Abstract: An intrusion detection arrangement for communication networks comprising a network activity observer configured to monitor network traffic by the related traffic elements, such as data packets, thereof and to establish traffic profiles relative to the monitored traffic elements, such as one profile per each monitored traffic element, a misuse detector configured to determine a first indication of a probability of the profiled traffic representing malicious activity through co-operation with a model repository comprising at least one model characterizing a known intrusion attack, an anomaly detector configured to determine, at least logically in parallel with the misuse detector, a second indication of a probability of the profiled traffic representing anomalous activity through cooperation with a model repository comprising at least one model characterizing legitimate network activity, and a classifier configured to operate on said first and second indications to generate a classification decision on the natu

Abstract: A method, apparatus, and computer program for network analysis are provided. The method comprises: outputting, in a network analysis tool, display content comprising a layout of the communication network comprising network elements in the form of a plurality of network nodes and a plurality of communication interfaces connecting the plurality of network nodes, the display content further comprising compressed application information associated with at least one of the network elements, wherein the compressed application information indicates what type of user application data traffic is currently transferred through said at least one of the network elements; receiving an input to select at least one of the displayed network elements; and outputting, as a response to the input, detailed application information of the selected at least one of the displayed network elements.

Abstract: An intrusion detection arrangement (101) for communication networks comprising a network activity observer (102) configured to monitor network traffic by the related traffic elements, such as data packets, thereof and to establish traffic profiles relative to the monitored traffic elements, such as one profile per each monitored traffic element, a misuse detector (104) configured to determine a first indication of a probability of the profiled traffic representing malicious activity through co-operation with a model repository (106) comprising at least one model characterizing a known intrusion attack, an anomaly detector (108) configured to determine, at least logically in parallel with the misuse detector, a second indication of a probability of the profiled traffic representing anomalous activity through cooperation with a model repository (110) comprising at least one model characterizing legitimate network activity, and a classifier (112) configured to operate on said first and second indications to gene

Abstract: A method, apparatus, system, and computer program for analyzing properties of an application-specific end-to-end communication connection are presented. In a connection performance analysis apparatus, measurement data messages are received from a plurality of traffic-monitoring nodes arranged at selected intermediate points in a plurality of network segments of the application-specific end-to-end communication connection and from at least one end node of the end-to-end communication connection, wherein a measurement data message comprises information related to a travel time of at least one data packet of the end-to-end communication connection to the traffic-monitoring node or to the end node transmitting the respective measurement data message. Then, the connection performance analysis apparatus analyzes the received measurement data messages in order to determine a bottleneck of the end-to-end communication connection.

Abstract: The invention relates to a method, measurement arrangement, analyser and analyser program for debugging transmission failures in a telecommunication network. In the method, the analyser utilizes both internal events of a telecommunication component and signalling messages transmitted in the telecommunication network. Internal events and external signalling messages are combined or correlated for speeding de-bugging.

Abstract: There is provided a protocol analyser arrangement, comprising: more than one analyser module (100A, 100B, 100C) including: at least a processing unit (110) for controlling functions of the analyser module in each of the analyser modules; and a data transfer unit (106) coupled to the processing unit for communicating data with a data transmission system (221) in at least one analyser module. The more than one analyser module each further include a communication unit (108) coupled to the processing unit for communicating with one or more other communication units of the more than one analyser module thus forming a cluster of the analyser modules (210); and a processing unit (110) of any analyser module of the cluster of the analyser modules is configured to share processing resources of the analyser module with one or more other analyser modules in the cluster of the analyser modules.

Abstract: A network interface card for a measuring device and a manufacturing method thereof. The network interface card comprises a control unit for controlling the operation of the network interface card, and a line connection connected to the control unit for connecting the network interface card to a telecommunication network to be measured. The network interface card further comprises an internal control interface connected to the control unit for connecting the network interface card to an internal local bus of the measuring device and an external control interface connected to the control unit for connecting the network interface card to an external bus of the measuring device.