Abstract: A method of determining correlated flows in a network may include obtaining times of arrival and corresponding flows for data units in the network (1020) and assigning weights to a set of data units based on respective times between the set of data units and one data unit (1030). A probability matrix representing interflow connections in the network may be updated based on the assigned weights (1040).

Abstract: A system constructs an OSPF-compatible virtual model of a multi-hop, multi-access packet radio network that includes a plurality of routers (120) and which includes its own private, internal routing system (150), in order to facilitate the incorporation of that packet radio network into an overall OSPF routing environment. The system determines a network graph identifying actual connectivity among the plurality of routers (120). The system constructs a virtual model (300) of the, wherein connectivity of the virtual model may be different than the actual connectivity of the network graph. The system represents the multi-hop, multi-access radio network in the virtual model as a set of multi-access links (305, 310), point-to-point links, AS-external routes, and area summary routes. The system employs the virtual model for routing purposes and advertises the virtual model to other OSPF routers for the same purpose.

Abstract: The invention relates to a transport protocol and associated methods and stack architectures for improving the energy efficiency of transmitting packets through an ad hoc network. The protocol controls transmissions by taking into account per-packet energy limits, per-node loss tolerances, and/or minimum availability rates determined based on path quality measurements collected by packets traversing the network and application reliability requirements associated with various applications.

Abstract: A method and system is provided for detecting correlated connections in an extended connection. A plurality of stepping stone detection algorithms are executed in parallel (400), each of the plurality of stepping stone detection algorithms generating a result. The results are scored for each of the plurality of stepping stone detection algorithms (402). A consensus attack path is generated based upon the scored results (404).

Abstract: A system and method for determining the point of entry of a malicious packet into a network is disclosed. An intrusion detection system detects entry of the malicious packet into the network (500). A stepping stone detection system identifies stepping stones in extended connections within the network (524). A traceback engine isolates the malicious packet in response to operation of the intrusion detection system (528), wherein the traceback engine utilizes the identified stepping stones to determine the point of entry of the malicious packet.

Abstract: A communication system has stations arranged in clusters of member stations, each of which communicates with the other member stations. One member station is a head station of the cluster that communicates with head stations of other clusters. The stations are configured by determining the communication state between a station and one or more cluster head stations. The station is assigned to at least one cluster when a prescribed communication state has been determined between the station and the cluster head station. The station is set to be in independent communication with the one or more cluster head stations which have the prescribed communication state with the station.