Abstract: A virtual device management system for creating and implementing virtual devices and associated methods are provided herein. The system presents to a user a list of devices available for combining to create the virtual device. When the system receives from the user a selection of two or more devices that the user wishes to combine to create the virtual device, the system presents to the user a list of available functions that can be performed by the virtual device based on the selected devices. The system then receives from the user a selection of one or more functions and configures the virtual device to perform the selected functions. The system can also be configured to present, via a user interface via a mobile application running on a user device, a plurality of virtual devices with predetermined functionalities that are created by detecting the various connected devices within an IoT network.

Abstract: Techniques are described for providing network device management. In some implementations, a native mobile device application enables use of a mobile device to add new devices to a network, remove devices from a network, change network and device profile settings, troubleshoot a network, provide an interface into network devices, communications, diagnostics, etc., and provide remote access to the network for installation, programming, troubleshooting, and inclusion.

Abstract: A computer-implemented method and a transport manager system operate to reduce network congestion by detecting one or more data flows in a network, determining, using a candidate flow detection threshold, whether a data flow of the one or more data flows is a candidate flow, the candidate flow detection threshold being based on one or more characteristics of the one or more data flows, and in response to determining that the data flow is the candidate flow, managing the data flow. A consumption rate, a duration, a number of bytes communicated, a throughput, or aggregated characteristics of the one or more data flows may be used to determine the candidate flow detection threshold.

Abstract: A system for analytics collection from distributed resource in a software-defined networking. The system comprises: an analytics engine; and a resource interface communicated with the analytics engine, the resource interface being configured to collect telemetry data from the resource and to transmit the telemetry data to the analytics engine.

Abstract: A device may obtain configuration data for a server-side model. The device may generate synthetic usage data based on the configuration data. The device may train the server-side model based on the synthetic usage data. The device may determine update data based on the trained server-side model. The device may provide, to a client device, a message that includes the update data. The message may be configured to cause the client device to train a client-side model based on the update data and historical user data associated with the client device. The device may receive, from the client device, the client-side model data and may select content data based on the client-side model data and the trained server-side model. The device may provide the content data to the client device to permit the client device to provide content that is associated with the content data.

Abstract: Techniques are disclosed to automate TLS certificate rotation. For example, a certificate rotation event may be detected from a certificate management tool. The certificate rotation event may be associated with a first certificate and may indicate that the first certificate is to be updated with a second certificate. An application server that is running on a host and to which the first certificate is bound may be identified. A certificate identifier for the second certificate may be provided to one or more agents running on the host. A distribution service may obtain certificate information, e.g., a public key, a private key, or a certificate identifier for the second certificate, from the certificate rotation tool. Some or all of the certificate information for the second certificate may be obtained by the one or more agents running on the host. The one or more agents may instruct the application server to bind the second certificate.

Abstract: A service management method and apparatus, and a storage medium, where the method is used in a service management system, and where the service management system includes a service management unit and at least one first network management unit. The method includes: receiving, by the service management unit, a service management request, where the service management request carries network type indication information or service requirement information; and determining, by the service management unit, a target network type based on the network type indication information or the service requirement information, where a target network corresponding to the target network type is configured to provide a service, and the target network type includes a sliced network or a non-sliced network.

Abstract: Real-time enrichment for deep packet inspection is disclosed. A flow identifier iteratively accesses records generated in response to actions by a plurality of computing devices that are communicating through a same gateway router. Each record identifies a device identifier of a corresponding computing device of the plurality of computing devices. A subset of computing devices of the plurality of computing devices is identified based on a criterion. Device identifier information comprising device identifiers that identify the subset of computing devices is generated, each device identifier corresponding to one of the computing devices in the subset of computing devices. The device identifier information is provided to a deep packet inspector that monitors the gateway router and captures packets communicated through the gateway router based on the device identifiers.

Abstract: A system is provided for performing a predetermined function within a total area of operation, wherein the system includes a plurality of autonomous agents. Each autonomous agent is able to detect respective local parameters. Each autonomous agent uses a Kalman filter component to establish an environment state based a plurality of state measurements over time. The output of the Kalman filter component within a respective agent is applied to reinforcement learning by an actor-critic task controller, within the respective agent, to determine a subsequent action to be performed by the respective agent in accordance with a reward function. Each agent includes a Kalman consensus filter that addresses errors of the plurality of state measurements over time.

Abstract: Various systems and methods of establishing and utilizing device management (DM) services in Internet of Things (IoT) networks and similar distributed network architectures, are described. In an example, RESTful messaging within IoT operational and resource models are used to establish, instantiate, and operate DM services having various roles within an IoT framework abstraction.

Abstract: Methods and systems for validating security policy in a cloud computing environment are provided. An example method includes providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges, receiving a security policy, the security policy logically describing rules for the relationships between the workloads, determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy, and providing the list of violations to a user.

Abstract: A multi-layered parallel aggregation can be performed on large-scale metric streams using layers of independent host server computers that perform partial aggregations on results of a previous layer and pass a result of the partial aggregation to a next layer of host server computers, until a single host server computer in a last layer can calculate a final output, which is a combination of the partial aggregations. Because every layer is aggregating input streams, the quantity of data exchange lowers as the layer number increases. The number of layers is chosen so as to ensure that data ingested by a last layer is sufficiently manageable that a single host server computer in the last layer can aggregate all of the partial aggregates into a final result.

Abstract: The invented method includes one or more of the following aspects of selecting a multiplicity of nodes, deriving a designator for each node of the multiplicity of nodes and associating each designator in a one-to-one correspondence with a respective node from which a respective designator is derived, each designator indicating a plurality of dimensional values, and each dimensional value expressing a quality of a variate property of an associated node, selecting a unique designator having a particular pattern of dimensional values, selecting a first node having a first node designator matching the particular pattern of dimensional values, and when no node is found to have the particular pattern of dimensional values expressed in the respective designator to be connected by an edge to an external node, reporting a positive finding of an island.

Abstract: A source access network device multicasts copies of a packet to multiple core switches, for switching to a same target access network device. The core switches are selected for the multicast based on a load balancing algorithm managed by a central controller. The target access network device receives at least one of the copies of the packet and generates at least metric indicative of a level of traffic congestion at the core switches and feeds back information regarding the recorded at least one metric to the controller. The controller adjusts the load balancing algorithm based on the fed back information for selection of core switches for a subsequent data flow.

Abstract: A computer system to track and enhance performance of a virtual workspace system is provided. The computer system receives requests to profile phases of a distributed process executed by hosts coupled to one another via a network. Each of phase includes operations executed by processes hosted by the hosts. Each of phase either starts with receipt of a request via a user interface of a virtualization client or ends with provision of a response to the request via the user interface. The computer system identifies event log entries that each include an identifier of an event marking a start or an end of one of the operations, constructs a performance profile based on the event log entries, and transmits the performance profile to the user interface.

Abstract: Content such as advertisements received into a mobile device may be more appropriately displayed on an alternative device remote from the mobile device. When ad content is received into the mobile device, the user may perform a physical gesture such as movement of the device or an associated motion sensor. The physical gesture is analyzed in the mobile device and causes the ad content to be redirected to the remote device. Additional physical gestures by the user can be interpreted in the mobile device to manipulate the content on the remote device.

Abstract: A computer-implemented method is provided for comparing the security profile of a particular entity to peer entities. The method can include receiving, for a particular entity, (i) a value for at least one feature and (ii) a number of security records of one or more security risk types. The method can include determining peer entities based on the value of the features; obtaining, for each peer entity, a number of security records; and adjusting the number of peer security records based on the number of entity security records. The method can further include comparing, for one or more security risk types, the received number of security records for the particular entity to the respective adjusted number of security records for each peer entity; and comparing a security profile of the particular entity to security profiles of the population of peer entities based on the comparison for the security risk types.

Abstract: A traffic anomaly sensing system 10 includes a preprocessing unit 11, a local graph feature generation unit 12, a global graph feature generation unit 13, a learning unit 14, and an anomaly determination unit 15. The preprocessing unit 11 generates a communication history graph from traffic data. The local graph feature generation unit 12 generates, from the communication history graph, a local graph feature about a certain vertex. The global graph feature generation unit 13 generates, from the communication history graph, a global graph feature about a vertex. The learning unit 14 generates a feature vector by combining the generated local graph feature and the generated global graph feature and generates a learned model for each host identifier. The anomaly determination unit 15 determines whether the traffic data is anomalous or not by inputting the graph feature to the generated learned model.

Abstract: A data storage of a communication device stores a communication parameter. A communication parameter responder of a controller, upon receipt from a control device, via a communicator, of a communication parameter request-command indicating a communication parameter request, reads and acquires the communication parameter stored in the data storage. The communication parameter responder generates a response command containing the acquired communication parameter and sends the response command to the control device via the communicator.

Abstract: A method for policing APN-AMBR includes, at P-GW including plural P-GW DP worker instances: receiving, uplink data to be transmitted over a non-GBR bearer associated with a first PDN session from a first UE via an AP or downlink data to be transmitted over the non-GBR bearer to the first UE via the AP; forwarding the uplink or downlink data to a first P-GW DP worker instance of the plurality of P-GW DP worker instances that is assigned to the PDN session; and, at the first P-GW DP worker instance, transmitting, to an APN-AMBR policer separate from the P-GW, a request for a slice of APN-AMBR capacity for processing the uplink or downlink data. The method further includes, at the APN-AMBR policer: maintaining records of APN-AMBR capacity used by UEs having PDN sessions assigned to different ones of the P-GW DP worker instances; and granting or denying the request based on the APN-AMBR capacity used by the PDN sessions assigned to the different ones of the P-GW DP worker instances.