Abstract: A method and system for profiling a user based upon a user's previous on-line actions is provided. The profile provides a characterization of the user's preferences based upon a received user event. The user event identifying event identification information and a user identifier. A look-up in a cached web map is performed to retrieve classification information associated with the event identification information. A user profile is retrieved or created for the user identifier. Profile update information is generated based upon the retrieved classification information for the user event, to identify how the user is to be updated based upon the retrieved classification information and defined profiling rules. The user profile is updated and stored for access by an external advertising server. The classification information provides a text-score record comprising a text string and a score defined in relation to a lexical ontology comprising a hierarchy of categories.

Abstract: A system and method are provided for delivering targeted content to a subscriber coupled to a service provider network. Network application data generated by the subscriber is received and processed by a network application element deployed in the service provider network associated with a network identifier of the subscriber's computing device. The network application data is generated from user interaction with a server coupled to the service provider network or through a public communication network. The network application data is converted to web events associated with the network identifier. The web events are filtered to remove irrelevant data from received web events. A subscriber profile can then be generated base upon the filtered web events associated with the subscriber. Targeted content can then be delivered to the subscriber based upon the subscriber's profile.

Abstract: An apparatus, system and method are described for use in detecting the presence of malware on subscribers computers. The apparatus, system and method are network based and may be deployed within an Internet Service Provider (ISP) network. The system may include a plurality of network sensors for receiving and analyzing network traffic to determine the presence of malware. An aggregating apparatus receives alerts of the presence of malware and translates a network identifier of the alert to a subscriber identifier. The aggregating apparatus aggregates alert information and forwards it to a reporting infrastructure that can generate notifications in order to notify a subscriber that malware has been detected on a computer associated with the subscriber.

Abstract: A method and apparatus are provided for identifying and tracking multiple computer user sessions associated with a network address translation (NAT) device coupled to a computer network. Data packets originating from the NAT device containing a request to a destination server coupled to the computer network are received. A client source address associated with the data packets is determined where the source address associated with the NAT device. One or more session entries associated with the client source address can then be determined, wherein the session entries are stored in system state information. A session signature can then be determined based one or more characteristics defined by the data packet header information and/or request header information in the one or more data packets, the session signature uniquely identifying one of the multiple computer user sessions coupled to the NAT device.

Abstract: A system and method are provided for delivering targeted content to a subscriber coupled to a service provider network. Network application data generated by the subscriber is received and processed by a network application element deployed in the service provider network associated with a network identifier of the subscriber's computing device. The network application data is generated from user interaction with a server coupled to the service provider network or through a public communication network. The network application data is converted to web events associated with the network identifier. The web events are filtered to remove irrelevant data from received web events. A subscriber profile can then be generated base upon the filtered web events associated with the subscriber. Targeted content can then be delivered to the subscriber based upon the subscriber's profile.

Abstract: A method and apparatus are provided for identifying and tracking multiple computer user sessions associated with a network address translation (NAT) device coupled to a computer network. Data packets originating from the NAT device containing a request to a destination server coupled to the computer network are received. A client source address associated with the data packets is determined where the source address associated with the NAT device. One or more session entries associated with the client source address can then be determined, wherein the session entries are stored in system state information. A session signature can then be determined based one or more characteristics defined by the data packet header information and/or request header information in the one or more data packets, the session signature uniquely identifying one of the multiple computer user sessions coupled to the NAT device.

Abstract: An apparatus, system and method are described for use in detecting the presence of malware on subscribers computers. The apparatus, system and method are network based and may be deployed within an Internet Service Provider (ISP) network. The system may include a plurality of network sensors for receiving and analyzing network traffic to determine the presence of malware. An aggregating apparatus receives alerts of the presence of malware and translates a network identifier of the alert to a subscriber identifier. The aggregating apparatus aggregates alert information and forwards it to a reporting infrastructure that can generate notifications in order to notify a subscriber that malware has been detected on a computer associated with the subscriber.

Abstract: A method and system for profiling a user based upon a user's previous on-line actions is provided. The profile provides a characterization of the user's preferences based upon a received user event. The user event identifying event identification information and a user identifier. A look-up in a cached web map is performed to retrieve classification information associated with the event identification information. A user profile is retrieved or created for the user identifier. Profile update information is generated based upon the retrieved classification information for the user event, to identify how the user is to be updated based upon the retrieved classification information and defined profiling rules. The user profile is updated and stored for access by an external advertising server. The classification information provides a text-score record comprising a text string and a score defined in relation to a lexical ontology comprising a hierarchy of categories.

Abstract: A method of automatically detecting fiber cabling errors in an optical network is described. Fiber connectivity between optical nodes in the network, including initial cabling and any subsequent cabling changes or cabling errors, is detected. The connectivity information including initial link connectivity and changes relating to new fiber connectivity is stored. The invention automatically determines cross-connect and lightpath impact of a cabling change, detects if light paths have been automatically rerouted off affected optical links, and supports operator resolution of cabling problems.

Abstract: The problem solved by this invention is the definition of a well defined approach for creating lightpaths that uses a combination of both operator directed routing and automatic routing and allows the operator to change, at any point during the creation of the lightpath, the wavelength for any segment of the path. The key advantage of this approach is that it allows the operator to customize the lightpath to suit special end-customer needs or special networking requirements. The operator can utilize automatic routing algorithms to provide recommended wavelength selections and routing then, in the same operation, manually reject and select different wavelengths for some or all of the wavelengths in the lightpath.

Abstract: The invention creates a capability within the network management software application to highlight the path through the network for a selected lightpath. The user first selects a lightpath and then turns on the highlighted function. When highlighting is on the user can navigate through the network manager and visualize the lightpath shown by different colours for example dark blue for working and light blue for protection. At the network level, this enable the operator to see the routing of the path.