Abstract: Systems, methods, and computer-readable media are provided for de-duplicating sensed data packets in a network. As data packets of a particular network flow move through the network, the data packets can be sensed and reported by various sensors across the network. An optimal sensor of the network can be determined based upon data packets reported by the various sensors. Data packets sensed and reported by the optimal sensor can be preserved for network analysis. Duplicative data packets of the particular network flow sensed and reported by other sensors of the network can be discarded to save storage capacity and processing power of network-flow analysis tools. Analysis of the particular network flow can be performed based upon the data packets sensed by the optimal sensor and non-duplicative data packets of the particular network-flow sensed by other sensors of the network.

Abstract: A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. A method includes determining a lineage for a process within the network and then evaluating, through knowledge of the lineage, the source of the command that initiated the process. The method includes capturing data from a plurality of capture agents at different layers of a network, each capture agent of the plurality of capture agents configured to observe network activity at a particular location in the network, developing, based on the data, a lineage for a process associated with the network activity and, based on the lineage, identifying an anomaly within the network.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract: Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Abstract: Managing a network environment to identify spoofed packets is disclosed. A method includes analyzing, via a first capture agent, packets processed by a first environment in a network associated with a first host, and analyzing, via a second capture agent, packets processed by a second environment in the network associated with a second host. The method includes collecting the first data and the second data at a collector and generating a topological map of the network and a history of network activity associated with the first environment and the second environment. The method includes extracting network data from a packet and comparing the extracted network data with stored network data in the database. When the comparison indicates that the extracted network data does not match the stored network data (i.e., the reported source does not match an expected source for the packet), determining that the packet is a spoofed packet.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Abstract: Systems and methods of developing and/or implementing multimedia applications. The system provides an extensible framework including an application layer, a framework utility layer, and a core engine layer. The framework utility layer includes an application programming interface, a video codec sub-framework (XCF), a video packetization sub-framework (XPF), and a video/text overlay sub-framework (XOF). The core engine layer includes one or more core codec engines and one or more core rendering engines. The XCF, XPF, and XOF sub-frameworks are effectively decoupled from the multimedia applications executing on the application layer, and the core codec and rendering engines of the core engine layer, allowing the XCF, XPF, and XOF sub-frameworks and core codec/rendering engines to be independently extensible. The system also fosters enhanced reuse of existing multimedia applications across a plurality of multimedia systems.

Abstract: Systems and methods of adjusting synchronization of audio media streams and video media streams in 3G mobile communications systems that can mitigate the effects of temporal skew due to intervening processing elements associated with media channels carrying the respective media streams. The systems and methods are operative to adjust the synchronization of audio media streams and video media streams by receiving control messages that report delays due to such intervening processing elements, calculating a relative amount of delay using the reported delays for each media channel, and applying a delay factor based on the relative amount of delay to the faster media channel to place the audio media streams and the video media streams in proper temporal alignment. The delay factor is applied to the faster media channel at those locations within the mobile communications systems where the audio and video media streams are combined and/or separated for subsequent transmission.

Abstract: Systems and methods of adjusting synchronization of audio media streams and video media streams in 3G mobile communications systems that can mitigate the effects of temporal skew due to intervening processing elements associated with media channels carrying the respective media streams. The systems and methods are operative to adjust the synchronization of audio media streams and video media streams by receiving control messages that report delays due to such intervening processing elements, calculating a relative amount of delay using the reported delays for each media channel, and applying a delay factor based on the relative amount of delay to the faster media channel to place the audio media streams and the video media streams in proper temporal alignment. The delay factor is applied to the faster media channel at those locations within the mobile communications systems where the audio and video media streams are combined and/or separated for subsequent transmission.

Abstract: Systems and methods of developing and/or implementing multimedia applications. The system provides an extensible framework including an application layer, a framework utility layer, and a core engine layer. The framework utility layer includes an application programming interface, a video codec sub-framework (XCF), a video packetization sub-framework (XPF), and a video/text overlay sub-framework (XOF). The core engine layer includes one or more core codec engines and one or more core rendering engines. The XCF, XPF, and XOF sub-frameworks are effectively decoupled from the multimedia applications executing on the application layer, and the core codec and rendering engines of the core engine layer, allowing the XCF, XPF, and XOF sub-frameworks and core codec/rendering engines to be independently extensible. The system also fosters enhanced reuse of existing multimedia applications across a plurality of multimedia systems.

Abstract: Systems and methods of developing and/or implementing multimedia applications. The system provides an extensible framework including an application layer, a framework utility layer, and a core engine layer. The framework utility layer includes an application programming interface, a video codec sub-framework (XCF), a video packetization sub-framework (XPF), and a video/text overlay sub-framework (XOF). The core engine layer includes one or more core codec engines and one or more core rendering engines. The XCF, XPF, and XOF sub-frameworks are effectively decoupled from the multimedia applications executing on the application layer, and the core codec and rendering engines of the core engine layer, allowing the XCF, XPF, and XOF sub-frameworks and core codec/rendering engines to be independently extensible. The system also fosters enhanced reuse of existing multimedia applications across a plurality of multimedia systems.

Abstract: Methods and apparatus are disclosed for synchronizing a local clock in a Voice over Packet Network. In an example method, a data packet is transmitted from a transmitting device with an associated transmission frame rate determined by a remote clock signal, and is received at a receiving device. The receiving device stores the received data packet in a jitter buffer and generates a local clock signal. The data packet is retrieved from the buffer at an associated retrieval frame rate determined by the local clock signal, and an error indicative of the difference between the transmission frame rate and the retrieval frame rate is generated. The retrieval frame rate is then adjusted in accordance with the determined error.

Abstract: A method and system for performing a route lookup in a routing system, including a plurality of routes places a bound on the number of accesses to the memory necessary to perform a route lookup and guarantees the minimal amount of memory to achieve a particular bound. For each node the memory required to meet a bound on the depth of the tree rooted at that node is computed, given the distribution of routes in the network.