Abstract: Embodiments of the invention include a computer-implemented method for detecting anomalies in non-stationary data in a network of computing entities. The method collects non-stationary data in the network and classifies the non-stationary data according to a non-Markovian, stateful classification, based on an inference model. Anomalies can then be detected, based on the classified data. The non-Markovian, stateful process allows anomaly detection even when no a priori knowledge of anomaly signatures or malicious entities exists. Anomalies can be detected in real time (e.g., at speeds of 10-100 Gbps) and the network data variability can be addressed by implementing a detection pipeline to adapt to changes in traffic behavior through online learning and retain memory of past behaviors. A two-stage scheme can be relied upon, which involves a supervised model coupled with an unsupervised model.

Abstract: Optimizing a network comprising a core computing system (CCS) and a set of edge computing devices (ECDs), wherein each of the ECDs locally performs computations based on a trained machine learning (ML) model. A plurality of ML models are continually trained at the CCS, concurrently, based on data collected from the ECDs. One or more states of the network and/or components thereof are monitored. The monitored states are relied upon to decide (when) to change a trained ML model as currently used by any of the ECDs to perform said computations. It may be decided to change the model used by a given one of the ECDs to perform ML-based computations. One of the models as trained at the CCS is selected (based on the monitored states) and corresponding parameters are sent to this ECD. The latter can resume computations according to a trained model.

Abstract: Distinct sets of non-stationary data seen on a switch in data communication with one or more of computerized units in a network, are mirrored via two switch ports, which include a first port and a second port. A dual analysis is performed while mirroring said distinct sets of data. First data obtained from data mirrored at the first port are analyzed (e.g., using a trained machine learning model) and, based on the first data analyzed, the switch is reconfigured for the second port to mirror second data, which are selected from non-stationary data as seen on the switch (e.g., data received and/or transmitted by the switch). The second data mirrored at the second port is analyzed (e.g., using a different analysis scheme, suited for the selected data).

Abstract: Distinct sets of non-stationary data seen on a switch in data communication with one or more of computerized units in a network, are mirrored via two switch ports, which include a first port and a second port. A dual analysis is performed while mirroring said distinct sets of data. First data obtained from data mirrored at the first port are analyzed (e.g., using a trained machine learning model) and, based on the first data analyzed, the switch is reconfigured for the second port to mirror second data, which are selected from non-stationary data as seen on the switch (e.g., data received and/or transmitted by the switch). The second data mirrored at the second port is analyzed (e.g., using a different analysis scheme, suited for the selected data).

Abstract: Optimizing a network comprising a core computing system (CCS) and a set of edge computing devices (ECDs), wherein each of the ECDs locally performs computations based on a trained machine learning (ML) model . A plurality of ML models are continually trained at the CCS, concurrently, based on data collected from the ECDs. One or more states of the network and/or components thereof are monitored. The monitored states are relied upon to decide (when) to change a trained ML model as currently used by any of the ECDs to perform said computations. It may be decided to change the model used by a given one of the ECDs to perform ML-based computations. One of the models as trained at the CCS is selected (based on the monitored states) and corresponding parameters are sent to this ECD. The latter can resume computations according to a trained model.

Abstract: Embodiments of the invention include a computer-implemented method for detecting anomalies in non-stationary data in a network of computing entities. The method collects non-stationary data in the network and classifies the non-stationary data according to a non-Markovian, stateful classification, based on an inference model. Anomalies can then be detected, based on the classified data. The non-Markovian, stateful process allows anomaly detection even when no a priori knowledge of anomaly signatures or malicious entities exists. Anomalies can be detected in real time (e.g., at speeds of 10-100 Gbps) and the network data variability can be addressed by implementing a detection pipeline to adapt to changes in traffic behavior through online learning and retain memory of past behaviors. A two-stage scheme can be relied upon, which involves a supervised model coupled with an unsupervised model.

Abstract: Embodiments of the invention are directed to a computer-implemented method for monitoring a computerized network comprising several nodes that are, each, configured for receiving and/or sending data packets via one or more communication channels, such that physical queues of data packets arriving at and/or departing from each of the nodes may form in said one or more communication channels. According to this method, virtual queues are maintained, wherein each of said virtual queues simulates a queue of data packets in a virtual channel associated to one of said one or more communication channels, wherein the service rate of said virtual channel can be varied. The virtual queues maintained are further monitored. Finally, this method comprises varying a service rate of one or more virtual channels, on which queues are respectively simulated by one or more of the virtual queues maintained.

Abstract: Embodiments of the invention are directed to a computer-implemented method for monitoring a computerized network comprising several nodes that are, each, configured for receiving and/or sending data packets via one or more communication channels, such that physical queues of data packets arriving at and/or departing from each of the nodes may form in said one or more communication channels. According to this method, virtual queues are maintained, wherein each of said virtual queues simulates a queue of data packets in a virtual channel associated to one of said one or more communication channels, wherein the service rate of said virtual channel can be varied. The virtual queues maintained are further monitored. Finally, this method comprises varying a service rate of one or more virtual channels, on which queues are respectively simulated by one or more of the virtual queues maintained.

Abstract: The present invention is notably directed to a computer-implemented method for monitoring a computerized network. Said network comprises several switches that are, each, configured for processing data queuing thereat. The method comprises monitoring queues of data at switches of the network at an entity external to and in communication with the network. Monitoring is carried out by first sending, via a data path of the network, an execution data packet to each of the switches. The execution data packet comprises contents interpretable by said each of the switches so as for the latter to start and/or stop an execution of a sampling mechanism for sampling a queue of data at said each of the switches and returning sampled data to the external entity. Eventually, data sampled according to this sampling mechanism are received at the external entity (from each of the switches, and via said data path). The present invention is further directed to related methods and computer program products.