Abstract: A system and method of transmitting a DDoS, or distributed denial of service, signature from an intra-network to an internet is presented. The method includes identifying a DDoS signature and employing an inter-domain routing protocol configured to enable-operational information to be exchanged between nodes. The DDoS signature is embedded as payload of the standards-compliant inter-domain routing protocol. The step of embedding occurs within a network. The embedded DDoS signature is then sent from the network to an internet node outside of the network. The method further includes applying the DDoS signature to enable the internet nodes to filter packets matching the DDoS signature.

Abstract: A system and method of inter-router communication is described. The system and method include a routing protocol communication, configured to be sent between a plurality of routers on a network, and having a data plane update packet sent with a route update packet. The data plane update packet includes routing attributes corresponding to information export protocol signatures. A signature recognition module may be located on at least one of the routers in the network, and can store and recognize data packet signature patterns located in at least a portion of a payload of the data plane update packet. A data plane filter module can also be located on at least one of the routers, and can handle data packets according to filtering rules for specific data packet signature patterns.

Abstract: The embodiments described herein provide a method, program and computing network for processing a content request received via a computing network. The method comprises the steps of receiving an incoming request for content from a remote computing device, determining the content type requested by the incoming request and delivering the request to one of a plurality of servers according to the determined content request type.

Abstract: A quality of service routing architecture is provided which includes a network router configured to route network data traffic. The architecture may further include a routing communication protocol for to sending router control information from the network router to other network routers, the routing communication protocol having a quality of service level attribute. There may be a routing communication protocol decoding module on the network router. The routing communication protocol decoding module may identify incoming routing control communications and determine the quality of service level attribute of the incoming routing control communications. The network router can also include a quality of service forwarding module for determining a next hop router value based on the quality of service level attribute and forwarding data according to the next hop value determination.

Abstract: In a method for providing a cloud-based computing service to a user, a request for the computing service to be performed for the user is received, in which, the request includes a selection of at least one flow-slice, the at least one flow-slice comprising a network abstraction of a network pay-per-use unit. In addition, workloads to be performed by a plurality of infrastructure components to satisfy the at least one flow-slice are estimated and a provisioning scheme for the plurality of infrastructure components to implement the estimated workloads on the plurality of infrastructure components is determined.

Abstract: Data-type-based spanning tree reconfiguration includes determining volumes for one or more types of data transmitted in information flows in an existing spanning tree in a network. The spanning tree is reconfigured based on one or more of the volumes and the types of data transmitted in the flows.

Abstract: Autonomous diagnosis and mitigation of network anomalies may include creating a plurality of sketch matrices wherein each sketch matrix corresponds to an individual hashing function and each row in each sketch matrix corresponds to an array of hashed parameters of interest from multiple network devices for a given period of time, the parameters of interest being configurable by an administrator. A principal components analysis (PCA) input matrix is created for each of the sketch matrices by computing an entropy value for each element in the sketch matrices, and principal components analysis (PCA) is performed on each of the PCA input matrices to heuristically detect a network anomaly in real time.

Abstract: A method includes determining in a router whether a test portion of a received packet matches test data specified in a filter. The test portion is specified in the filter by a first offset parameter and a first length parameter. The received packet is modified by the router replacing data in a map portion of the packet with map data specified in the filter if the test portion matches the test data. The map portion is also specified in the filter by a second offset parameter and a second length parameter.

Abstract: In a method for providing a cloud-based computing service to a user, a request for the computing service to be performed for the user is received, in which, the request includes a selection of at least one flow-slice, the at least one flow-slice comprising a network abstraction of a network pay-per-use unit. In addition, workloads to be performed by a plurality of infrastructure components to satisfy the at least one flow-slice are estimated and a provisioning scheme for the plurality of infrastructure components to implement the estimated workloads on the plurality of infrastructure components is determined.

Abstract: A method and apparatus for detecting predefined signatures in packet payload is disclosed. In one embodiment, a method of string matching in a network packet payload includes performing hash on a current search string received in the network packet payload to generate respective search string hash values, storing the search string hash values in a hash buffer, performing rehash using the search string hash values to generate an associated search string rehashed value, performing a parallel search of the search string rehashed value against Content Addressable Memory (CAM) entries to determine if the search string rehashed value matches with one of the CAM entries, and identifying the current search string in the network packet payload as a match with one of the CAM entries based on the outcome of performing the parallel search.

Abstract: Load-aware spanning tree reconfiguration includes determining volumes for information flows in an existing spanning tree in a network. The spanning tree is reconfigured based on the volumes to provide higher-volume information flows with shorter paths in the reconfigured spanning tree.

Abstract: The method, apparatus and system of detecting whether a router is compromised and configured to place malicious packets onto the network are disclosed. In one embodiment, a method for detecting a malicious router includes performing hash on a current ingress packet received via the network packet payload to generate ingress packet hash values. Further, includes performing hash on current egress packet that is associated with the current ingress packet to generate egress packet hash values. The generated ingress packet hash values and the egress packet hash values are then compared. Then the router is checked to determine whether it is potentially compromised and configured to place the malicious packets based on the outcome of the comparison.

Abstract: Pattern matching for a network flow includes storing a representation of the pattern. The representation of the pattern includes hash values representing blocks of data in the pattern. Hash values are calculated for blocks of data in the network flow. The blocks of data are spread across multiple packets in the network flow. The calculated hash values for the blocks of data in the network flow are compared to the hash values in the representation of the pattern to detect the pattern in the network flow.

Abstract: A method includes determining in a router whether a test portion of a received packet matches test data specified in a filter. The test portion is specified in the filter by a first offset parameter and a first length parameter. The received packet is modified by the router replacing data in a map portion of the packet with map data specified in the filter if the test portion matches the test data. The map portion is also specified in the filter by a second offset parameter and a second length parameter.

Abstract: A system for communication flow estimation and method therefore are described. The system comprises a filter array arranged to receive a packet, an index hash unit, a flow count array, and a global average counter. The index hash unit generates an index based on a received index set. The flow count array comprises one or more counters and updates a counter based on a received index. The global average counter updates an average count of received packets based on the received packet.

Abstract: A system and method of transmitting a DDoS, or distributed denial of service, signature from an intra-network to an internet is presented. The method includes identifying a DDoS signature and employing an inter-domain routing protocol configured to enable-operational information to be exchanged between nodes. The DDoS signature is embedded as payload of the standards-compliant inter-domain routing protocol. The step of embedding occurs within a network. The embedded DDoS signature is then sent from the network to an internet node outside of the network. The method further includes applying the DDoS signature to enable the internet nodes to filter packets matching the DDoS signature.

Abstract: A quality of service routing architecture is provided which includes a network router configured to route network data traffic. The architecture may further include a routing communication protocol for to sending router control information from the network router to other network routers, the routing communication protocol having a quality of service level attribute. There may be a routing communication protocol decoding module on the network router. The routing communication protocol decoding module may identify incoming routing control communications and determine the quality of service level attribute of the incoming routing control communications. The network router can also include a quality of service forwarding module for determining a next hop router value based on the quality of service level attribute and forwarding data according to the next hop value determination.

Abstract: A system and method of inter-router communication is described. The system and method include a routing protocol communication, configured to be sent between a plurality of routers on a network, and having a data plane update packet sent with a route update packet. The data plane update packet includes routing attributes corresponding to information export protocol signatures. A signature recognition module may be located on at least one of the routers in the network, and can store and recognize data packet signature patterns located in at least a portion of a payload of the data plane update packet. A data plane filter module can also be located on at least one of the routers, and can handle data packets according to filtering rules for specific data packet signature patterns.

Abstract: A system for communication flow estimation and method therefore are described. The system comprises a filter array arranged to receive a packet, an index hash unit, a flow count array, and a global average counter. The index hash unit generates an index based on a received index set. The flow count array comprises one or more counters and updates a counter based on a received index. The global average counter updates an average count of received packets based on the received packet.

Abstract: Pattern matching for a network flow includes storing a representation of the pattern. The representation of the pattern includes hash values representing blocks of data in the pattern. Hash values are calculated for blocks of data in the network flow. The blocks of data are spread across multiple packets in the network flow. The calculated hash values for the blocks of data in the network flow are compared to the hash values in the representation of the pattern to detect the pattern in the network flow.