Abstract: This disclosure describes systems, methods, and devices related to software-defined wide area network (SD-WAN) overlays for evaluating services provided by a communications network. A device may identify a SD-WAN overlaying a virtual private network (VPN) of a communications network, the VPN including multiprotocol label switching (MPLS) and the Internet, the MPLS and the Internet associated with connecting a one or devices to a datacenter; retrieve, using an application programming interface (API), analytical data from the SD-WAN; identify devices and interfaces of the SD-WAN; receive performance metrics of the devices and interfaces; detect, based on comparisons of the performance metrics to event criteria, an occurrence of an event in the VPN; and present, based on the occurrence of the event, of a notification of the event to a customer of the VPN.

Abstract: Novel tools and techniques are provided for implementing dashboard for alert storage and history (“DASH”). In various embodiments, DASH provides for consolidated tracking and monitoring of two or more of current (or active) alerts, cleared alerts, and/or transactional information for alerts that are stored within corresponding alert live database that mirrors current alert instance data in a real-time fault management system, alert history database that contains a snapshot of an alert history of each alert or corresponding network device, and/or alert log database that contains a full transaction record of every copy of an alert either over a first duration or having a total data size within a first total data size. DASH also cleans received alert data and/or enriches the alert data, and provides a user interface (“UI”) that enables a user to view, absorb, filter, manage, and/or organize alert data to facilitate addressing of alerts in the network(s).

Abstract: Implementations described and claimed herein provide systems and methods for custom-defined network routing. In one implementation, a set of custom defined network flow rules is received at an edge router of a primary network, which is in communication with a customer network. The set of custom defined network flow rules correspond to network traffic associated with the customer network. The set of custom defined network flow rules is stored in a forwarding table on the edge router. A packet of data is received at the edge router. The packet of data is attributed to the customer network. The set of custom defined network flow rules is applied to the pack of data using the forwarding table.

Abstract: Embodiments are provided for managing routes of data traffic within a network. The management may be performed via a graphical user interface that interacts with a Web server to update a configuration file. The configuration file can be converted to router management commands by a network management device (e.g., a BGP speaker). The commands can then be sent to border routers for controlling network traffic. Embodiments are also provided for capturing and logging routing updates made in a network.

Abstract: Aspects of the present disclosure involve systems, methods, computer program products for consolidating toll-free and/or tolled features of two or more telecommunications networks. The networks may be consolidated via an Enhanced Feature Server (EFS) deployed in a telecommunications network. The EFS may be configured to receive a toll-free and/or tolled communication and route the communication based on the dialed toll-free number and a carrier identification code (CIC) associated with the communication, or based on the dialing number and a CIC. Routing the communication based at least on the CIC associated with the communication allows the telecommunications network to consolidate a redundant network from the telecommunications network. In circumstances where a CIC is not associated with a communication, the EFS may request a data schema from a toll-free database, or from an automatic number identification (ANI) database, and determine a CIC based on an analysis of the data schema.

Abstract: A data network analysis system includes a computer-executable set of instructions that obtain service account information associated with a route provided to a customer through a data communication network having network elements. Using the service account information, the instructions identify a termination port that terminates the route to a customer premises equipment of the customer, and at least one target port of the route and those network elements that are assigned to convey the route through one or more of the network elements. The instructions then obtain the routing information for the route from each of the network elements that are assigned to convey the route.

Abstract: Novel tools and techniques are provided for implementing web-based monitoring and detection of fraudulent or unauthorized use of voice calling service. In various embodiments, a computing system might receive, from a user device associated with an originating party, a request to initiate a call session with a destination party, the request comprising user information associated with the originating party and a destination number associated with the destination party; might query a database with session data (including user information) to access permission data and configuration data; and might configure fraud logic using received configuration data from the database. The computing system might analyze the session data and permission data using the configured fraud logic to determine whether the originating party is permitted to establish the requested call session with the destination party; if so, might initiate one or more first actions; and, if not, might initiate one or more second actions.

Abstract: Apparatus, systems, methods, and the like, for autonomous scaling of security and other network services through initialization of a service from a network service device and/or migration of such services from one service device to another is provided. Such network scaling may allow for migration of services from existing service edges to other service edges. A security management system may coordinate the migration of services provided to a secondary network from one or more service edges to another, separate service edge while providing session synchronization during the migration. To migrate the services from the first service edge to a second service edge, a session table may be shared between the service edges and the first and second service edges may advertise service routes or endpoints with one or more priority values to control or otherwise determine which service edge is selected by a service-receiving device to receive the services.

Abstract: The present application describes a system and method for passively collecting DNS traffic data as that data is passed between a recursive DNS resolver and an authoritative DNS server. The information contained in the collected DNS traffic data is used to generate a virtual authoritative DNS server, or a zone associated with the authoritative DNS server, when it is determined that the authoritative DNS server has been compromised.

Abstract: A trigger mechanism or fire control for trigger operable devices includes a housing; a sear having a sear body coupled to the housing and including a primary engagement surface and an active sear support reset geometry; and a sear support coupled to the housing and having a body with a sear engagement surface and a passive sear support reset geometry. The primary engagement surface of the sear is moved into an overlapping condition with the sear engagement surface of the sear support as the sear is moved from a discharged position to a reset position after actuation of the trigger operable device. In addition, interaction between the active sear support reset geometry and the passive sear support reset geometry causes a mechanical displacement of the sear support to a reset position.

Abstract: In an embodiment, a computer implemented method receives flow data for one or more flows that correspond to a device-circuit pair. The method calculates a time difference for each flow that corresponds to a device-circuit pair. Based on the calculated time differences and the received flow data, the method updates a probability distribution model associated with the device-circuit pair. Then, the method determines whether a time bucket is complete or open based on the updated probability distribution model.

Abstract: FlowSpec is a mechanism for distributing rules to routers in a network. Such rules may be used, for example, to drop traffic associated with a distributed denial of service attack. However, a malformed or incorrect FlowSpec announcement may, if distributed in the network, cause legitimate traffic to be dropped, degrading the service experienced by legitimate users. As such, systems and methods for avoiding the distribution of malformed FlowSpec announcements are provided.

Abstract: Systems, methods, and storage media for detecting a security intrusion of a network device are disclosed. Exemplary implementations may include a method involving, in the network device including a processor, monitor a light signal associated with a security enabled port of the network device; and in response to detecting a change in the light signal, initiate a security alert.

Abstract: This disclosure describes systems, methods, and devices related to requesting use of a zero-copy operation. A method may include: generating, by a first channel of a hierarchy of channels in a user space, a request to retrieve a file descriptor before initiating a zero-copy operation; sending, by the first channel, to the hierarchy, the request; identifying, by a second channel of the hierarchy, a response accepting the request, the response including the file descriptor; adding, by the second channel, additional information to the response accepting the request, the additional information including at least one of a need notify request to be notified of an amount of data transferred using the zero-copy operation or parsed body data; identifying, by the first channel, the file descriptor and the additional information; and initiating, by the first channel, based on identifying the file descriptor, the zero-copy operation.

Abstract: Systems and methods for enforcing compliance-program conformity during authorization-token generation are presented. Applications may be registered with an identity and access management (IAM) system. The registration of the application may include whether the application is subject to one or more compliance program(s). When an authorization token is requested from the IAM system, the IAM system may (a) determine the set of authorization information needed in the token, and (b) determine whether the application is subject to a compliance program. The IAM system may then check an approval source of record to determine whether the user was legitimately approved for the required authorization prior to granting an authorization token. If there is a mismatch between the approval source of record and the authorization information associated with the user identity, then the mismatch may cause certain mitigation actions to be performed.

Abstract: The present application describes providing an attestation level to a received communication. The attestation level may be used to communicate a level of security to a network or a called party that receives the communication. The attestation level associated with the communication may indicate to a destination network and/or recipient that the phone number associated with the communication is secure and/or the telephone number has not been spoofed.

Abstract: A system and method for providing on-demand edge compute. The system may include an orchestrator that provides a UI and controls an abstraction layer for implementing a workflow for providing on-demand edge compute. The abstraction layer may include a network configuration orchestration (NCO) system (e.g., a Network-as-a-Service (NaaS) system) and an API that may provide an interface between the orchestrator and the NCO. The API may enable the orchestrator to communicate with the NCO for receiving requests that enable the NCO to integrate with existing network controllers, orchestrators, and other systems and perform various network provisioning tasks (e.g., to build and provision a communication path between server instances). The various tasks, when executed, may provide end-to-end automated network provisioning services as part of providing on-demand edge compute service to users. The API may further enable the ECS orchestrator to receive information from the NCO, (e.g.

Abstract: Novel tools and techniques are provided for implementing name-based routing through networks. In various embodiments, a broker manager in each of a plurality of networks may receive a subscription request for a network device from a client device, each device being locally accessible or disposed in an upstream or downstream network. The broker manager uses its client broker to communicate with a locally accessible client device, and uses its mediator broker (and, sometimes, an intermediate device(s)) to communicate with a locally accessible network device. The broker manager otherwise uses its messaging brokers to communicate with control channels of one or more networks. Once subscription with the network device has been established, any commands and responses between the client device and the network device may be routed over pub/sub channels via the broker managers and their brokers using name-based routing, without routing based on IP address of the network device.

Abstract: Implementations include providing security services to workloads deployed across various types of network environments, such as public networks, private networks, hybrid networks, customer premise network environments, and the like, by redirecting traffic intended for the service device through a security environment of the first network. After application of the security features to the incoming traffic, the “clean” traffic may be transmitted to the service device instantiated on the separate network via a tunnel. Redirection of incoming traffic to the security-providing first network may include correlating a network address of the service device to a reserved network address of a block of reserved addresses and updating a Domain Name Server (DNS) or other address resolving system with the reserved address. The return transmission tunnel may be established between the security environment and the network address of the service device.