Abstract: Some embodiments of the invention provide a method of sending data messages from an edge router at a first location of an enterprise network to a SaaS (software as a service) application server provided by a third-party at a second location. The method receives, from a DNS (domain name system) first server, a resolution for a particular destination network address for the SaaS application server at the second location. From a second server, the method obtains an identifier for a first cloud gateway from multiple cloud gateways at multiple locations through which the particular destination address for the SaaS application server can be reached, the first cloud gateway farther from the first location than a second cloud gateway in the multiple cloud gateways but closer to the second location than the second cloud gateway. The method uses an optimized SD-WAN connection to the first cloud gateway to forward data messages for the first cloud gateway to the SaaS application at the second location.

Abstract: In some aspects, the disclosure is directed to methods and systems for detection and classification of stamps in documents. The system can receive image data and textual data of a document. The system can pre-process and filter that data, and covert the textual data to a term frequency inverse document frequency (TF-IDF) vector. The system can detect the presence of a stamp on the document. The system can extract a subset of the image data including the stamp. The system can extract text from the subset of the image data. The system can classify the stamp using the extracted text, the image data, and the TF-IDF vector. The system can store the classification in a database.

Abstract: One aspect provides a method and system for managing address resolution requests in a network. During operation, a gateway of the network advertises a route for sending address resolution requests and determines whether a cached entry corresponding to an address resolution request received via the route exists in a neighbor table. In response to determining that the cached entry exists, the gateway responds to the address resolution request based on the cached entry; in response to determining that the cached entry does not exist, the gateway replicates the address resolution request to edge devices in the network, thereby facilitating discovery of a target host corresponding to the address resolution request.

Abstract: A switch that can report unavailability in a label-switched network is provided. During operation, the switch can determine that a label-switched path is unavailable for forwarding a packet. The switch can then generate a notification message for collecting unavailability information at a respective upstream hop of the label-switched path. The notification message includes a depth indicator indicating the depth of collected unavailability information and an ingress label of the packet at the switch. If the switch is an intermediate switch on the label-switched path, the switch can forward the notification message to an upstream switch on the label-switched path, thereby allowing the upstream switch to collect further unavailability information in the notification message.

Abstract: Systems and methods are provided for detecting changes in network activity that are depicted in a routing table. The routing table may be stored as a search tree data structure (e.g., Merkle Patricia Tree) to mimic a standard routing table and reduce the search time to find the desired route by allowing the router to traverse the search tree data structure more efficiently. Additionally, the metadata of the tree may be provided to an unstructured machine learning model (e.g., K-means) to identify new clusters of routes week-over-week and generate an alert with any changes. Changes are identified in near real time and dynamically at the router (not a central device) to reduce the time needed to respond to network changes.

Abstract: In some aspects, the disclosure is directed to methods and systems for machine learning-based data extraction using multiple string searching models. String extraction logic may differ depending on the type of document received. For documents identified to contain line item structures, broader searching models are applied to the document to account for the increased variability of data in the document inherent in data organized in line item structures. For documents identifier to contain non-line item structures, stricter searching models are applied to the document to account for predictable data in the document associated with data organized in non-line item structures.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: Examples provided herein describe a method for providing security for Internet of Things (IoT) devices. For example, a data packet from an IoT device may be received at an edge device. A signature associated with the IoT device may be accessed at the edge device, where the signature includes network layer information about the IoT device. A set of rules may be applied by the edge device to validate the IoT device based on the accessed signature. Responsive to the IoT device being validated based on the accessed signature, received data packet, and the applied set of rules, the edge device may process the data packet from the IoT device.

Abstract: A method and system for enhanced time synchronization with lesser delay and jitter, from a gateway of a network or an external standard time source, over the internet, in a traditional network, including SDN, by NTP clients like newly added devices, spawned VMs and the like, by automatic deployment of the distributed NTP service through DHCP and DNS servers by spawning NTP demons (ntpd), according to the time synchronization requests received, thereby offloading the NTP functionality of the gateway and decreasing NTP traffic.

Abstract: One aspect provides a method and system for managing address resolution requests in a network. During operation, a gateway of the network advertises a route for sending address resolution requests and determines whether a cached entry corresponding to an address resolution request received via the route exists in a neighbor table. In response to determining that the cached entry exists, the gateway responds to the address resolution request based on the cached entry; in response to determining that the cached entry does not exist, the gateway replicates the address resolution request to edge devices in the network, thereby facilitating discovery of a target host corresponding to the address resolution request.

Abstract: In some aspects, the disclosure is directed to methods and systems for detection and classification of stamps in documents. The system can receive image data and textual data of a document. The system can pre-process and filter that data, and covert the textual data to a term frequency inverse document frequency (TF-IDF) vector. The system can detect the presence of a stamp on the document. The system can extract a subset of the image data including the stamp. The system can extract text from the subset of the image data. The system can classify the stamp using the extracted text, the image data, and the TF-IDF vector. The system can store the classification in a database.

Abstract: Systems, methods and devices for adding key chain and key derivative functions (KDF) support for Network time protocol (NTP) authentication using password based key derivation functions-NTP (PBKDF-NTP) are disclosed. In one embodiment, a method includes generating time bound multiple short lived keys instead of long lived keys for NTP security which ensures that attacker will not get enough time to crack the key values. The usage of time bound multiple short lived keys instead of long lived keys for NTP security will ensure that attacker will not get enough time to crack the key values within key lifetime. Hence man-in-middle attack can be avoided in NTP.

Abstract: A switch that can report unavailability in a label-switched network is provided. During operation, the switch can determine that a label-switched path is unavailable for forwarding a packet. The switch can then generate a notification message for collecting unavailability information at a respective upstream hop of the label-switched path. The notification message includes a depth indicator indicating the depth of collected unavailability information and an ingress label of the packet at the switch. If the switch is an intermediate switch on the label-switched path, the switch can forward the notification message to an upstream switch on the label-switched path, thereby allowing the upstream switch to collect further unavailability information in the notification message.

Abstract: In some aspects, the disclosure is directed to methods and systems for detection and classification of stamps in documents. The system can receive image data and textual data of a document. The system can pre-process and filter that data, and covert the textual data to a term frequency inverse document frequency (TF-IDF) vector. The system can detect the presence of a stamp on the document. The system can extract a subset of the image data including the stamp. The system can extract text from the subset of the image data. The system can classify the stamp using the extracted text, the image data, and the TF-IDF vector. The system can store the classification in a database.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: In some aspects, the disclosure is directed to methods and systems for detection and classification of stamps in documents. The system can receive image data and textual data of a document. The system can pre-process and filter that data, and covert the textual data to a term frequency inverse document frequency (TF-IDF) vector. The system can detect the presence of a stamp on the document. The system can extract a subset of the image data including the stamp. The system can extract text from the subset of the image data. The system can classify the stamp using the extracted text, the image data, and the TF-IDF vector. The system can store the classification in a database.

Abstract: A system and a method for eliminating data loss in a virtually aggregated network are described. A first network device may identify inactivity of a central network device present in a communication network. The central network device is responsible for distributing routing information between a plurality of network devices including the first network device. The first network device delays network route calculations until a second network device is elected from the plurality of network devices to perform functions of the central network device. The second network device generates link state information related to the plurality of network devices, and shares the link state information with the plurality of network devices. Upon receiving the link state information, the plurality of network device may resume the route calculations.

Abstract: A method and system for enhanced time synchronization with lesser delay and jitter, from a gateway of a network or an external standard time source, over the internet, in a traditional network, including SDN, by NTP clients like newly added devices, spawned VMs and the like, by automatic deployment of the distributed NTP service through DHCP and DNS servers by spawning NTP demons (ntpd), according to the time synchronization requests received, thereby offloading the NTP functionality of the gateway and decreasing NTP traffic.

Abstract: A system, method, and computer program for providing tunneling redundancy is provided. The method may include using router redundancy protocols on routers at endpoints of virtual IP tunnels to allow for failover of a master router to a backup router that assumes control over a virtual IP address in order to keep packet transmission in the virtual IP tunnel flowing with minimal interruption and no remote reconfiguration.

Abstract: Examples disclosed herein relate to a method comprising changing a state at a first device in a virtual stack forwarding (VSF) stack topology, wherein each device in the VSF stack topology has a synchronized state in a corresponding local database storing state and configuration for the device. The method may also comprise transmitting, from the first device, the changed state to a commander node of the VSF stack topology, committing, by the commander node, the changed state to a first local database of the commander node and transmitting, by the commander node, the changed state to a root node of the VSF stack topology. The method may also comprise committing, by the root node, the changed state to a second local database of the root node and propagating, by the root node, the changed state throughout the VSF stack topology.