Abstract: A processing system may obtain a first network event data set associated with a telephone number, where the first network event data set includes identifier matching data associated with the telephone number. The processing system may next apply an input data set comprising at least the first network event data set to a machine learning model implemented by the processing system to obtain an authenticity score associated with the telephone number, where the machine learning model is configured to generate the authenticity score associated with the telephone number in accordance with the input data set. The processing system may next obtain a request from a first authentication service for the authenticity score associated with the telephone number and may transmit the authenticity score associated with the telephone number to the first authentication service in response to the request.

Abstract: Described is allocating and deallocating server instances (e.g., comprising baseband unit resources) of a distributed unit based on need for user equipment session handling. For example, when user equipment sessions load a server instance to a threshold capacity, an additional server instance can be allocated to handle new user equipment sessions. Any selected carrier subgroup, which can correspond to a cell's carriers, can be selected for assigning any newly incoming, unassigned user equipment sessions associated with the selected carrier subgroup to the newly allocated, additional server instance. As prior sessions end, the load decreases on the server that had reached the threshold capacity. When the total hub load decreases, deallocation of a no-longer used server instance can be performed. Deallocation can include transferring any remaining session, e.g., long-lasting sessions, to a different server instance.

Abstract: The concepts and technologies disclosed herein provide high availability and high utilization cloud data center architecture for supporting telecommunications services. According to one aspect of the concepts and technologies disclosed herein, a 4-site model of application placement within the cloud computing environment provides 37.5% resource utilization with site availability of five 9s (99.999%) and virtual machine availability of five 9s. According to another aspect of the concepts and technologies disclosed herein, a 3-site model of application placement within the cloud computing environment provides 66% resource utilization with site availability of five 9s and virtual machine availability of five 9s. According to another aspect of the concepts and technologies disclosed herein, a 4-site model of application placement within the cloud computing environment provides 75% resource utilization with site availability of five 9s and virtual machine availability of five 9s.

Abstract: Described is centralized scheduling of baseband unit resources of a hub, including allocating and deallocating baseband unit resources of a distributed unit instance based on anticipated and/or actual demand for the resources. For example, when user equipment transitions to a connected state, a corresponding message can be detected and used to determine whether sufficient baseband unit resources exist to handle the traffic of the newly connecting user equipment. If not, additional baseband unit resources are allocated, coupled to a node (cell), and the node scheduled to handle the user equipment traffic. When user equipment transitions to an inactive state, the corresponding command can be detected and used to determine whether the baseband unit resources are still needed for other traffic. If not, the baseband unit resources are deallocated.

Abstract: The concepts and technologies disclosed herein are directed detecting and mitigating drive-by home WI-FI hijack attacks. According to one aspect, a war driving activity correlation system can obtain a report from a home gateway system. The report can identify a suspicious device attempting to connect to a WI-FI network provided, at least in part, by the home gateway system. The war driving activity correlation system can determine, based upon the report, a route of an attacker who uses the suspicious device. The war driving activity correlation system can send instructions to the home gateway system. The instructions can include the route and can specify one or more mitigation actions to be performed by the home gateway system, such as blacklisting a media access control address associated with the suspicious device. The mitigation action(s) can be based upon one or more policies.

Abstract: Aspects of detecting and mitigating denial of service (“DoS”) attacks over home gateway network address translation (“NAT”) are disclosed herein. According to one aspect disclosed herein, a home gateway system can detect that a NAT table is overpopulated. In response to detecting that the NAT table is overpopulated, the home gateway system can determine a mitigation action to be performed. The home gateway system can then perform the mitigation action in an attempt to mitigate an effect of the NAT table overpopulation.

Abstract: A distributed denial of service (“DDoS”) attack profiler can determine a plurality of DDoS attack properties associated with a DDoS attack that utilizes an Internet of Things (“IoT”) device operating in communication with a home gateway. The DDoS attack profiler can create a DDoS attack profile and can provide a DDoS attack report based upon the DDoS attack profile to a correlator. An IoT device profiler can determine a plurality of IoT device properties and can create, based upon the plurality of IoT device properties, an IoT device profile. The IoT device profiler can create an anomaly report that identifies an anomaly associated with the IoT device. The correlator can correlate the DDoS attack report with the anomaly report to determine if a match exists. In response to determining that the match exists, the home gateway system can store the bot match record in a bot match repository.

Abstract: The concepts and technologies disclosed herein are directed to home gateway monitoring for vulnerable home Internet of Things (“IoT”) devices. According to one aspect disclosed herein, a home gateway can scan a home network address space of a home network for an IoT device. The home gateway can perform a vulnerability test on the IoT device to determine whether the IoT device is vulnerable to a known vulnerability. In response to determining that the IoT device is vulnerable to the known vulnerability, the home gateway can change a device status of the IoT device to a vulnerable status and can change a permissions level of the IoT device to a quarantine permissions level.

Abstract: An access point impersonation protection system (“the system”) can scan for wireless network signals to detect a wireless network provided by a malicious access point. The system can collect a network feature associated with the wireless network. The system can analyze the network feature and can provide analysis results to a machine learning classifier. The machine learning classifier can assign a classification to the access point. The classification can be a benign classification indicative of the access point being benign. The classification can be a malicious classification indicative of the access point being malicious. The network feature can be an active time, an SSID name, a vendor, a model, a signal strength, an authentication requirement, or a combination thereof. The system can alert upon identifying a malicious access point and apply counter measures to prevent the malicious access point from causing harm to nearby devices.

Abstract: Aspects of the subject disclosure may include, for example, a drone service retrieving network state information describing a network state of at least a portion of a communication network, determining an impact of the network state on operation of an unmanned aerial vehicle (UAV), selecting a carrier frequency to be used for communication by the UAV, and providing the data describing the carrier frequency to the UAV and/or to communication network nodes. Other embodiments are disclosed.

Abstract: The disclosed technology is directed towards load balancing baseband units in a communications network. A baseband physical layer 1 unit’s functions are disaggregated into Layer 1 (L1) distributed units and radio units, instead of deploying full-fledged baseband units at a service’ provider’s service areas (cells). A load balancer scales up the number of active distributed units based on increased actual demand, and scales down the active distributed units based on decreased demand. The L1 distributed units and radio units can be software-defined network functions, and need not be collocated, whereby the distributed units can be in the cloud or hub remotely located relative to the radio units deployed at the service areas. Examples of load balancing can be load balancing of transmitted data per carrier, per subcarrier, per user equipment, per transmission time interval (TTI / slot), per bearer, or per channel.

Abstract: Described is pooling baseband units into a hub and mapping radio units associated with the hub to baseband units of the group based on respective resource capacity data of the respective baseband units and an estimated resource usage data of a device that couples to a baseband unit. In one alternative, estimated peak resource usage data of a radio unit over an operation interval is used to select a baseband unit, generally based on which baseband unit of the pool has the least remaining resource capacity, to which the radio unit is mapped for the operation interval. In another alterative, estimated peak resource usage data resource (usage and duration) of a user equipment session is used to dynamically map the user equipment session to a baseband unit, generally selected by which baseband unit of the pool has the least remaining resource capacity.

Abstract: Described is allocating and deallocating baseband unit resources of a distributed unit based on anticipated and/or actual demand for the resources. For example, when user equipment transitions to a connected state, a corresponding message can be detected and used to determine whether sufficient baseband unit resources are needed to handle the traffic of the newly connecting user equipment. If not, additional baseband unit resources are allocated. When user equipment transitions to an inactive state, the corresponding command can be detected and used to determine whether the baseband unit resources are still needed for other traffic. If not, baseband unit resources are deallocated; that is, if a distributed unit's resources are no longer needed, the distributed unit's resources are deactivated to reduce resource consumption. Deallocation can be performed by changing the resources to a power conservation (e.g., sleep) state, with allocation performed by changing such resources back to an active state.

Abstract: Aspects of the subject disclosure may include, for example, a network API service that receives network event data and provides performance hints to a resource manager that manages application containers at edge cloud locations. Network event data may be received from access networks, core networks, nodes within access networks or core networks, or the like. Performance hints may allow booting of application containers at edge cloud locations. Other embodiments are disclosed.

Abstract: Example mobile devices disclosed herein include a camera, memory including computer-executable instructions, and a processor to execute the instructions to at least associate a location of the mobile device with picture data obtained with the camera. The processor is also to assign a first data tag to the picture data when the location of the mobile device corresponds to a first area, the first data tag to identify a first security level for the picture data, or assign a second data tag to the picture data when the location of the mobile device does not correspond to the first area, the second data tag to identify a second security level for the picture data. The processor is further to determine whether to permit an application to access the picture data based on whether the first data tag or the second data tag is assigned to the picture data.

Abstract: The described technology is generally directed towards intelligent dual-connectivity for non-standalone network nodes. Network nodes can report state information to a central controller, such as a radio access network intelligent controller. The controller can determine, based on the state information reported by multiple network nodes, network nodes to cooperate in non-standalone mode. The controller can provide the network nodes with instructions to implement the controller's non-standalone relationship determinations.

Abstract: A system can include a gateway, a plurality of network function nodes, and a distributed load balancer including load balancer nodes each having a flow table portion stored thereon. The load balancer nodes can form a node chain having a tail and head nodes. A load balancer node can receive a packet from the gateway. In response, the load balancer node can generate a query, directed to the tail node, that identifies the packet and a network function identifier associated with a network function node that is proposed to handle a connection. The tail node can determine whether an entry for the connection exists in a flow table portion associated with the tail node. If not, the tail node can initiate an insert request for writing the entry for the connection via the head node. The entry can then be written to all load balancer nodes in the node chain.

Abstract: The described technology is generally directed towards a cellular network area optimizer. The area optimizer observes cellular network conditions at multiple radio access network (RAN) nodes within a target area. Based on observed conditions, the area optimizer applies a set of parameter values at the multiple RAN nodes. The set of parameter values enhances the overall throughput, while maintaining or improving connection retainability and accessibility, of the multiple RAN nodes under the observed conditions. The area optimizer learns different sets of parameter values to apply in response to different observed conditions by making parameter value adjustments and observing the effect of the adjustments on overall throughput of the RAN nodes in the target area.

Abstract: The concepts and technologies disclosed herein provide high availability and high utilization cloud data center architecture for supporting telecommunications services. According to one aspect of the concepts and technologies disclosed herein, a 4-site model of application placement within the cloud computing environment provides 37.5% resource utilization with site availability of five 9s (99.999%) and virtual machine availability of five 9s. According to another aspect of the concepts and technologies disclosed herein, a 3-site model of application placement within the cloud computing environment provides 66% resource utilization with site availability of five 9s and virtual machine availability of five 9s. According to another aspect of the concepts and technologies disclosed herein, a 4-site model of application placement within the cloud computing environment provides 75% resource utilization with site availability of five 9s and virtual machine availability of five 9s.

Abstract: Systems and methods may create and manage hybrid clouds including both standard compute nodes and edge devices. Edge devices can be enrolled in a hybrid cloud by deploying a lightweight container to the edge device.