Abstract: An adaptive stream segment prefetcher changes the number of segments it prefetches following a client requested segment of the same stream based on conditions associated with that stream at prefetch time. The adaptive prefetcher increases or decreases the number of segments to prefetch for a particular stream based on the number of active or concurrent clients requesting that particular stream, based on the playback duration of the particular stream by one or more clients, or some combination of both. The adaptive prefetcher continuously monitors the conditions associated with the stream such that number of segments prefetched at a first time are greater or less than the number of segments prefetched at a later second time.

Abstract: The implementation provides for controlled dynamic content replacement within media content. The media content is encoded in its original form with markers marking segments for time or condition triggered replacement. Each marker is provided a type. A request link is generated for requesting the media content. The link encodes control data for the different marker types. In response to a media content request, the server scans encoded chunks of the media content for markers. From the request link, the server obtains the control data for an identified marker type and determines whether to replace the content based on triggering of the control data. This allows advertising content to remain as part of the media content until reaching a certain number of impressions or a certain time. Thereafter, the content is dynamically replaced with temporally relevant content or other content from an ongoing campaign during real-time media content playback.

Abstract: Some embodiments provide a capacity management agent that modifies bandwidth that is allocated between an end user and a carrier network by caching requested content that is streamed at a first rate and then providing the cached content to the end user through the carrier network at a second rate. The agent performs a process that includes receiving data intended for a service region of the carrier network from an external data network. The process identifies resource availability at the service region. Next, the process passes the data to the service region at the first rate when the resource availability at the service region is not less than a threshold amount and caches the data for passing to the service region at the second rate that consumes fewer carrier network resource than the first rate when the resource availability at the service region is less than the threshold amount.

Abstract: An adaptive stream segment prefetcher changes the number of segments it prefetches following a client requested segment of the same stream based on conditions associated with that stream at prefetch time. The adaptive prefetcher increases or decreases the number of segments to prefetch for a particular stream based on the number of active or concurrent clients requesting that particular stream, based on the playback duration of the particular stream by one or more clients, or some combination of both. The adaptive prefetcher continuously monitors the conditions associated with the stream such that number of segments prefetched at a first time are greater or less than the number of segments prefetched at a later second time.

Abstract: The embodiments implement file size variance caching optimizations. The optimizations are based on a differentiated caching implementation involving a small size content optimized first cache and a large size content optimized second cache optimized. The first cache reads and writes data using a first block size. The second cache reads and writes data using a different second block size that is larger than the first block size. A request management server controls request distribution across the first and second caches. The request management server differentiates large size content requests from small size content requests. The request management server uses a first request distribution scheme to restrict large size content request distribution across the first cache and a second request distribution scheme to restrict small size content request distribution across the second cache.

Abstract: Some embodiments provide partitioned serialized caching and delivery of large sized content and files. Some embodiments partition requests for large sized content into segment requests with each segment request identifying a different byte range of the requested content. Each segment request is hashed to identify a particular server from a set of servers tasked with caching and delivering a different segment of the requested content. In this manner, no single server caches or delivers the entirety of large sized content. The segment requests are distributed serially across the set of servers so that the segments are passed in order, wherein the serial distribution involves handing-off the requesting user's connection serially to each server of the set of server in the order with which the set of servers deliver the content segments.

Abstract: Some embodiments provide a self-configuring firewall for automatic detection and mitigation of security weaknesses. The self-configuring firewall performs passive and active vulnerability detection. Passive detection involves scanning software resources and configurations under firewall protection for vulnerabilities present in the software and software configurations. Active detection identifies vulnerabilities by subjecting the software resources and configurations to simulated malicious traffic. The identified vulnerabilities are mapped to attack signatures. The self-configuring firewall enables the attack signatures which in turn allow the firewall to detect traffic containing attacks directed to exploiting the vulnerabilities.

Abstract: Some embodiments provide a file system for purging content based on a single traversal of the file system that identifies the directory containing the content without performing a secondary traversal within the directory to target the operation to only the file that are associated with content such that other files contained in the directory are unaffected. The file system supplements traditional directory structures with file-level directories. Each file-level directory is created to contain a root file associated with particular content, different variants of the particular content, and supporting files. Consequently, the file system can complete an operation targeting particular content by performing that operation on the file-level directory containing the particular content, thereby eliminating the need to conduct a file-by-file traversal of the containing directory as a prerequisite to identifying the files associated with the particular content and performing the operation on the files individually.

Abstract: Some embodiments provide automated and intelligent security configuration at the network edge. A server tasked with distributing content provider content automatically detects and modifies attributes in the content provider content in order to close potential security vulnerabilities prior to redistributing that content on behalf of the content provider to different recipients. The vulnerabilities can arise from the content provider misconfiguring attributes or omitting certain security attributes when creating the content. The server can provide a default or customized set of protections, wherein the customized protections are specific to each content provider or the content of each content provider.

Abstract: Some embodiments provide a proprietary 64-bit consistent distribution scheme that preserves the efficiencies of CARP while providing a significantly more balanced distribution of requests that is on par with schemes reliant on computationally expensive cryptographic hashes. The scheme performs hashing of requested URLs and identifiers of available servers over a 64-bit space while optimizing the hashing to remove computationally expensive operations. Some embodiments provide a variant of the scheme to provide a differentiated distribution on the basis of one or more differentiating factors. A first variant utilizes load factor values to adjust the resulting hashes and to produce a first distribution of differentiated content that varies from a second distribution of undifferentiated content.

Abstract: A network device receives, from a customer, a customer subscription to a media transformation service; receives, from the customer as a first component of the subscription, data associated with customer media; and receives, from the customer as a second component of the subscription, one or more customer-selected parameters that specify media transformations to be performed upon the customer media. The network device receives, from a client browser, a request for the customer media, and transforms, responsive to receipt of the request from the client browser, the customer media based on the one or more customer-selected parameters to produce a transformed version of the customer media. The network device sends the transformed version of the customer media, via a content delivery network, to the client browser.

Abstract: Techniques are disclosed that generally relate to content delivery techniques in audio-visual systems. In an audio-visual system, a method of using sensors to incrementally present content elements on a display includes presenting a first content element on the display, receiving first data from a sensor, the first data associated with a first distance. An increment coefficient is identified, and a portion size is determined by reducing the first distance by the increment coefficient. Finally, an unseen portion of a second content element is incrementally added to the display, and a presented portion of the first content element is incrementally removed from the display, the size of the portions added and removed being equal to the determined portion size.

Abstract: Some embodiments provide distributed rate limiting to combat network based attacks launched against a distributed platform or customers thereof. The distributed rate limiting involves graduated monitoring to identify when an attack expands beyond a single server to other servers operating from within the same distributed platform distribution point, and when the attack further expands from one distributed platform distribution point to other distribution points. Once request rates across the distributed platform distribution points exceed a global threshold, a first set of attack protections are invoked across the distributed platform. Should request rates increase or continue to exceed the threshold, additional attack protections can be invoked. Distributed rate limiting allows any server within the distributed platform to assume command and control over the graduated monitoring as well as escalating the response to any identified attack.

Abstract: Some embodiments provide loop detection and loop prevention mechanisms for messaging passing in between peers in a multi-tier hierarchy. In some embodiments, the messaging header is modified to track which peers have received a copy of the message. Each peer appends its identifier to the message header before passing the message to another peer. When selecting a receiving peer, the sending peer ensures that the receiving peer is not already identified in the message header. If the receiving peer has already received the message, then another peer from a next-peer list is selected to receive the message. If all peers in the next-peer have been traversed, the sending peer returns an error message via a reverse traversal of the peers in the message header.

Abstract: Some embodiments provide server-side implementation and enforcement of blackout rules for streaming content. A server receives a request from an end user device and extracts a first identifier identifying the end user device and a second identifier identifying the requested stream from the request. The server determines if blackout rules identified for the requested streaming content using the second identifier apply to the end user device based on the first identifier. The blackout rules may restrict IP addresses, IP address subnets, or geographic regions defined using zip codes or DMAs. The first identifier can be an IP address that directly or indirectly maps to the blackout rules. If the first identifier is restricted by a blackout rule, the server identifies the restrictions of the rule, when they apply, and how they are to be applied before dynamically altering the content that is streamed to the end user device.

Abstract: Provided is a system for efficiently creating snippets or clips from media assets without re-encoding the entire portion of already encoded media content falling within the snippet boundaries. The system partitions and encodes the original media asset as set of slices with each slice encoding a different temporal chunk of the media asset. The system identifies a first slice that encodes a duration of the media asset spanning the snippet start time, and a second slice that encodes a duration of the media asset spanning the snippet end time. The system produces a snippet start slice from decoding, clipping, and re-encoding the first slice and a snippet end slice from decoding, clipping, and re-encoding the second slice. The system generates the snippet from the snippet start slice, an unmodified subset of the set of slices between the first slice and the second slice, and the snippet end slice.

Abstract: Some embodiments move the task of selecting between different transit provider paths from the network level to the application level. Some embodiments perform network level configurations involving a destination network router advertising over a first transit provider path, a unique first address identifying a destination network server as reachable via the first path and advertising over a second transit provider path, a unique second address identifying the destination network server as reachable via the second path. Some embodiments further perform application level configurations involving a source network server passing a first packet to the destination network server over the first path by addressing the first packet to the first address and passing a second packet to the destination network server over the second path by addressing the second packet to the second address. The path selection may be based on policies accounting for congestion, performance, and other metrics.

Abstract: Some embodiments provide an origin whose content is distributed by a third party content distributor control over invoking attack protections from the third party content distributor. The origin independently monitors requests and messaging the content distributor passes to the origin as a result of the content distributor needing to retrieve content from the origin before redistribution or because requested content is dynamic or uncacheable. Upon detection of an attack, the origin signals the content distributor to perform one of several attack protections on its behalf. In this manner, the origin leverages the content distributor distributed platform architecture to shield itself from attack. Based on the origin signaling, the content distributor rate limits, blocks, redirects, or performs other attack protections to reduce the load on the origin server.

Abstract: Some embodiments modify caching server operation to evict cached content based on a deterministic and multifactor modeling of the cached content. The modeling produces eviction scores for the cached items. The eviction scores are derived from two or more factors of age, size, cost, and content type. The eviction scores determine what content is to be evicted based on the two or more factors included in the eviction score derivation. The eviction scores modify caching server eviction operation for specific traffic or content patterns. The eviction scores further modify caching server eviction operation for granular control over an item's lifetime on cache.

Abstract: Some embodiments provide systems and methods for determining a server of a distributed hosting system to optimally distribute content to an end user. The method includes identifying an IP address of the end user. Based on the IP address, a set of servers send packets to the end user to derive performance metrics. The performance metrics are used to determine a server from the set of servers that optimally distributes content to the end user. The method modifies a configuration for resolving end user requests such that the optimal server is identified to the end user when the end user requests content from the hosting system. Some embodiments determine the optimal server by providing downloadable content that is embedded with a monitoring tool. The monitoring tool causes the end user to derive performance metrics for the hosting system when downloading a particular object from a set of servers.