Abstract: Event management system and method. Events comprise physical and logical attributes. Tuples are created to identify a set of logical attributes. The tuples are arranged in hierarchized relations by creating binarized co-occurrence matrices, each co-occurrence matrix reflecting different time intervals and indicate occurrence of tuples in time windows of the time intervals. Tuple pairs are analyzed to determine probabilistic score related to co-occurrence, and tuple families are created from tuple pairs based on the probabilistic score. From tuple families, events are used to extract tuple instances including physical attributes, which are arranged as tuple-instance families using the corresponding tuple families as reference.

Abstract: A system and method for resolving an unsatisfactory quality of experience (QoE) for an application executed on a wireless device that accesses a CSP network is described. A QoE network appliance generates an integrated event stream that includes a RAN data set, a CN data set, a NWDAF data set, a QoE latency measurement, a QoE bandwidth measurement, and a QoE packet loss rate measurement. A measured QoE score is generated with the RAN data set, the CN data set, and the NWDAF data set. The measured QoE score is associated with a QoE latency measurement, a QoE bandwidth measurement, and a QoE packet loss rate measurement. A robotics process automation (RPA) module receives the integrated event stream when the measured QoE score fails to satisfy the QoE requirement. The RPA module performs one or more automated actions to improve the measured QoE based on information from the integrated event stream.

Abstract: Event management system and method. Events comprise physical and logical attributes. Tuples are created to identify a set of logical attributes. The tuples are arranged in hierarchized relations by creating binarized co-occurrence matrices, each co-occurrence matrix reflecting different time intervals and indicate occurrence of tuples in time windows of the time intervals. Tuple pairs are analyzed to determine probabilistic score related to co-occurrence, and tuple families are created from tuple pairs based on the probabilistic score. From tuple families, events are used to extract tuple instances including physical attributes, which are arranged as tuple-instance families using the corresponding tuple families as reference.

Abstract: A method provides telecom operators a single Quality of Experience (QoE) index to collectively interpret service experience and network experience by way of ensemble of expectation scores. The method includes the steps of mapping Key Performance Indicators (KPIs) of time-series data into multiple probability spaces of statistical expectation functions thereby producing time-series expectation scores; applying vector geometry to said time-series expectation scores for each of said statistical expectation functions thereby producing an N-Dimensional probability vector; normalizing correlations of said N-Dimensional probability vector across said KPIs thereby producing a normalized N-Dimensional probability vector; and generating a N-Dimensional probability distribution from the normalized N-Dimensional probability vector to produce an ensemble function. The ensemble function is then be applied to time-series data thereby producing an ensemble index, which represents the QoE (Quality of Experience).

Abstract: The invention provides a method for managing a plurality of events, wherein each event comprises physical attributes and logical attributes by creating tuples with the events with the same logical attributes, providing a set of hierarchized relations between tuples, by means of a pipeline algorithm, wherein parent-child relations are provided between tuples, classifying the tuples in families, each family contains all the tuples related according to the parent-child relation provided by the pipeline algorithm, identify the parent tuple of each family, defined as the tuple which has at least one children and has no parent and present the parent tuples, together with the physical attributes of the events associated to each parent tuple.

Abstract: A system and method for detecting unauthorized access to a plurality of network assets is described. The system and method receive a network asset feed from a plurality of data sources and then generating at least one social graph with the network asset feed. User communities are identified with the social graph and user accounts are associated with user communities. Commonly accessed network assets are identified from a firewall log, a router log or the combination thereof. A derived community is identified based on the user accounts associated with commonly accessed network assets. The systems and methods monitor communications associated with the user community so that the communications correspond to the derived community, and then reports an anomalous communication when the user community communications do not correspond to the derived community.

Abstract: A network load traffic management component is communicatively coupled to a radio access network (RAN). The network load traffic management component includes a subscriber scoring module and a subscriber scoring database that operates on a server processor and a server memory. The network load traffic management component identifies at least one network event corresponding to a RAN control plane. The network load traffic management component monitors each network event for a session time, in which each session time is associated with each subscriber interacting with the RAN. The network load traffic management component, repeatedly, determines a performance measurement for each network event associated with each session time. The performance measurement for each network event is recorded. A subscriber score is generated based on the performance measurements for each network event. A predictive indicator score is generated based on subscriber scores and behavioral analytics associated with each subscriber.

Abstract: A system and method of characterizing a geographical location for a wireless device in a wireless network is described. The system includes a first config management log, a second config management log, a correlation module, data bins, a location module, a predictive analysis module and a service layer module. The first config management log is associated with a plurality of base stations. The second config management log is associated with a network component communicatively coupled to the plurality of base stations. The correlation module correlates the first config management log and the second config management log with a geographic area. Each of the data bins is associated with a geographic area. The predictive analysis module analyzes the communication parameters associated with a particular geographic area. The service layer module identifies the communication parameters affecting at least one of a user experience and a quality of experience (QoE) in the particular geographic area.

Abstract: Systems and methods for managing network operations are described. An illustrative system includes a plurality of network components, in which each network component generates a plurality of network component data, and a mediation node that receives the plurality of network component data. The mediation node associates a plurality of time series data and a network topology with the network component data. The mediation node includes at least one baseline module that receives a selected subset of the network component data and generates at least one baseline for anomaly detection. The system may further include at least one application component communicatively coupled to the mediation node, and the application component may receive the time series data, the plurality of subsets of the network component data, and a plurality of baselines and identify a relationship.

Abstract: In various embodiments, streaming data records, files or file segments transmitted from multiple resources in a multi-threaded environment are sorted into one or more time windows via use of one or more execution threads; the records, files or file segments in each time window are displayed, analyzed or delivered to various applications or destinations.

Abstract: A non-rule based security detection system and method is described. The method includes identifying a plurality of data sources. The method then proceeds to generate a baseline for each data source. The baseline includes a plurality of data source outputs that are evaluated over a time period. A plurality of data source anomalies are detected, in which each data source anomaly is associated with at least one data source output exceeding a threshold for the data source baseline. A geolocation for each data source anomaly is then identified. A plurality of correlations between the plurality of data source anomalies and the geolocation for each data source anomaly are generated. At least one correlation is associated with a security event.

Abstract: In various embodiments, network-traffic records overlapping multiple binning windows are prorated such that partial records are stored in each binning window of overlap. In addition, the full, non-prorated record is stored in at least one of the binning windows.

Abstract: A computer-implemented method of delegating an object in an object library to a computer application having multiple execution threads includes, in certain embodiments, registering at least some of the execution threads with the object library; executing a first registered execution thread to access the object; generating delegation information; associating the object with the generated delegation information; and delegating the object to a second registered execution threads based on the delegation information, thereby ensuring sequential delegation of the object, without locking thereof, in the registered execution threads of the computer application.

Abstract: A system for detecting and managing network data traffic and a network load traffic management module is described. The system for detecting and managing network data traffic includes a Radio Access Network (RAN), a plurality of mobile devices, a network load traffic management server, a first dataset and a corresponding first baseline, a second data set and a corresponding second baseline, a data flow dataset, and a probability for one or more mobile devices to remain within each location associated with each RAN site, wherein the probability is calculated by the network traffic management module.

Abstract: A system for detecting a computing device tethered to a mobile device is described. The system includes communicatively coupled the computing device to the mobile device with an IPv4 domain protocol. Additionally, the mobile device is communicatively coupled to the mobile data network with an IPv6 domain protocol. A network module, associated with a mobile data network, receives a DNS request packet from the mobile device. An IPv6 hostname and an IPv6 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv6 address. Additionally, an IPv4 hostname and an IPv4 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv4 address. A communication packet, generated by the mobile device, is also received by the network module. The communication packet includes a destination address and a hostname.

Abstract: A non-rule based security detection system and method is described. The method includes identifying a plurality of data sources. The method then proceeds to generate a baseline for each data source. The baseline includes a plurality of data source outputs that are evaluated over a time period. A plurality of data source anomalies are detected, in which each data source anomaly is associated with at least one data source output exceeding a threshold for the data source baseline. A geolocation for each data source anomaly is then identified. A plurality of correlations between the plurality of data source anomalies and the geolocation for each data source anomaly are generated. At least one correlation is associated with a security event.

Abstract: Methods, apparatuses and systems for diagnosing network anomalies and allocating repair resources in a computer network receive network anomaly reports (NARs) from a group of customers. Each NAR specifies a network anomaly observed by a customer at a network endpoint. Each NAR is entered into a database and associated in the database with attributes including at least one customer attribute associated with the sender of that NAR or network attribute associated with the network anomaly specified in that NAR. A time period is detected during which the difference between an aggregate number of NARs received within that time period and a baseline number of NARs received during prior time periods of substantially identical duration exceeds a threshold. The attributes associated with the NARs received during the time period are analyzed to identify a network anomaly specified in those NARs. Repair resources are further preferentially allocated to the identified network anomaly.

Abstract: Systems and methods classify unknown devices communicating over a packet-switched network based on traffic-borne characteristics comprising packet parameters, flow parameters, and/or operating-system parameters. Embodiments utilize “self-learning” to optimize the level of classification accuracy.

Abstract: A plurality of data keys are associated with a plurality of type values; query frequencies of the data keys are known. A computer memory is divided into a plurality of tranches, each tranche including a probabilistic or non-probabilistic data structure. The data keys are stored in the tranches in accordance with their query frequencies such that, e.g., frequently queried data keys are stored in data structures having higher accuracy and infrequently queried keys are stored in data structure having less accuracy (and consequently require less memory space).

Abstract: This disclosure is directed to techniques for inferring traffic information or estimating total volume of traffic/data flowing through a target network/entity, wherein only a partial subset of inferred traffic information or volume of data is available to a predictor entity/network that infers such traffic information. In an embodiment, such partial subset of total traffic can either be made available to the entity/network for inferring and estimating total traffic or such partial data can actually flow through the entity/network.