Abstract: The present invention provides an aqueous coating composition comprising by dry weight based on total dry weight of the coating composition, from 2% to 16% a small-particle-size polymeric dispersion of (co)polymeric particles having an average particle size of from 30 to 90 nm, and from 25% to 70% of titanium dioxide particles; from 50% to 100% of the titanium dioxide particles are encapsulated by a polymer shell of (co)polymeric particles.

Abstract: Provided is a pigment composition comprising (i) a plurality of particles of sulfate-process titanium dioxide, (ii) 0.1% to 25% by weight based on the weight of said particles of a water-soluble first polymer that comprises polymerized units of one or more sulfur acid monomer, and (iii) 10% to 200% by weight based on the weight of said particles of a second polymer that at least partially encapsulates said particles.

Abstract: A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers.

Abstract: A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.

Abstract: Described is a system and method for receiving first data corresponding to usage of a network, receiving second data corresponding to usage of the network, comparing the first data to the second data and providing an indication of a network event when the second data varies from the second data greater than a predetermined threshold.

Abstract: Method and apparatus for processing traffic of interest in a network is described. In one example, a baseline profile and at least one threshold is computed using initial aggregated volume data for the traffic of interest. Aggregated volume counts for time periods in a time interval are obtained. Differences between the aggregated volume counts for the time periods and values of the baseline profile for corresponding time periods are computed. An alarm is triggered for each of the differences that exceeds the at least one threshold.

Abstract: A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers.

Abstract: Systems in the current art provide capacity planning for packet networks. These systems require input data that characterizes traffic demands. The demands may be expressed as matrixes that record the number of bytes and packets exchanged between access routers or service nodes for each type-of-service. This invention defines a system and method to calculate these traffic matrixes. Access routers in a service node export flow records to a Record Collector. The flow records are processed to create ingress and egress records that are stored on the Record Collector. This data is uploaded to a Capacity Planning Server at which the traffic matrixes are generated. The egress access router(s) for a flow are determined by searching for matching ingress and egress records. Matching records have identical source and destination addresses. This algorithm requires no knowledge of the complex topology and routing protocols that are used within packet networks. Sampled or non-sampled flow records may be used.

Abstract: A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers.

Abstract: Methodologies and systems for detecting an anomaly in a flow of data or data stream are described herein. To detect an anomaly, an anomaly detection server may create a baseline based on historical or other known non-anomalous data within the data stream. The anomaly detection server then generates one or more test values based on current data in the data stream, and compares the test value(s) to the baseline to determine whether they vary by more than a predetermined amount. If the deviation exceeds the predetermined amount, an alarm is triggered. The anomaly detection server may continually adjust the baseline based on the current data in the data stream, and may renormalize the baseline periodically if desired or necessary.

Abstract: A system and method for detecting Email spammers from unknown SMTP Clients using the unknown SMTP Client's SMTP traffic information e.g. byte size and variability data. The system and method includes a byte size and variability traffic flow model and a classification system. The traffic flow model may be based upon a standard deviation of byte size and variability of traffic flows for a plurality of legitimate SMTP Clients and for a plurality of Spammer SMTP Clients. The classification system then classifies an Unknown SMTP Client as an Email Spammer based on a comparison between the byte size and the variability of the Unknown SMTP Client's traffic flows with the byte size and variability traffic flow model.

Abstract: A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.

Abstract: Systems in the current art provide capacity planning for packet networks. These systems require input data that characterizes traffic demands. The demands may be expressed as matrixes that record the number of bytes and packets exchanged between access routers or service nodes for each type-of-service. This invention defines a system and method to calculate these traffic matrixes. Access routers in a service node export flow records to a Record Collector. The flow records are processed to create ingress and egress records that are stored on the Record Collector. This data is uploaded to a Capacity Planning Server at which the traffic matrixes are generated. The egress access router(s) for a flow are determined by searching for matching ingress and egress records. Matching records have identical source and destination addresses. This algorithm requires no knowledge of the complex topology and routing protocols that are used within packet networks. Sampled or non-sampled flow records may be used.

Abstract: Systems in the current art provide capacity planning for packet networks. These systems require input data that characterizes traffic demands. The demands may be expressed as matrixes that record the number of bytes and packets exchanged between access routers or service nodes for each type-of-service. This invention defines a system and method to calculate these traffic matrixes. Access routers in a service node export flow records to a Record Collector. The flow records are processed to create ingress and egress records that are stored on the Record Collector. This data is uploaded to a Capacity Planning Server at which the traffic matrixes are generated. The egress access router(s) for a flow are determined by searching for matching ingress and egress records. Matching records have identical source and destination addresses. This algorithm requires no knowledge of the complex topology and routing protocols that are used within packet networks. Sampled or non-sampled flow records may be used.

Abstract: Systems in the current art provide capacity planning for packet networks. These systems require input data that characterizes traffic demands. The demands may be expressed as matrixes that record the number of bytes and packets exchanged between access routers or service nodes for each type-of-service. This invention defines a system and method to calculate these traffic matrixes. Access routers in a service node export flow records to a Record Collector. The flow records are processed to create ingress and egress records that are stored on the Record Collector. This data is uploaded to a Capacity Planning Server at which the traffic matrixes are generated. The egress access router(s) for a flow are determined by searching for matching ingress and egress records. Matching records have identical source and destination addresses. This algorithm requires no knowledge of the complex topology and routing protocols that are used within packet networks. Sampled or non-sampled flow records may be used.

Abstract: Methodologies and systems for detecting an anomaly in a flow of data or data stream are described herein. To detect an anomaly, an anomaly detection server may create a baseline based on historical or other known non-anomalous data within the data stream. The anomaly detection server then generates one or more test values based on current data in the data stream, and compares the test value(s) to the baseline to determine whether they vary by more than a predetermined amount. If the deviation exceeds the predetermined amount, an alarm is triggered. The anomaly detection server may continually adjust the baseline based on the current data in the data stream, and may renormalize the baseline periodically if desired or necessary.

Abstract: Systems in the current art provide capacity planning for packet networks. These systems require input data that characterizes traffic demands. The demands may be expressed as matrixes that record the number of bytes and packets exchanged between access routers or service nodes for each type-of-service. This invention defines a system and method to calculate these traffic matrixes. Access routers in a service node export flow records to a Record Collector. The flow records are processed to create ingress and egress records that are stored on the Record Collector. This data is uploaded to a Capacity Planning Server at which the traffic matrixes are generated. The egress access router(s) for a flow are determined by searching for matching ingress and egress records. Matching records have identical source and destination addresses. This algorithm requires no knowledge of the complex topology and routing protocols that are used within packet networks. Sampled or non-sampled flow records may be used.

Abstract: A system and method for providing adaptive rate selection mitigates impulse-like noise and allows for interleaving and RS coding, while not excessively delaying data transmission. Generally, the system utilizes a memory and a processor, wherein the processor is programmed by software stored within the memory to perform the step of reading a specified data transmission delay rate for a channel utilized for data transmission. A Reed Solomon encoder is utilized by the adaptive rate system, which performs the steps of: reading a specified number of redundant bytes in a Reed Solomon frame; determining a level of impulse protection control from the number of redundant bytes in the Reed Solomon frame and a maximum code word length; and determining a number of symbols comprised within the Reed Solomon frame. In addition, an interlever is utilized for determining an interlever depth via use of said number of symbols comprised within the Reed Solomon frame and the specified data transmission delay rate for the channel.

Abstract: A telecommunications method and system for providing and monitoring multiple classes of service to users seeking dial-up access to a given resource. Incoming calls from two user groups, one group subscribing to a first service level and the other group subscribing to a second service level, are initially assigned to open circuits in a first shared dial hunt group. When all circuits are busy, only calls from users subscribing to the second service level are routed to open circuits in a second dedicated dial hunt group so that second level service subscribers will have fewer calls blocked than first level service subscribers. In an alternative implementation, calls from users subscribing to a first service level are routed only to open circuits in a first dial hunt group and calls from users subscribing to a second service level are routed initially to open circuits in a second dial hunt group.

Abstract: The distribution of replica caches of information is dynamically optimized among the regions of a network, based upon the changing usage patterns. Initially, a single server in a first region stores the primary copy of information. A router in the first region receives service request messages from the plurality of users throughout network, directed to the server storing the primary copy. To determine if it is justified to deploy a replica cache, the router transmits a monitor request message to other routers in other regions of the network, requesting them to monitor all service requests in their respective regions, being directed to the primary copy in the first server. The first router then computes an optimum assignment of a replica copy of the information, for storage in at least one newly assigned server in the network.