Abstract: Disclosed are a process and apparatus for classifying video streams of an online streaming media service in real-time. The process includes processing data packets representing one or more video streams between a service provider and a user access network, generating flow activity data from the packets representing quantitative metrics of network transport activity, and applying a trained classifier to the flow activity data to classify each of the video streams as either a live video stream or a video-on-demand (VoD) stream.

Abstract: A process for monitoring network behaviour of IoT devices, which includes: monitoring a communication network traffic to identify TCP and UDP traffic flows to and from each of one or more IoT devices; processing the identified traffic flows to generate a corresponding data structure representing the identified network traffic flows of the IoT device in terms of, for each of local and internet networks, one or more identifiers of respective hosts and/or devices that had a network connection with the IoT device, source and destination ports and network protocols; and comparing the generated data structure for each IoT device to corresponding data structures representing predetermined manufacturer usage description (MUD) specifications of known types of IoT devices to generate quantitative measures of similarity of the traffic flows of the IoT device to traffic flows defined by the predetermined MUD specifications to identify the type of the IoT device

Abstract: A network device classification process, including: monitoring network traffic of networked devices in a communications network to generate device behaviour data representing network traffic behaviours of the networked devices at different time granularities; processing the device behaviour data to classify a plurality of the networked devices as IoT devices, and others of the networked devices as non-IoT devices; accessing IoT device type data representing predetermined network traffic characteristics of respective known IoT device types; processing the device behaviour data of the IoT devices and the IoT device type data to classify each of the IoT devices as being a corresponding one of the plurality of known IoT device types; and for each of the IoT devices classified as a corresponding known IoT device type, classifying the IoT device as being in a corresponding operating state based on network traffic behaviours of the IoT device at different time granularities.

Abstract: A computer-implemented process for estimating user experience of online gaining, including the step of monitoring the flow of network packets of an online game at a monitoring location between a client gaining device and a game server to generate estimates of at least one of latency and jitter in the flow of network packets of the online game as a measure of user experience of the online game.

Abstract: A network traffic monitoring process of a communications network including: receiving data packets from a software-defined networking (SDN) flow switch; processing header of the received packets to identify its subsets belonging to respective network flows; detecting large network flows by determining a corresponding cumulative amount of data contained in the received packets for each of the network flow until it reaches or exceeds a predetermined threshold amount of data; for each detected large network flow, sending flow identification data to the SDN flow switch to identify further packets of the large network flow and to stop sending them to the network traffic monitoring component; periodically receiving from the SDN flow switch and processing the corresponding counter data and corresponding timestamp data to generate temporal metrics of the large network flow; and processing the generated temporal metrics with a trained classifier to classify the large network flow.

Abstract: Disclosed are a process and apparatus for classifying video streams of an online streaming media service in real-time. The process includes processing data packets representing one or more video streams between a service provider and a user access network, generating flow activity data from the packets representing quantitative metrics of network transport activity, and applying a trained classifier to the flow activity data to classify each of the video streams as either a live video stream or a video-on-demand (VoD) stream.

Abstract: Some embodiments include a network attack detection process, including, for each of a plurality of IoT devices of a communications network: receiving corresponding network traffic data representing network traffic characteristics of a plurality of network traffic flows of the device; processing the network traffic data to generate a plurality of corresponding features for each of the network traffic flows; and applying a corresponding set of one-class flow classifiers to the generated features to classify network traffic flows of the device and assess whether the network traffic characteristics of the network traffic flows are indicative of the device being under attack or having been compromised; wherein the flow classifiers are trained with training data representing normal network traffic behaviour of the device in an uncompromised state.

Abstract: A network bandwidth apportioning process executed by an Internet Service Provider (ISP), the process includes: defining a utility function representing, a relationship between allocated bandwidth of a predetermined network traffic class and a deemed utility of the class; determining, for each of the classes of network traffic, a corresponding portion of network bandwidth to be allocated to the class such that the sum of the deemed utilities for the classes is maximised for the determined portions; and apportioning network bandwidth of the ISP between the predetermined classes of network traffic according to the determined portions of network bandwidth. Network bandwidth apportioning further includes classifying each of the packets into predetermined classes of network traffic and allocating network bandwidth to each of the classes according to the determined portion of network bandwidth for the class.

Abstract: A process for monitoring network behaviour of IoT devices, which includes: monitoring a communication network traffic to identify TCP and UDP traffic flows to and from each of one or more IoT devices; processing the identified traffic flows to generate a corresponding data structure representing the identified network traffic flows of the IoT device in terms of, for each of local and internet networks, one or more identifiers of respective hosts and/or devices that had a network connection with the IoT device, source and destination ports and network protocols; and comparing the generated data structure for each IoT device to corresponding data structures representing predetermined manufacturer usage description (MUD) specifications of known types of IoT devices to generate quantitative measures of similarity of the traffic flows of the IoT device to traffic flows defined by the predetermined MUD specifications to identify the type of the IoT device

Abstract: A network device classification process, including: monitoring network traffic of networked devices in a communications network to generate device behaviour data representing network traffic behaviours of the networked devices at different time granularities; processing the device behaviour data to classify a plurality of the networked devices as IoT devices, and others of the networked devices as non-IoT devices; accessing IoT device type data representing predetermined network traffic characteristics of respective known IoT device types; processing the device behaviour data of the IoT devices and the IoT device type data to classify each of the IoT devices as being a corresponding one of the plurality of known IoT device types; and for each of the IoT devices classified as a corresponding known IoT device type, classifying the IoT device as being in a corresponding operating state based on network traffic behaviours of the IoT device at different time granularities.

Abstract: Some embodiments include a network attack detection process, including, for each of a plurality of IoT devices of a communications network: receiving corresponding network traffic data representing network traffic characteristics of a plurality of network traffic flows of the device; processing the network traffic data to generate a plurality of corresponding features for each of the network traffic flows; and applying a corresponding set of one-class flow classifiers to the generated features to classify network traffic flows of the device and assess whether the network traffic characteristics of the network traffic flows are indicative of the device being under attack or having been compromised; wherein the flow classifiers are trained with training data representing normal network traffic behaviour of the device in an uncompromised state.

Abstract: A network traffic monitoring process of a communications network including: receiving data packets from a software-defined networking (SDN) flow switch; processing header of the received packets to identify its subsets belonging to respective network flows; detecting large network flows by determining a corresponding cumulative amount of data contained in the received packets for each of the network flow until it reaches or exceeds a predetermined threshold amount of data; for each detected large network flow, sending flow identification data to the SDN flow switch to identify further packets of the large network flow and to stop sending them to the network traffic monitoring component; periodically receiving from the SDN flow switch and processing the corresponding counter data and corresponding timestamp data to generate temporal metrics of the large network flow; and processing the generated temporal metrics with a trained classifier to classify the large network flow.

Abstract: In a method for dynamic buffer adjustment at a line card of router, a current buffer occupancy at the line card is compared with at least a first buffer occupancy threshold, the first buffer occupancy threshold being calculated based on a buffer occupancy threshold parameter and a capacity of at least a first buffer memory at the line card; and an active buffer capacity is adjusted by at least one of activating and deactivating buffer memory blocks at the line card based on the comparing step, the activating including switching on the buffer memory blocks, and the deactivating including causing the buffer memory blocks to enter a sleep state.

Abstract: In a method for dynamic buffer adjustment at a line card of router, a current buffer occupancy at the line card is compared with at least a first buffer occupancy threshold, the first buffer occupancy threshold being calculated based on a buffer occupancy threshold parameter and a capacity of at least a first buffer memory at the line card; and an active buffer capacity is adjusted by at least one of activating and deactivating buffer memory blocks at the line card based on the comparing step, the activating including switching on the buffer memory blocks, and the deactivating including causing the buffer memory blocks to enter a sleep state.

Abstract: The present invention relates to a system and method for enabling a buffer-less or substantially buffer-less core network using a packet-level forward error correction (FEC) coding scheme. The system includes an ingress edge router configured to receive data packets destined to at least one egress edge router via an access link from an end-host. The ingress edge router is connected to the at least one egress edge router via a core network, where the core network is buffer-less or substantially buffer-less. Also, the ingress edge router is configured to apply a forward error correction (FEC) encoding scheme to the data packets at a packet level and transmit the encoded data packets to the core network.

Abstract: An apparatus and method implement a No-Per-Connection-Timestamp Discrete-Rate Scheduler with Pivot Session which does not strictly require the computation and storage of any scheduling-related information per connection, not even a single bit, but only maintains one variable service rate and one timestamp per rate FIFO queue. In a first embodiment, the pivot-session-based scheduler does not make use of per-connection scheduling information, and further embodiments maintain a single scheduling-related bit per connection. The scheduler achieves near-optimal delay bounds, and fairness indices (both SFI and WFI) that are almost identical to those of the discrete-rate scheduler with per-connection timestamps.

Abstract: A system is disclosed that services a plurality of queues associated with respective data connections in a packet communication network such that the system guarantees data transfer delays between the data source and the destination of each data connection. This is achieved in two stages. The first stage shapes the traffic of each connection such that it conforms to a specified envelope. The second stage associates timestamps with the packets released by the first stage and chooses for transmission from among them the one with the smallest timestamp. Both stages are associated with a discrete set of delay classes. The first stage employs one shaping structure per delay class. Each shaping structure in turn supports a discrete set of rates and employs a FIFO of connections per supported rate. A connection may move between FIFOs corresponding to different rates as its rate requirement changes.