Abstract: An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.

Abstract: An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.

Abstract: Processing an ingress packet in a packet pipeline to determine a forwarding rule includes identifying a matching rule in each forwarding table in the pipeline. Prefix lengths of the respective matching rules are compared. The matching rule with the greatest prefix length serves as the basis for forwarding an egress packet.

Abstract: Processing an ingress packet in a packet pipeline to determine a forwarding rule includes identifying a matching rule in each forwarding table in the pipeline. Prefix lengths of the respective matching rules are compared. The matching rule with the greatest prefix length serves as the basis for forwarding an egress packet.

Abstract: Techniques for implementing history-based connection-server affinity on a network load balancer are provided. In one set of embodiments, the network load balancer can receive a network packet destined for a service, where the service is associated with a plurality of servers, and where the packet is part of a network connection between a client device and one of the plurality of servers. The network load balancer can further compute, using a portion of the packet, a bucket identifier of a bucket for the network connection, identify a first server in the plurality of servers that is currently mapped to the bucket identifier in a hash table, and send the packet to the first server. If the network load balancer receives the packet back from the first server, the network load balancer can determine, based on local history information, a second server that was previously mapped to the bucket identifier in the hash table and send the packet to that second server.

Abstract: Techniques for implementing resilient hashing with multiple hashes are provided. In one set of embodiments, a network device can maintain a first hash table comprising mappings between a first set of hash indices and a set of bit values. The network device can also maintain a second hash table comprising mappings between a second set of hash indices and active next-hop destinations. Upon receiving a network packet, the network device can compute a first hash and can match the first hash value to a first mapping in the first hash table based on the first mapping's hash index. When the first mapping's bit value indicates that the first mapping's hash index corresponds to an active next-hop destination, the network device can further match the first hash value to a second mapping in the second hash table and send the network packet to the second mapping's active next-hop destination.

Abstract: Certain embodiments disclosed herein relate to method for egress maximum transmission unit (MTU) enforcement. The method may include receiving a protocol packet at an ingress interface of a network device; make a first determination of a protocol packet payload length; performing an ingress MTU identifier lookup in an ingress MTU identifier table using the protocol packet payload length to obtain an ingress MTU identifier; performing a packet propagation lookup to obtain an egress MTU identifier; performing an MTU enforcement lookup in an MTU enforcement table using the ingress MTU identifier and the egress MTU identifier to obtain an egress action; and performing the egress action.

Abstract: Certain embodiments disclosed herein relate to method for egress maximum transmission unit (MTU) enforcement. The method may include receiving a protocol packet at an ingress interface of a network device; make a first determination of a protocol packet payload length; performing an ingress MTU identifier lookup in an ingress MTU identifier table using the protocol packet payload length to obtain an ingress MTU identifier; performing a packet propagation lookup to obtain an egress MTU identifier; performing an MTU enforcement lookup in an MTU enforcement table using the ingress MTU identifier and the egress MTU identifier to obtain an egress action; and performing the egress action.

Abstract: The goal of detecting modifications, such as unauthorized modifications for example, of the code and/or behavior of an embedded device (e.g., unexpected/unauthorized remote reprogramming, re-flashing), changes to code at run-time (e.g.

Abstract: Techniques for implementing history-based connection-server affinity on a network load balancer are provided. In one set of embodiments, the network load balancer can receive a network packet destined for a service, where the service is associated with a plurality of servers, and where the packet is part of a network connection between a client device and one of the plurality of servers. The network load balancer can further compute, using a portion of the packet, a bucket identifier of a bucket for the network connection, identify a first server in the plurality of servers that is currently mapped to the bucket identifier in a hash table, and send the packet to the first server. If the network load balancer receives the packet back from the first server, the network load balancer can determine, based on local history information, a second server that was previously mapped to the bucket identifier in the hash table and send the packet to that second server.

Abstract: Techniques for implementing resilient hashing with multiple hashes are provided. In one set of embodiments, a network device can maintain a first hash table comprising mappings between a first set of hash indices and a set of bit values. The network device can also maintain a second hash table comprising mappings between a second set of hash indices and active next-hop destinations. Upon receiving a network packet, the network device can compute a first hash and can match the first hash value to a first mapping in the first hash table based on the first mapping's hash index. When the first mapping's bit value indicates that the first mapping's hash index corresponds to an active next-hop destination, the network device can further match the first hash value to a second mapping in the second hash table and send the network packet to the second mapping's active next-hop destination.

Abstract: An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of digital connections, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved by using data elements of Internet Protocol datagrams that are exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status, when a DOWN status is suspected, other functions in the ACSD initiate transmission of a set of PROBE packets that can determine if the suspect link is actually DOWN or merely giving a response that would be interpreted as DOWN by prior art methods.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of the availability of digital connections (links) between computer sites, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved over prior art methods by using data elements of Internet Protocol datagrams, e.g. record fields or bits of fields, that are regularly and normally exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of digital connections, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved by using data elements of Internet Protocol datagrams that are exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status. when a DOWN status is suspected, other functions in the ACSD initiate transmission of a set of PROBE packets that can determine if the suspect link is actually DOWN or merely giving a response that would be interpreted as DOWN by prior art methods.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of the availability of digital connections (links) between computer sites, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved over prior art methods by using data elements of Internet Protocol datagrams, e.g. record fields or bits of fields, that are regularly and normally exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status.

Abstract: The goal of detecting modifications, such as unauthorized modifications for example, of the code and/or behavior of an embedded device (e.g., unexpected/unauthorized remote reprogramming, re-flashing), changes to code at run-time (e.g.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of the availability of digital connections (links) between computer sites, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved over prior art methods by using data elements of Internet Protocol datagrams, e.g. record fields or bits of fields, that are regularly and normally exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of the availability of digital connections (links) between computer sites, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved over prior art methods by using data elements of Internet Protocol datagrams, e.g. record fields or bits of fields, that are regularly and normally exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status.

Abstract: A Multi-Homing System is equipped with an Adaptive JSP Access Cloud State Detection apparatus (ACSD) that improves the reliability of the availability of digital connections (links) between computer sites, such as a Computer Premises Network and the Internet, in which such connections are made by connecting through a multiplicity of ISP Access Clouds (links). Reliability is improved over prior art methods by using data elements of Internet Protocol datagrams, e.g. record fields or bits of fields, that are regularly and normally exchanged between the ISP Access Clouds and the CPN without creating additional data traffic. Data Elements from each ISP Access Cloud are used by processing functions of the by the ACSD to test for conditions that indicate that it may be in a DOWN status.