Abstract: Apparatus and method for scheduling event streams. The apparatus includes (i) an interface for receiving event streams which are placed in queues and (ii) a scheduler which selects at least one event stream for dispatch depending on sketched content information data of the received event streams. The scheduler includes a sketching engine for sketching the received event streams to determine content information data and a selection engine for selecting at least one received event stream for dispatch depending on the determined content information data of the received event streams. The method includes the steps of (i) determining content information data about the content of event streams and (ii) selecting at least one event stream from the event streams for dispatch depending on the content information data. A computer program, when executed by a computer, causes the computer to perform the steps of the above method.

Abstract: A method for configuring network device adapted to process network traffic comprising a plurality of network flows and to export network flow information. For configuring the network device, a copy of the network traffic that is processed by the network device is created. A simulation of a process of collecting the network flow information using the copy of the network traffic is performed. Based on the results of the simulation, a preferred information collection scheme is determined. The network device is then configured to collect the network flow information to be exported according to the preferred information collection scheme.

Abstract: A method for probabilistic lossy counting includes: for each element in a current window, determining whether an entry corresponding to a current element is present in a table; in the event an entry corresponding to the current element is present in the table, incrementing a frequency counter associated with the current element; otherwise, inserting an entry into a table, wherein inserting an entry comprises: calculating a probabilistic error bound ? based on an index i of the current window; and inserting the probabilistic error bound ? and a frequency counter into an entry corresponding to the current element in the table; and at the end of the current window, removing all elements from the table wherein the sum of the frequency counter and probabilistic error bound ? associated with the element is less than or equal to the index of the current window.

Abstract: Methods and apparatus for gathering information from processors by using compressive sampling are presented. The invention can monitor multicore processor performance and schedule processor tasks to optimize processor performance. Using compressive sampling minimizes processor-memory bus usage by the performance monitoring function. An embodiment of the invention is a method of gathering information from a processor, the method comprising compressive sampling of information from at least one processor core. The compressive sampling produces compressed information. The processor comprises the at least one processor core, and the at least one processor core is operative to process data.

Abstract: Methods, systems and computer program products for detecting flow-level network traffic anomalies via abstraction levels. An exemplary embodiment includes a method for detecting flow-level network traffic anomalies in a computer network, the method including obtaining current distributions of flow level traffic features within the computer network, computing distances of the current distributions' components from a distributions model, comparing the distances of the current distributions to distance baselines from the distributions model, determining if the distances are above a pre-determined thresholds and in response to one or more of the distances being above the pre-determined thresholds in one or more distributions, identifying the current condition to be abnormal and providing indications to its nature.

Abstract: The present invention provides a system and method for time-series with compression accuracy as a function of time. Briefly described, in architecture, one embodiment of the system, among others, can be implemented as follows. The system includes a computer with a processor. The system performs a method receiving a data set on the computer, utilizing a plurality of filter banks to transform the data set into a plurality coefficients, wherein each coefficient is associated with a basis function, and quantizing the plurality of coefficients, wherein the quantization maps the plurality of coefficients into certain value ranges. Then, system further performs determining a threshold based upon each coefficient effect on a time domain, disregarding the coefficient that fall below the threshold, and storing any remaining coefficients as compressed data for the data set.

Abstract: A system and method is provided for updating a hash tree in a protected environment. An integrity protection controller is provided for observing one or more system parameters of a storage system and one or more hash tree parameters of the hash trees, and for updating a hash tree in dependence on the storage system parameter and the hash tree parameter.

Abstract: The invention provides methods, apparatus and systems for detecting distributed denial of service (DDoS) attacks within the Internet by sampling packets at a point or points in Internet backbone connections to determine a packet metric parameter. The packet metric parameter which might comprise the volume of packets received is analysed over selected time intervals with respect to specified geographical locations in which the hosts transmitting the packets are located. The expected behaviour can be employed to identify traffic distortions revealing a DDoS attack. In a complementary aspect, the invention provides a method of authenticating packets at routers in order to elevate the QoS of authenticated packets. This method can be used to block or filter packets and can be used in conjunction with the DDoS attack detection system to defend against DDoS attacks within the Internet in a distributed manner.

Abstract: Techniques for encryption and authentication of data. One or more plaintext data blocks ciphertext data blocks and corresponding authentication tags are generated by means of authenticated encryption. A tag tree is generated by means of the authentication tags. The ciphertext data blocks and the tag tree data of the tag tree are stored in an untrusted storage, and the root tag of the tag tree is stored in a trusted storage.

Abstract: A protective ring apparatus includes a back plate and a riser wall which projects outward from the back plate. The riser wall is located peripheral to a back plate central access channel. A front frame is connected to a top portion of the riser wall, and the front frame defines a front frame access channel which is in registration with the back plate central access channel. A pair of twist links, located along a common link axis, are connected to opposite sides of the front frame. A removable protector plate is connected to the pair of twist links and, prior to its removal, covers and prevents wires in an open electrical box from being cut by a cutting tool used to cut a window in a sheet of drywall to be installed around an electrical box framed by the plaster ring apparatus.

Abstract: A protective ring apparatus includes a back plate and a riser wall which projects outward from the back plate. The riser wall is located peripheral to a back plate central access channel. A front frame is connected to a top portion of the riser wall, and the front frame defines a front frame access channel which is in registration with the back plate central access channel. A pair of twist links, located along a common link axis, are connected to opposite sides of the front frame. A removable protector plate is connected to the pair of twist links and, prior to its removal, covers and prevents wires in an open electrical box from being cut by a cutting tool used to cut a window in a sheet of drywall to be installed around an electrical box framed by the plaster ring apparatus.