Abstract: Evaluating financial risk for a target business by extracting a plurality of financial factors from a financial memory. Based on applying a changepoint algorithm, determining one or more segments of financial data. Identifying one or more trends within one or more segments of financial data. Based on extrapolating one or more trends, calculating one or more figures of merit. Extracting one or more comparable figures of merit from one or more comparable business from a figure of merit memory. Transforming one or more comparable figures of merit into a baseline distribution. Based on the baseline distribution, determining a percentile for a target business. Storing the target figure of merit into a figure of merit memory.

Abstract: Calculating an interest rate for a loan comprises by receiving a credit score of a borrower and receiving a historical timeseries of balance data of the borrower. Determining a probability of default based on a modelling of the plurality of future balances. Transforming the historical timeseries into an implied timeseries based on a modelling of a plurality of future balances of the implied timeseries wherein the implied probability of default substantially equals the reference probability of default. Based on the implied timeseries, determining a worst-case plurality of future balances over the period of the loan and determining a worst-case probability of default. Based on the implied timeseries, determining a best-case plurality of future balances over the period of the loan and determining a best-case probability of default. Combining the worst-case probability of default and the best-case probability of default to calculate a risk adjusted interest rate for the loan.

Abstract: A method of calculating a price for a financial instrument comprises receiving a plurality of external data and receiving a financial instrument configuration. In response to the financial instrument configuration adapting the plurality of external data to produce a plurality of corresponding derived data. The adapting comprises adjusted the plurality of external data by a weighting. In response to the plurality of derived data determining a credit worthiness probability distribution function based on the plurality of derived data. In response to configuration rules determining a relationship between a price of the financial instrument and credit worthiness. Receiving a target probability and utilizing the credit worthiness probability distribution function to determine a confidence interval of credit worthiness.

Abstract: A system and method of processing data, including identifying a first data processing criteria, communicating the first data processing criteria from a data processing application to a network element, receiving sensor data from a plurality of sensors at the network element, operating on the sensor data at the network element to process the data according to the identified first data processing criteria, resulting in a first processed data result, transmitting the first processed data result from the network element to the data processing application, and processing the first processed data result at the data processing application resulting in a second processed data result. The criteria can be dynamically updated.

Abstract: Communication session admission control systems and methods are disclosed. A state of a communication system is monitored, and admission of a communication session into the communication system is controlled based on a random admission control procedure and a current state of the communication system. Monitoring of the current state of equipment in the communication system, connections in the communication system, communication sessions in progress in the communication system, special monitoring sessions established in the communication system, and/or an overall state of the communication system can have several benefits. These benefits may include improving utilization of resources in the system, and providing a session admission control scheme that is capable of reacting to actual observed conditions and adapting to changing system topologies following a fault, for instance.

Abstract: The invention detects stealth worm propagation by comparing the repeat elements in sets of destinations of a source in multiple time windows to a fitted distribution of same, stored as a benchmark plot. Measurements are performed over N time windows, wherein a representation of the set of destinations to which a respective source has sent packets is determined for each source, in each time window. The counting is performed using a hash table. Once N such sets of destinations have been obtained, the number Xk of destinations that are common to N, N?1, N?2, . . . , 2, 1 windows is determined. Thus Xk is the number of destinations that a particular source sent packets to in k time windows. Xk is then compared to the corresponding value on the plot; anomalies indicate an attack from the respective source.

Abstract: Packets of a certain type from a certain source are directed to a system that estimates the set of destinations and the number of new destinations for which that source has sent packets during a time window Ti. Instead of maintaining tables with the complete destination addresses for each source, the destination addresses are hashed and stored in a small bit array. The sets of destinations for a number of successive time windows are OR'ed for building cumulative tables Ci, where Ci includes all destinations that have been seen between T0 and Ti. The new destinations are determined by counting the destinations set in Ti but not in Ci-1. Any change from the typical patterns can be suspected as being a slow scan.

Abstract: Apparatus and methods for real-time traffic classification based on off-line determined traffic classification rules are provided. Traces of real traffic are obtained and subjected to statistical analysis. The statistical analysis identifies the multidimensional domain space of characteristic traffic parameters. Classification rules associated with the identified domains are derived and provided to traffic classification points for real-time traffic classification. Traffic classification points, typically edge network nodes, sample packets in aggregate streams with a predetermined probability. Statistical information regarding the sampled flows is tracked in a table, the number of time a flow was sampled providing a probabilistic measure of the flow's duration before the flow terminates. The table entries, which predominantly track high bandwidth flows, are subjected to the classification rules for real-time classification of the sampled flows.

Abstract: A method for detecting anomalies in traffic patterns and a traffic anomalies detector are presented. The method and the detector are based on estimating the fan-in of a node, i.e. the number of distinct sources sending traffic to a node, based on infrequent, periodic sampling. Destinations with an abnormally large fan-in are likely to be the target of an attack, or to be downloading large amounts of material with a P2P application. The method and the anomalies detector are extremely simple to implement and exhibit excellent performance on real network traces.

Abstract: A method and apparatus for assessing a communications' network adherence to Service Level Agreements (SLAs) is presented. The apparatus includes a arrival curve parameter derivation and arrival curve parameter reporting means. A arrival curve parameter generator may be implemented either in hardware for a predefined response in fitting arrival curves to cumulative content arrival variations, or in software for flexibility in the content traffic considered for assessment. The arrival curve generator may be associated with a physical port, a line card, or a network node. Arrival curve parameters defining arrival curves are employed by a Network Management System (NMS) in conjunction with communications network node and communications network service curves in performing SLA conformance assessments.

Abstract: The SATME method and system estimates source-to-destination traffic matrices using a simulated annealing algorithm, the traffic matrix estimation being represented as a probability distribution over the set of all possible matrices that satisfy a set of given constraints. The constraints explicitly encode information that the user knows about the network traffic as components of an objective function (a fitness function), that is then minimized using simulated annealing. With the method according to the invention, arbitrary constraints of any form can be included, and the case where there are no feasible solutions can be diagnosed by the objective function not converging to zero.

Abstract: The FastSATME method and system estimate source-to-destination traffic matrices using a simulated annealing algorithm, the traffic matrix estimation being represented as a probability distribution over the set of all possible matrices that satisfy a set of given constraints. The constraints explicitly encode information that the user knows about the network traffic as components of an objective function (a fitness function), that is then minimized using simulated annealing. With the method according to the invention, arbitrary constraints of any form can be included. FastSATME works over a series of time steps. At the first time step FastSATME acts the same as SATME but in subsequent time steps, the estimate of the traffic matrix at time t is based on the estimate at t-1.

Abstract: A cluster router architecture and methods for performing distributed routing are presented. The cluster router architecture includes off-the shelf Personal Computer (PC) hardware-based router cluster nodes interconnected in an intra-connection network in multiple dimensions. Each PC-based router cluster node is provided with the same routing functionality and a router-cluster-node-centric configuration enabling each router cluster node to provide routing responses for packets pending processing. Packet processing is divided into entry packet processing and routing response processing; special processing; and exit processing. Exit packet processing is performed by router cluster nodes transmitting packets into communication networks in which the cluster router participates. Packet processing is interrupted on determining that special processing is required in respect of a packet, and the packet is handed over to a corresponding special purpose router cluster node.

Abstract: A method and system of personalized commercial cache, including one or more of the following: obtaining personalized consumer information; identifying commercials corresponding to the obtained personalized consumer information; downloading personalized commercials that are the commercials corresponding to the personalized consumer information; storing the downloaded personalized commercials; and playing the stored personalized commercials by splicing the stored personalized commercials into a television program at a predetermined time in the television program.

Abstract: A system and method of processing data, including identifying a first data processing criteria, communicating the first data processing criteria from a data processing application to a network element, receiving sensor data from a plurality of sensors at the network element, operating on the sensor data at the network element to process the data according to the identified first data processing criteria, resulting in a first processed data result, transmitting the first processed data result from the network element to the data processing application, and processing the first processed data result at the data processing application resulting in a second processed data result. The criteria can be dynamically updated.

Abstract: Packets of a certain type from a certain source are directed to a system that estimates the set of destinations and the number of new destinations for which that source has sent packets during a time window Ti. Instead of maintaining tables with the complete destination addresses for each source, the destination addresses are hashed and stored in a small bit array. The sets of destinations for a number of successive time windows are OR'ed for building cumulative tables Ci, where Ci includes all destinations that have been seen between T0 and Ti. The new destinations are determined by counting the destinations set in Ti but not in Ci-1. Any change from the typical patterns can be suspected as being a slow scan.

Abstract: A backpressure mechanism uses a TDM backpressure bus with each port card being assigned time slot. During its time slot, each ingress card/port writes on the bus the number of packets it transmitted to an egress ports during the last data refresh cycle. This information is read by the egress ports and used to compute current depth of the switch fabric output queues. In addition to information received from ingress cards, egress cards keep count of number of packets received from the appropriate switch fabric port and based on it estimate/calculate the current depth of the switch fabric output queue. Congestion states are calculated for all queues by comparing the queue depth with a respective threshold. Each egress card uses these congestion states to generate backpressure signals to ingress cards. Ingress card are using these signals to make decision whether to send or not traffic to destination egress card/port.

Abstract: A cluster router architecture and methods for performing distributed routing is presented. Implementations include off-the shelf Personal Computer (PC) hardware. The cluster router architecture includes PC-based router cluster nodes toroidally interconnected in an intra-connection network in multiple dimensions. The cluster router may further make use of a management node. Each router cluster node is provided with the same routing functionality and a node centric configuration enabling each router cluster node by itself or multiple router cluster nodes in the cluster router to provide routing responses for packets pending processing. The method divides packet processing into entry packet processing and routing response processing; and exit processing. Entry packet processing and routing response processing is performed by router cluster nodes receiving packets from communication networks in which the cluster router participates.

Abstract: A method for detecting anomalies in traffic patterns and a traffic anomalies detector are presented. The method and the detector are based on estimating the fan-in of a node, i.e. the number of distinct sources sending traffic to a node, based on infrequent, periodic sampling. Destinations with an abnormally large fan-in are likely to be the target of an attack, or to be downloading large amounts of material with a P2P application. The method and the anomalies detector are extremely simple to implement and exhibit excellent performance on real network traces.

Abstract: A distributed, multistage agent for monitoring, diagnosis and maintenance of network devices comprises an input/output interface for receiving input monitoring and diagnostic data relevant to operation of a first neighboring agent and transmitting output monitoring and diagnostic data relevant to operation of the host network device to a second neighboring agent. An agent process analyzes the input data and generates processed data characterizing operation of the host network device, using a local database which stores expected performance data on operation of said network device. The processed data is correlated with the expected data any error is signaled to the network operator. The agents may be designed as a multiple stage process, the stages being triggered by the data output by an earlier stage only when needed.