are adaptively decreased as the counter value increases. Parameters of the sketching-update process are selected so that the relative error of cardinality estimates obtained based on the counter values is relatively small and substantially constant over a relatively wide range of cardinalities, e.g., from one to about one million. Due to the latter property, the counting method can advantageously be implemented in the form of embedded software that relies on a relatively small, fixed amount of memory.

Abstract: Burner assembly for use in industrial heating and melting applications of material susceptible to oxidation at elevated temperatures is comprised of a flow passage of oxidant surrounded by an annular flow passage of fuel whereby the oxidant is substantially contained inside the fuel layer up to at least 5 oxidant nozzle diameters downstream of the burner outlet in order to minimize contact between the oxidant and the furnace load.

Abstract: A network-equipment-implemented method and apparatus for tracking durations of flows received at a network node in consecutive intervals utilizes two counting bloom filters in ping-pong operation to reduce memory and processing. Identifiers for flows that exceed a predetermined duration or number of intervals are stored in a long-duration flow-identifier table. Hash functions used within the counting bloom filters and optionally used in the long-duration flow-identifier table are chosen to minimize the probability of false positives in the detection of long-duration flows. In some embodiments, flows are sampled to conserve memory and processing resources at the risk of missing detection of some long-duration flows.

Abstract: A method is provided, according to which data are collected on downstream packet losses at a single point in a network. From from the collected data, packet loss rates are estimated on at least two subnetworks downstream of the collection point. The respective subnetworks may differ by one or more links.

Abstract: A method and apparatus are provided for incrementally tracking quantiles in the presence of multiple record types. A method for performing incremental quantile tracking includes receiving a first data record of a first record type having a first data value, determining whether a second data record of a second record type is received, determining an initial distribution function, updating the initial distribution function to form a new distribution function based on the first data value and whether a second data record is received, generating an approximation of the new distribution function, determining at least one new quantile estimate associated with at least one new probability of the new distribution function using the approximation of the new distribution function, and storing the at least one new quantile estimate and the at least one new probability associated with the at least one new quantile estimate.

Abstract: A method and apparatus for incremental tracking of multiples quantiles is provided. A method for performing an incremental quantile update using a data value of a received data record includes determining an initial distribution function, updating the initial distribution function to form a new distribution function based on the received data value, generating an approximation of the new distribution function, and determining new quantile estimates from the approximation of the new distribution function. The initial distribution function includes a plurality of initial quantile estimates and a respective plurality of initial probabilities. The initial distribution function is updated to form the new distribution function based on the received data value. The new distribution function includes a plurality of quantile points identifying the respective initial quantile estimates and a respective plurality of new probabilities associated with the respective initial quantile estimates.