Abstract: A multi-port status message maintains network connections between virtual ports of two network elements. The network elements negotiate the network connections between first virtual ports on a first network element and corresponding second virtual ports on a second network element. The first network element generates a multi-port status message listing the first virtual ports that are actively connected to the corresponding second virtual ports. The first network element sends the multi-port status message to the second network element to maintain the network connections.

Abstract: Techniques are provided for performing dynamic DNS-SD. In an embodiment, an apparatus includes one or more databases, one or more transceivers to receive a first Domain Name System (DNS) query from a first computing device, the first DNS query defining a first service discovery name space, and one or more processors in communication with each of the one or more databases and the one or more transceivers. The one or more processors generate and append a first metadata associated with the first computing device to the first DNS query. The one or more transceivers transmit the first DNS query and the first metadata to a Domain Name System (DNS) server computer, receive, from the DNS server computer, a first response responsive to the first DNS query, and relay, to the first computing device, the first response.

Abstract: In one implementation, a method includes transmitting, to a server, a first interest message. The first interest message includes a request for a representational state transfer (REST) operation and a name of a first state for the REST operation. The method also includes receiving, from the server, a second interest message. The second interest message includes the name of the first state for the REST operation. The method further includes transmitting, to the server, the first state based on the second interest message and receiving, from the server, a response to the REST operation.

Abstract: In a network that includes a client, a server and one or more proxy entities that intercept network traffic between the client and the server, a computer-implemented method is provided including: establishing trust with a permissioned distributed database; computing hashes from packet payloads of network traffic originated, intercepted or received; storing the hashes to the permissioned distributed database so that the permissioned distributed database maintains hashes computed from packets of the network traffic originated, intercepted or received by the client, server and the one or more proxy entities; and validating the hashes by comparing, with each other, the hashes stored to the permissioned distributed database by the client, server and the one or more proxy entities to determine whether any packet payload of the network traffic was modified in transit.

Abstract: Systems, methods, and computer-readable media for managing a distributed network of function execution environments. In some examples, a function router registers a plurality of execution endpoints on a catalog of execution endpoints and functions, each of the plurality of execution endpoints including a respective runtime environment capable of executing one or more functions. The function router receives, from a client, a request to execute a particular function and, based on the request, queries the catalog for the particular function and execution endpoints associated with the particular function. The function router receives a query response identifying one or more execution endpoints associated with the particular function, and selects an execution endpoint for executing the particular function based on one or more criteria associated with the request. The function router then sends to the client a response identifying the execution endpoint selected for executing the particular function.

Abstract: Various systems and methods for using strict path forwarding. For example, one method involves receiving an advertisement at a node. The advertisement includes a segment identifier (SID). In response to receiving the advertisement, the node determines whether the SID is a strict SID or not. If the SID is a strict SID, the node generates information, such as forwarding information that indicates how to forward packets along a strict shortest path corresponding to the strict SID.

Abstract: Techniques for user-based service discovery in a network are described. In one embodiment, a method includes receiving, at a controller, a query to discover advertised services from a user device from a local area network. The method includes determining one or more advertised services in response to the query from the user device and determining a service discovery gateway agent for the local area network in communication with the user device. A query response that includes the one or more advertised services determined in response to the query is transmitted to the service discovery gateway agent. The service discovery gateway agent is configured to receive the query response and transmit the one or more advertised services to the user device via a Layer 2 unicast transmission.

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract: A method and apparatus for dynamic integration of a covert namespace are provided. A Software-Defined Networking (SDN) controller is configured to send a request for workload transfer to an endpoint where the endpoint is connected to a virtual switch. The SDN controller determines that a connection between the endpoint and the virtual switch is secure based on a tenant-specific policy associated with the endpoint. A first covert namespace is configured to be connected between the endpoint and the virtual switch to communicate to the endpoint and the virtual switch directly. The operations of the virtual switch are executed using the first covert namespace according to the tenant-specific policy. A workload is caused to be transmitted to the endpoint through the first covert namespace.

Abstract: In one embodiment, a device determines locations of a plurality of transmitters relative to a particular wireless access point in a wireless network. One of the transmitters comprises a target client to which the particular wireless access point is to communicate. The device compares a plurality of beamforming patterns associated with the particular wireless access point to the determined locations. The device selects, based on the comparison, one of the beamforming patterns for use by the particular wireless access point to communicate with the target client. The device controls the particular wireless access point to use the selected beamforming pattern to communicate with the target client.

Abstract: A method for securing communications for a given network topology is provided. The method comprises generating by a node N(i) of the network, security parameters for the node N(i); transmitting by the node N(i), said security parameters to a controller for the network; maintaining by the controller said security parameters for the node N(i); receiving by the controller a request from a node N(j) for the security parameters for the node N(i); retrieving by the controller the security parameters for the node N(i); and transmitting by the controller said security parameters to the node N(j).

Abstract: An apparatus, comprising: a silicon substrate; and a quantum dot laser comprising: a base layer of a III-V semiconductor material, bonded with the silicon substrate; and at least one layer grown epitaxially from the base layer, wherein the at least one layer comprises a quantum dot layer. The apparatus further comprises a photonic element, fabricated on the silicon substrate and including a waveguide optically aligned with the quantum dot layer.

Abstract: In one embodiment, a server in a network reports one or more symptoms of a monitored device that is malfunctioning to a user interface via a particular chatbot session. The server receives, via the particular chatbot session, a triage request to enter a triage mode regarding the one or more reported symptoms. The server predicts a corrective action using the one or more reported symptoms as input to a machine learning model. The machine learning model is trained using a history of observed symptoms in the network, a history of corrective actions initiated via chatbot sessions and associated with the observed symptoms, and a history of feedback regarding the corrective actions received via the chatbot sessions. The server provides the predicted corrective action to the user interface via the particular chatbot session as a suggested corrective action, in response to the received triage request.

Abstract: In one embodiment, a service receives traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network. The service analyzes the traffic telemetry data to infer characteristics of an application on the endpoint device that generated the encrypted traffic. The service receives, from a monitoring agent on the endpoint device, application telemetry data regarding the application. The service determines that the application is evasive malware based on the characteristics of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device. The service initiates performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.

Abstract: Automatic, adaptive stimulus generation includes receiving, at a network device that is associated with a network or system, analytics data that provides an indication of how the network or system is responding to a set of test stimuli introduced into the network or system to facilitate an analysis operation. The network device analyzes the analytics data based on an intended objective for the analysis operation and generates control settings based on the analyzing. The control settings control creation of a subsequent stimulus to be introduced into the network or system during subsequent execution of the analysis operation.

Abstract: A wafer comprising: a silicon substrate; a base layer of a predetermined thickness of a III-V semiconductor material bonded with the silicon substrate; and at least one layer grown on the base layer to form a plurality of quantum dot lasers.

Abstract: In one embodiment, a supervisory service receives a registration message broadcast by a first vehicle and captured by a RSU in the network of RSUs. The supervisory service registers the first vehicle by validating a signature of the registration message without registering a media access control (MAC) address of the first vehicle and without causing to send a registration response to the first vehicle. The supervisory service receives a message broadcast by a second vehicle addressed to the first vehicle and captured by at least one RSU in the network of RSUs. The supervisory service selects one or more RSUs in the network of RSUs to re-broadcast the message. The supervisory service controls the one or more RSUs to re-broadcast the message.

Abstract: In an example embodiment, a validating peer of a plurality of validating peers in a blockchain network receives, from a non-validating peer, a request to create a root block of a blockchain. The root block includes information related to a potential computer security threat. The validating peer creates the root block with a root block pending validation status. The validating peer shares, with other validating peers of the plurality of validating peers, a notification of the root block with the root block pending validation status to provide an indication of the information. The validating peer determines whether the information is authentic. If the information is determined to be authentic, the validating peer changes the root block pending validation status to a root block authenticated validation status and shares, with the other validating peers, a notification of the root block authenticated validation status to indicate that the information is authentic.

Abstract: In one embodiment, a supervisory device in a network, configured to interact with one or more sensors positioned in a given area and with a conference room scheduling service, obtains an acoustic feature of the area from one or more of the sensors. The supervisory device makes a determination that a conference room should be reserved based on the acoustic feature and selects a particular conference room based on the determination that a conference room should be reserved. The supervisory device instructs a conference room scheduling service to reserve the particular conference room.

Abstract: A wireless communication device is built from a base module and a plurality of front-end modules. Each of the plurality of front-end modules is configured to operate a different one of a plurality of radio frequency services and having a front-end module connector configured to removeably mate with a base module connector of the base module. A particular front-end module is connected to the base module. Upon connection of the particular front-end module to the base module connector, the base module reads information from a memory of the particular front-end module to determine the radio service that the particular front-end module is configured to operate and to supply the control signals to configure and control front-end circuitry of the front-end module to operate the radio service.