Abstract: A group-based event analysis service may be implemented by a provider network to monitor service-to-service event streams to identify behavior that is abnormal for a particular group of event streams. Event streams may be classified into groups based on the computing resources or services that generate the events, the behavior patterns of the events in the event stream, and other information about the event streams. Deviations in behavior of individual members of a group relative to group behavior may be used to identify anomalous and/or potentially harmful behavior.

Abstract: A network firewall security apparatus that enables a very high degree of traffic selectability yet avoids the usual performance penalty associated with firewalls. This approach is specific to high-speed circuit switched networks, Asynchronous Transfer Mode (ATM) networks in particular. Security management is achieved through active connection management with authentication, better suited to the cell-based environment of high-speed circuit switched networks and to the mix of circuit switched traffic, where Internet Protocol (IP) datagrams comprise a fraction of the total traffic. The information in the signaling cells is used to determine which flows, rather than which individual cells, are allowed to pass through the firewall. A hierarchical method has been devised, in which the physical location of the interrelated components may be decoupled. Active connection management is applied in determining the approval of a connection based on signaling information and network state information.