Abstract: A method for multi-protocol monitoring and correlation includes aggregating captured network performance data including a plurality of captured network performance metrics for a plurality of subscriber session records associated with a plurality of protocols. A first level of correlation is performed between the plurality of subscriber session records using one or more direct correlation rules. The correlated subscriber session records associated with the plurality of protocols are related to the same subscriber session. A second level of correlation is performed between the correlated subscriber session records using one or more indirect correlation rules based on the performed first level of correlation.

Abstract: A method for monitoring spectral efficiency in a wireless network includes determining total number of resource blocks or resource elements allocated for each of one or more calls in the wireless network during a given time period and determining a corresponding total number of bits transmitted for each of the one or more calls during the given time period. A spectral efficiency metric is calculated for each of the one or more calls based at least in part on the total number of bits transmitted during the given time period and the total number of resource blocks or resource elements allocated for transmission during the given time period. A heat map for each of the one or more calls is generated based on geographic locations of the one or more calls.

Abstract: A data storage system includes storage nodes adapted to provide retrieval of time-based data in response to a receipt of a time-based data retrieval request associated with data streams. Each of the data streams includes time-ordered data items having a header. The header includes timestamps representing a time interval associated with the data items. The data storage system further includes applications issuing the time-based data retrieval requests associated with the data streams and session managers coupled to the applications and storage nodes. Shared resources are dynamically allocated between the applications submitting the requests. Data requested by the requests is retrieved from the storage nodes using timestamp based indexes associated with the data streams in a substantially parallel manner. The retrieved data is merge-sorted by time. The sorted data is transmitted to the applications based on a delivery rate controlled by each application.

Abstract: A system for detecting a faulty behavior of a User Equipment (UE) in a telecommunication network is provided. A trouble report information associated with a first UE is received. The trouble report includes information uniquely identifying the first UE and information indicative of trouble affecting the first UE. One or more geographic locations for each communication session associated with the first UE for a predetermined period of time are established. Performance metrics associated with the first UE are compared with performance metrics associated with a plurality of UEs. The plurality of UEs includes UEs that handled communication sessions at similar times and locations. The first UE is characterized based on the comparison.

Abstract: A method, computer program product and system for performing performance and root cause analysis of failures in a telecommunication network are provided. The telecommunication network includes User Equipment (UE) devices, core network and radio access network (RAN). Information related to impacted performance and failures reported in the telecommunication network is received. Telecommunication and transport network elements associated with the reported network performance and failures are identified. Performance and configuration data associated with the identified network elements is analyzed to identify one or more causes of the reported network failures. A root cause analysis of the reported network failures is performed using knowledge and statistical inference models for each of the identified causes to provide at least one recommendation for resolving the reported network failures.

Abstract: A computer-implemented method for predicting failure of a disk that is configured to store digital data is provided. The method includes receiving health status data from a monitor that measures health status of the disk, the health status data including factor values associated with a plurality of respective disk failure factors, receiving an overall factor weight assigned to each disk failure factor, wherein the overall factor weight indicates the contribution of that factor in predicting a failure of the disk, and receiving, for each disk failure factor, a weight factor assigned to each bin of a set of bins, wherein each bin has an assigned range of factor values, the weight factor assigned to each bin indicating a probability of disk failure based on empirical results.

Abstract: A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes key performance indicator (KPI) records for monitoring a wireless communication system. The network monitoring system further includes a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured and operable to identify a list of root causes identifying failure events based on the at least one KPI rule in the at least one rule set.

Abstract: A computer-implemented method for supervising data stream storage including communicating with a probe that captures network data and outputs a plurality of data streams to a plurality of data repository units, receiving registration data associated with respective data streams that identifies the associated probes, selecting at least one of the data repository units to store the first data stream in real time based on a storage capacity of the data repository units to receive and store data, determining that storage capacity is not sufficient for the data stream in response to a change in the storage capacity of the data repository units to receive and store data, determining a corrective action in response to the determination that the storage capacity is not sufficient, and notifying the probe identified in association with the first data stream about the corrective action.

Abstract: A method for optimizing data access in a data warehouse having a model driven architecture is provided. A data model for storing time series measurement data representing a plurality of dimensions and measurements is received. The data model includes one or more aggregation tables. A query having one or more predicates is received from a user. The one or more predicates are analyzed to determine whether the received query can be optimized using the existing aggregation tables. The received query is optimized using the aggregation tables, in response to determining that such query optimization is possible.

Abstract: A network traffic monitoring system is provided. The system includes a host computer executing a plurality of virtual machines (VMs), including a monitoring VM and a virtual switch (vSwitch). The vSwitch includes a plurality of virtual Network Interface Cards (vNICs) associated with the plurality of VMs. The monitoring VM is coupled to the vSwitch and executed by the host computer. The vSwitch is configured to mirror a plurality of data packets exchanged between two communicating VMs to a vNIC associated with the monitoring VM. The monitoring VM is configured to retrieve the plurality of mirrored data packets from the vNIC associated with the monitoring VM. The monitoring VM is further configured to generate timestamps indicative of packet arrival time at the vSwitch for each data packet in the retrieved plurality based, at least in part, on a computed base time.

Abstract: A stream based storage system includes a plurality of storage nodes configured to provide storage and retrieval of at least a time-based portion of one or more data streams in response to a receipt of a data storage/retrieval request associated with the one or more data streams. Each of the one or more data streams includes a plurality of time-ordered items. The stream based storage system further includes a plurality of applications communicatively coupled to the plurality of storage nodes. The plurality of applications is configured to issue the data storage/retrieval request associated with the one or more data items.

Abstract: A computer implemented method and telecommunications diagnostic apparatus that correlates packets on a core network with those on the access network. Generated is an identification attribute from Information Elements (IEs) in S1AP packets present in the core network and accessible to the access network. The generated identification attribute is integrated to an access and core session of the access and core network to correlate data packets between the access and core session by comparing if a core session contains the same identification attribute as that of an access session within the life span of the access session.

Abstract: A monitoring device includes a video buffer model and a user model. The video buffer model monitors a media program streaming across a network to a media client for perceivable transmission impairments. The user model reflects user dissatisfaction due to types of perceivable transmission impairments and timing, duration, and frequency of perceivable transmission impairments so as to estimate a quality of experience of the media program. The parametric model can include one or more parameterized functions, and a set of parameters used in at least one of the one or more of the parameterized functions at a point in time during the streaming of the media program can be based on a type of perceivable transmission impairment associated with the point in time.

Abstract: A system for monitoring calls in a VoLTE network is provided. The monitored calls include SIP, RTP and H.248 portions. The system includes monitoring probes and first and second correlation engine components (CECs). The probe is configured to generate SIP, RTP and H.248 data records (DRs), send the SIP DRs to a second CEC based on a distribution key, generate and send a routing label to a first CEC and to send the H.248 and RTP DRs to the first CEC based on the first and second attributes, respectively. The first CEC is configured to correlate the received RTP and H.248 DRs and the routing label based on the second and first attributes, respectively, and send the correlated DRs to the second CEC based on a distribution key. The second CEC is configured to bind all of the generated DRs to a single call based on the distribution key.

Abstract: A method for monitoring streaming video content is provided. Content Delivery Network (CDN) feed sent over one or more CDNs is monitored and analyzed using a first soft probe deployed in the one or more CDNs to generate a first video session record. Video traffic sent over a packet core network (PCN) is monitored and analyzed using a second soft probe deployed in the PCN to generate a second video session record. A third session record is generated by correlating the first session record to the second session record. The third session record corresponds to an end-to-end video streaming session. One or more performance characteristics corresponding to the end-to-end video streaming session are generated based at least in part on the third session record.

Abstract: A network monitoring device monitors at least one tap point corresponding to a network interface between User Equipment (UE) and one or more additional nodes in the communication network, detects one or more transactions at the at least one tap point corresponding to the network interface with each transaction including request data and response data. The network monitoring device further determines a time associated with the request data and a time associated with the response data for each transaction, determines a delay time for each transaction for the at least one tap point by a difference between the time associated with the request data and the time associated with the response data, assigns the delay time for each transaction to one or more a predefined time ranges, and increments a count corresponding to the one or more predefined time ranges when the delay time is assigned.

Abstract: A fully-connected mesh network includes a plurality of switches. A first switch receives a packet traveling through the mesh network from an external source node to an external destination node specified by the packet. A plurality of links, which are all included in a mesh link aggregation group (LAG), couple each possible pair of the switches by a respective single link. Each of the respective links is included individually in an individual LAG. Each of the switches is configured to receive a packet from another switch of the plurality of switches via only the mesh LAG, and each switch that receives a packet via the mesh LAG is configured to transmit the packet to another switch of the plurality of switches via only one of the individual LAGs. The packet travels to the destination node at most two hops across the plurality of switches.

Abstract: A method, device and system for method of optimizing a feature of a communication network prior to implementing a future service is provided. A plurality of network nodes in the communication network is assigned to a network cluster. At least one value for a respective key performance indicator (KPI) for data exchanged between the network nodes in the network cluster is determined, where the data is associated with a first communication service. And a need for an optimization of a feature of the communication network in response to the value for the KPI being outside of a range, prior to implementation of a second communication service is determined.

Abstract: A system and method for monitoring a communication network is provided. The method includes capturing network data from network traffic of the communication network by a plurality of probes monitoring the communication network. The method further includes detecting by lightweight analysis a data packet of the captured network data that includes information related to a transactional procedure failure transacted by an end-user device and determining an identity of the end-user device. The method further includes sharing the identity of the end-user device with other probes of the plurality of probes, adding the end-user device's identity to respective whitelists associated with the probes of the plurality of probes, and performing, for end-user device identities included in the respective whitelists, detailed analysis of network data during a predetermined time period.

Abstract: A computer-implemented method for predicting failure of a disk that is configured to store digital data is provided. The method includes receiving health status data from a monitor that measures health status of the disk, the health status data including factor values associated with a plurality of respective disk failure factors, receiving an overall factor weight assigned to each disk failure factor, wherein the overall factor weight indicates the contribution of that factor in predicting a failure of the disk, and receiving, for each disk failure factor, a weight factor assigned to each bin of a set of bins, wherein each bin has an assigned range of factor values, the weight factor assigned to each bin indicating a probability of disk failure based on empirical results.