Abstract: A non-transitory computer readable medium, a system, and a method for displaying a remote browser isolation (RBI) configuration window are disclosed. In an embodiment, a non-transitory computer readable medium includes instructions to be executed in a computer system, where the instructions when executed in the computer system perform a method comprising displaying an RBI configuration window, displaying an on/off activation feature within the RBI configuration window, and displaying an RBI profile selection menu within the RBI configuration window, where the RBI profile selection menu includes a plurality of spatially grouped sets that include an RBI profile selector, RBI profile identifier text, and selectable RBI protected browsing action icons that indicate to a user whether a corresponding RBI protected browsing action is included in an RBI policy.

Abstract: A non-transitory computer readable medium, a system, and a method for displaying a remote browser isolation (RBI) configuration window are disclosed. In an embodiment, a non-transitory computer readable medium includes instructions to be executed in a computer system, where the instructions when executed in the computer system perform a method comprising displaying an RBI configuration window, displaying an on/off activation feature within the RBI configuration window, and displaying an RBI profile selection menu within the RBI configuration window, where the RBI profile selection menu includes a plurality of spatially grouped sets that include an RBI profile selector, RBI profile identifier text, and selectable RBI protected browsing action icons that indicate to a user whether a corresponding RBI protected browsing action is included in an RBI policy.

Abstract: An advancement over previous techniques using only certain out-of-band probe PDUs to determine loss. Packet loss statistics for a SD-WAN overlay path can be calculated for every packet transmitted by one endpoint and every packet received at the other endpoint. The roles of the positions of circular buffers can be periodically rotated from active to pre-stable to stable to post-stable. Counters in the active role can be incremented whenever a packet is transmitted. A position identifier can indicate which counter to increment when the packet is received. Counters in positions that are stable can be used to produce loss statistics for the SD-WAN overlay path.

Abstract: An advancement over previous techniques using only certain out-of-band probe PDUs to determine loss. Packet loss statistics for a SD-WAN overlay path can be calculated for every packet transmitted by one endpoint and every packet received at the other endpoint. The roles of the positions of circular buffers can be periodically rotated from active to pre-stable to stable to post-stable. Counters in the active role can be incremented whenever a packet is transmitted. A position identifier can indicate which counter to increment when the packet is received. Counters in positions that are stable can be used to produce loss statistics for the SD-WAN overlay path.

Abstract: Embodiments herein disclose methods for selecting one or more paths for routing application traffic based on application performance metrics for hosted applications. In an embodiment, to select the best path, the available paths can be monitored to understand the performance of specific applications through those paths. Subsequently, the performance data is used to derive an application link score (ALS) for any given combination of application and path. The ALS is then be used to determine the best path for a given application.

Abstract: Embodiments herein disclose methods for selecting one or more paths for routing application traffic based on application performance metrics for hosted applications. In an embodiment, to select the best path, the available paths can be monitored to understand the performance of specific applications through those paths. Subsequently, the performance data is used to derive an application link score for any given combination of application and path, wherein the application link score is generated as a function of packet delay and packet loss. The ALS is then be used to determine the best path for a given application.

Abstract: In accordance with an embodiment of the invention, a method for routing connections in an SD-WAN is disclosed. The method involves receiving TURN server performance metrics via Border Gateway Protocol (BGP) and receiving network performance metrics from calculations made using Service Level Agreement (SLA) protocol data units (PDUs) for TURN servers in an SD-WAN, generating a score for at least one TURN server in the SD-WAN based on the received TURN server performance metrics and received network performance metrics for the at least one TURN server, selecting a TURN server based on the score generated for the at least one TURN server, and routing a connection over the selected TURN server.

Abstract: Embodiments herein disclose methods for selecting one or more paths for routing application traffic based on application performance metrics for hosted applications. In an embodiment, to select the best path, the available paths can be monitored to understand the performance of specific applications through those paths. Subsequently, the performance data is used to derive an application link score for any given combination of application and path, wherein the application link score is generated as a function of packet delay and packet loss. The ALS is then be used to determine the best path for a given application.

Abstract: Embodiments herein disclose methods for selecting one or more paths for routing application traffic based on application performance metrics for hosted applications. In an embodiment, to select the best path, the available paths can be monitored to understand the performance of specific applications through those paths. Subsequently, the performance data is used to derive an application link score (ALS) for any given combination of application and path. The ALS is then be used to determine the best path for a given application.

Abstract: In accordance with an embodiment of the invention, a method for routing connections in an SD-WAN is disclosed. The method involves receiving TURN server performance metrics via Border Gateway Protocol (BGP) and receiving network performance metrics from calculations made using Service Level Agreement (SLA) protocol data units (PDUs) for TURN servers in an SD-WAN, generating a score for at least one TURN server in the SD-WAN based on the received TURN server performance metrics and received network performance metrics for the at least one TURN server, selecting a TURN server based on the score generated for the at least one TURN server, and routing a connection over the selected TURN server.

Abstract: An apparatus and method are disclosed for detecting intrusions in Voice over Internet Protocol systems, without the use of an attack signature database. In particular, the illustrative embodiment is based on the observation that some VoIP-related protocols (e.g., the Session Initiation Protocol [SIP], etc.) are simple enough to be represented by a finite-state machine (FSM) of compact size. A finite-state machine is maintained for each session/node/protocol combination, and any illegal state or state transition—which might be the result of a malicious attack—is flagged as a potential intrusion.

Abstract: An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.

Abstract: An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.

Abstract: A method is disclosed that enables mitigating at least some of the problems caused by a packet attack. When a first Internet Protocol (IP)-capable device is subjected to a packet attack, it indicates periodically to a second IP-capable device that certain communications with the first device are to be suspended. The periodic transmitting of the indication is performed at a slower rate than the keep-alive mechanism that is normally used to detect loss of connectivity. When the second device receives the transmitted indication, it refrains from transmitting keep-alive messages to the first device for a predetermined interval. Meanwhile, the first device also refrains from transmitting keep-alive messages to the second device for a similar interval. In transmitting the suspend indication, the illustrative embodiment seeks to prevent pairs of communicating devices that are experiencing packet attacks from continuing their operation under the erroneous assumption that each device is unavailable.

Abstract: A method is disclosed that enables the implementation of an embedded firewall at a telecommunications endpoint. In particular, the illustrative embodiment of the present invention addresses the relationship between the application, firewall engine, and packet-classification rules database that are all resident at the endpoint. In the variations of the illustrative embodiment that are described herein, the application: (i) directly communicates with the co-resident firewall engine such as through local message passing, (ii) shares memory with the firewall engine, and (iii) makes socket calls to the operating system that are intercepted by a middleware layer that subsequently modifies the rules database, depending on the socket call. The common thread to these techniques is that the application, firewall engine, and rules database are co-resident at the endpoint, which is advantageous in the implementation of the embedded firewall.

Abstract: A method is disclosed that enables the avoidance of a processor overload of a telecommunications endpoint device that is susceptible to traffic floods. An enhanced network switch sets the speed on one of its data ports as a specific function of the speeds of the devices that are connected to one or more of its other data ports. This behavior is different from that of network switches in the prior art, in which the data rate of a port in the prior art is auto-negotiated to the highest speed that can be supported by the network elements at either end of the port's connection, regardless of the other devices present. By considering the specific devices that are connected, the enhanced network switch is able to limit the amount of traffic that is directed by an upstream device, such as a router, towards a device with limited processor capability, such as a packet-based phone.

Abstract: A method is disclosed that enables the transmission of a digital message along with a corresponding media information signal, such as audio or video. A telecommunications device that is processing the information signal from its user, such as a speech signal, encodes the information signal by using a model-based compression coder. One such device is a telecommunications endpoint. Then, based on an evaluation of the perceptual significance of each encoded bit, or on some other meaningful characteristic of the signal, the endpoint's processor: (i) determines which encoded bits can be overwritten; and (ii) intersperses the digital message bits throughout the encoded signal in place of the overwritten bits. The endpoint then transmits those digital message bits as part of the encoded information signal. In this way, no additional bits are appended to the packet to be transmitted, thereby addressing the issue of compatibility with existing protocols and firewalls.

Abstract: A method is disclosed that enables the transmission of a digital message along with a corresponding information signal, such as audio or video. The supplemental information contained in digital messages can be used for a variety of purposes, such as enabling or enhancing packet authentication. In particular, a telecommunications device that is processing an information signal from its user, such as a speech signal, encrypts the information signal by performing a bitwise exclusive-or of an encryption key stream with the information signal stream. The device, such as a telecommunications endpoint, then intersperses the bits of the digital message throughout the encrypted signal in place of those bits overwritten, in a process referred to as “watermarking.” The endpoint then transmits the interspersed digital message bits as part of a composite signal that also comprises the encrypted information bits. No additional bits are appended to the packet to be transmitted, thereby addressing compatibility issues.

Abstract: Performance problems or other conditions are analyzed in a system comprising a plurality of endpoint devices and an associated centralized or distributed controller. End-to-end measurements are obtained for respective paths through the network, for example, using communications between the endpoint devices. For a given end-to-end measurement obtained for a particular one of the paths, a value of a performance indicator for the path is determined and the performance indicator value is assigned to each of a plurality of links of the path. The determining and assigning operations are repeated for additional ones of the end-to-end measurements, the links are grouped into one or more exculpation or inculpation sets based on how many times a particular performance indicator value has been assigned to each of the links, and the one or more sets are utilized to determine, for example, the location of a performance problem in the network.

Abstract: An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.