Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.

Abstract: Systems and methods are provided for collecting data related to changes to a data store table, which may be used for analyzing problems that occur in the network. The information monitored may include types of changes made to a data store/table, such as insertions and deletions of data store elements. When an anomaly occurs in the statistical data store/table data, an alert is issued. This statistical data of the types of changes to a data store may be suggestive of similar changes in a network. For example, the uptime, inactive time, and stable time of rows of a data store table may be used for estimating or inferring the uptime, inactive time, and stable time for nodes, data paths, or other elements of a network. The system may include a web UI or a command line interface, which may aid in diagnosing problems in the network, and taking corrective action.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.

Abstract: One embodiment of the present invention provides a switch. The switch includes a storage device, a processing module, and a database module. The storage device can maintain a database storing configuration information for the switch. During operation, the processing module produces a piece of data associated with operations of the switch based on the configuration information. The database module then stores the piece of data in a database table of the database without caching the piece of data in a memory of the switch after the piece of data is stored in the database. In this way, the database module can reduce the memory occupancy of the processing module in comparison with the storage occupancy of a schema corresponding to the database table. Subsequently, the processing module can program a hardware module of the switch with the piece of data prior to receiving an acknowledgment from the database module.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: Example approaches for authenticating a device are described. In an example, a category, from a plurality of categories, is identified for a device, based on data packets exchanged between the device and a network element. The category is indicative of operational capabilities of the device. Based on the category identified for the device, an authentication order for the device is determined. The authentication order is indicative of a sequence in which a set of authentication tests is to be executed for authentication of the device.

Abstract: One embodiment of the present invention provides a switch. The switch includes a storage device, a processing module, and a database module. The storage device can maintain a database storing configuration information for the switch. During operation, the processing module produces a piece of data associated with operations of the switch based on the configuration information. The database module then stores the piece of data in a database table of the database without caching the piece of data in a memory of the switch after the piece of data is stored in the database. In this way, the database module can reduce the memory occupancy of the processing module in comparison with the storage occupancy of a schema corresponding to the database table. Subsequently, the processing module can program a hardware module of the switch with the piece of data prior to receiving an acknowledgment from the database module.

Abstract: Methods and systems are provided for creating and using custom Type-Length-Value (TLV) elements. For example, a method includes receiving an information from a user, the information including a plurality of commands that together define both a type and a structure of a custom TLV, parsing the received information to create a custom TLV configuration database entry using the received plurality of commands, and writing the TLV configuration database entry into a TLV configuration database accessible by a message parsing device.

Abstract: Example approaches for authenticating a device are described, In an example, a category, from a plurality of categories, is identified for a device, based on data packets exchanged between the device and a network element. The category is indicative of operational capabilities of the device. Based on the category identified for the device, an authentication order for the device is determined. The authentication order is indicative of a sequence in which a set of authentication tests is to be executed for authentication of the device.

Abstract: According to examples, an apparatus for managing alerts pertaining to additions of users to a user group in a computer network may include a processor and a memory, which may have stored thereon machine readable instructions that are to cause the processor to, during a learning period, identify an entity that added a user to the user group during the learning period and enter an identification of the identified entity into an allowed entity list for the user group. Following the learning period, the instructions are to cause the processor to identify a user addition event that indicates that an adding entity added another user to the user group, determine whether the adding entity is in the allowed entity list, and manage issuance of an alert regarding the user addition event based upon whether the adding entity is in the allowed entity list to reduce a number of issued alerts.