Abstract: A distributed security system includes instances of a compute engine that can receive an event stream comprising event data associated with an occurrence of one or more events on one or more client computing devices and generate new event data based on the event data in the event stream. A predictions engine coupled in communication with the compute engine(s) receives the new event data and applies at least a portion of the received new event data to one or more machine learning models of the distributed security system based to the received new event data. The one or more machine learning models generate a prediction result that indicates whether the occurrence of the one or more events from which the new event data was generated represents one or more target behaviors, based on the applying of at least the portion of the received new event data to the one or more machine learning models according to the received new event data.

Abstract: A security agent implemented on a monitored computing device is described herein. The security agent has access to parametric behavioral pattern definitions that, in combination with canonical patterns of behavior, configure the security agent to match observed behavior with known computing behavior that is benign or malignant. This arrangement of the definitions and the pattern of behavior allow the security agent's behavior to be updated by a remote security service without updating a configuration of the security agent. The remote security service can create, modify, and disseminate these definitions and patterns of behavior, giving the security agent real-time ability to respond to new behaviors exhibited by the monitored computing device.

Abstract: A security agent implemented on a monitored computing device is described herein. The security agent has access to parametric behavioral pattern definitions that, in combination with canonical patterns of behavior, configure the security agent to match observed behavior with known computing behavior that is benign or malignant. This arrangement of the definitions and the pattern of behavior allow the security agent's behavior to be updated by a remote security service without updating a configuration of the security agent. The remote security service can create, modify, and disseminate these definitions and patterns of behavior, giving the security agent real-time ability to respond to new behaviors exhibited by the monitored computing device.

Abstract: In one example, a visualization data engine may be responsible for rendering the visualization data obtained from the backend data server and providing the user interface (UI) necessary to allow an administrator to analyze the data. An example UI may include the ability to filter, organize, reorganize, and choose the raw data to be transformed. The UI may also provide interactions that expand and compress sections of the dataset, drill into the underlying dataset that is represented to the user, and move the data from one visualization to another.

Abstract: In one example, a visualization data engine may be responsible for rendering the visualization data obtained from the backend data server and providing the user interface (UI) necessary to allow an administrator to analyze the data. An example UI may include the ability to filter, organize, reorganize, and choose the raw data to be transformed. The UI may also provide interactions that expand and compress sections of the dataset, drill into the underlying dataset that is represented to the user, and move the data from one visualization to another.

Abstract: A method of automatically detecting fiber cabling errors in an optical network is described. Fiber connectivity between optical nodes in the network, including initial cabling and any subsequent cabling changes or cabling errors, is detected. The connectivity information including initial link connectivity and changes relating to new fiber connectivity is stored. The invention automatically determines cross-connect and lightpath impact of a cabling change, detects if light paths have been automatically rerouted off affected optical links, and supports operator resolution of cabling problems.

Abstract: A method of modifying the routing of lightpaths without interrupting service, scheduling long maintenance windows or the need to delete and recreate lightpath definitions is disclosed. The solution utilizes a combination of non-disruptive bridge and roll techniques and uses temporary end to end protection or segment protection to change the routing of the working or protection part of the lightpath without having to take the lightpath out of service. The solution relies on lambda level switching hardware support and software at the two endpoint nodes to coordinate in the event of an operator-initiated protection switch, the switching of connections from the working path to the protected path. Protection switching can be configured to be end to end, single segment only or multi hop protection depending on the application.

Abstract: The invention creates a capability within the network management software application to highlight the path through the network for a selected lightpath. The user first selects a lightpath and then turns on the highlighted function. When highlighting is on the user can navigate through the network manager and visualize the lightpath shown by different colours for example dark blue for working and light blue for protection. At the network level, this enable the operator to see the routing of the path.

Abstract: The problem solved by this invention is the definition of a well defined approach for creating lightpaths that uses a combination of both operator directed routing and automatic routing and allows the operator to change, at any point during the creation of the lightpath, the wavelength for any segment of the path. The key advantage of this approach is that it allows the operator to customize the lightpath to suit special end-customer needs or special networking requirements. The operator can utilize automatic routing algorithms to provide recommended wavelength selections and routing then, in the same operation, manually reject and select different wavelengths for some or all of the wavelengths in the lightpath.

Abstract: This invention proposes a method for enabling segment protection, whereby one or more hops in the lightpath are protected by either a dedicated or shared wavelength. This provides a more cost effective solution for the service provider such that they only need to configure protection, and therefore deploy equipment, to those sensitive portions of the network rather than dedicating wavelengths and equipment for protection end-to-end for a lightpath. Further, allowing protecting wavelengths to be shared for protection, gives further flexibility and therefore, savings, to the service provider. To utilize lightpath segment protection and sharing the protection between multiple lightpaths requires the new mesh networking capabilities of the network elements and new network management tools to configure, and monitor these protected lightpaths.

Abstract: A multiple endpoint path for providing endpoint redundancy is described. Selected active end nodes in a digital communications network are configured by a network management system to have compatible alternate endpoint paths. When one of the selected active endpoint paths fails, the network management system automatically switches the endpath from the previously active endpoint to the alternate end point path.