Abstract: A method for performing a network operation is disclosed. The method includes obtaining an association matrix representing association parameters between first entities and second entities of the network, generating a reduced matrix of the association matrix by aggregating the first entities into a reduced number of representative entities, partitioning a set containing the representative entities and the second entities into intermediate co-clusters based on a reduced-matrix based cohesiveness criterion, generating an expanded intermediate co-cluster from an intermediate co-cluster, partitioning the expanded intermediate co-cluster into final co-clusters based on an association-matrix based cohesiveness criterion, generating a profile of network activities based on the final co-clusters, and performing the network operation based on the profile of the network activities.

Abstract: Embodiments of the invention provide a framework for traffic classification that bridges the gap between the packet content inspection and the flow-based behavioral analysis techniques. In particular, IP packets and/or IP flows are used as an input, network nodes are associated to specific network applications by leveraging information gathered from the web, and packet-level and/or flow-level signatures are extracted in an off-line fashion using clustering and signature extraction algorithms. The signatures learned are systematically exported to a traffic classifier that uses the newly available signatures to classify applications on-the-fly.

Abstract: A system, method, and computer program product for distributed monitoring of local thresholds at each of a number of monitoring nodes and initiating communication only after the locally observed data exceeds the local threshold. Both static thresholds and adaptive thresholds are considered. In the static case, a combination of two alternate strategies for considering thresholds minimizes communication overhead. In the adaptive case, local thresholds are adjusted based on the observed distributions of updated information in the distributed monitoring system. Both approaches yield significant savings over the naïve approach of performing processing at a centralized location.

Abstract: The present invention relates to a method of managing a network. The method steps includes extracting a signature from a first traffic flow of a plurality of traffic flows on the network based on layer-3/layer-4 information of the first traffic flow, storing the signature and an identification of a layer-7 application associated with the signature in a signature repository, identifying a second traffic flow of the plurality of traffic flows being associated with the layer-7 application by correlating the second traffic flow to the signature, and managing the network based on layer-7 application identification of the plurality of traffic flows.

Abstract: A system, method, and computer program product for distributed monitoring of local thresholds at each of a number of monitoring nodes and initiating communication only after the locally observed data exceeds the local threshold. Both static thresholds and adaptive thresholds are considered. In the static case, a combination of two alternate strategies for considering thresholds minimizes communication overhead. In the adaptive case, local thresholds are adjusted based on the observed distributions of updated information in the distributed monitoring system. Both approaches yield significant savings over the naïve approach of performing processing at a centralized location.