Abstract: Systems and methods provide for generating traffic class-specific congestion signatures and other machine learning models for improving network performance. In some embodiments, a network controller can receive historical traffic data captured by a plurality of network devices within a first period of time that the network devices apply one or more traffic shaping policies for a predetermined traffic class and a predetermined congestion state. The controller can generate training data sets including flows of the historical traffic data labeled as corresponding to the predetermined traffic class and predetermined congestion state. The controller can generate, based on the training data sets, traffic class-specific congestion signatures that receive input traffic data determined to correspond to the predetermined traffic class and output an indication whether the input traffic data corresponds to the predetermined congestion state.

Abstract: Techniques for dynamic prioritization of network session are provided. A first packet belonging to a first session is received at a data plane of a network. Upon determining that the first packet is part of a first roam event, a first bloom filter bank is searched to determine a priority associated with the first session, where the priority is based at least in part on a historical latency experienced during the first roam event. A first queue of a plurality of queues is selected based on the determined priority, and the first packet is added to the first queue, where packets in the plurality of queues are transmitted to a control plane of the network based on a respective priority assigned to each of the plurality of queues.

Abstract: Systems, methods, and computer-readable media for radio resource management in a Citizens Broadband Radio Service (CBRS) network include one or more CBRS devices (CBSDs) which can obtain a group type associated with the CBSDs and their associated Radio Environment Map (REM) reports of one or more frequency channels of the CBRS network. The group type and the REM reports may be provided to a Self-Organizing Network (SON) manager of the CBRS network, where the SON manager may determine and provide to the CBSDs, one or more of a channel utilization information, transmission power, or mobility load management information for the CBSD, based on the group type and the REM reports.

Abstract: The present technology pertains to a system that routes application flows. The system can receive an application flow from a device by an active threat detection agent; analyze the application flow for user context, device context, and application context; classify the application flow based on the analysis of the application flow; and direct the application flow according to the classification of the application flow and an application access policy.

Abstract: Systems, methods, and computer-readable media for dynamically assigning devices to specific channels in the CBRS band. One or more dedicated channels within the CBRS band can be selected and a boost channel device group can be formed by exclusively allocating the one or more dedicated channel to the boost channel device group. Further, a normal channel device group can be formed by allocating, to the normal channel device group, one or more channels in the CBRS band that are separate from the one or more dedicated channels allocated to the boost channel device group. One or more devices communicating in the CBRS band can be selectively assigned to either the boost channel device group or the normal channel device group to selectively control communications in the CBRS band over the one or more dedicated channels utilized by the boost channel device group.

Abstract: Techniques for improved wireless ranging are provided. A first communication from a first device is received at a first access point. A predefined minimum distance is determined for the first access point, where the predefined minimum distance corresponds to a distance at which the vertical location of the first access point causes inaccurate location estimations. A first distance of the first device from the first access point is estimated. Upon determining that the first distance of the first device is below the predefined minimum distance, fine timing measurement (FTM) requests from the first device are declined.

Abstract: The present technology is directed to an automated end to end network migration process from on-premise to cloud-based management platforms and visa-versa. The disclosed technology describes an enhanced plug and play (PnP) software agent operationally coupled to a device and capable of interacting with a PnP service hosted on a target management platform to thereby initiate the migration process. The PnP service on the target management platform upon receiving a migration request from the device PnP agent, maps the requesting device onto a client profile existing on the target management platform and identifies therefrom the associated default controller for the device. Subsequently, the device is directed to acquire and boot up on a new software image compatible with the target management platform and following a conversion of its existing configuration into a version compatible with the new software image, the device is migrated to the associated default controller.

Abstract: Systems and methods provide for Selective Tracking of Acknowledgments (STACKing) to improve buffer utilization and traffic shaping for one or more network devices. A network device can identify a first flow that corresponds to a predetermined traffic class and a predetermined congestion state. The device can determine a current window size and congestion threshold of the first flow. In response to a determination to selectively track a portion of acknowledgments of the first flow, the device can track, in main memory, information of a first portion of acknowledgments of the first flow. The device can exclude, from one or more buffers, a second portion of acknowledgments of the first flow. The device can re-generate and transmit segments corresponding to the second portion of acknowledgments at a target transmission rate based on traffic shaping policies for the predetermined traffic class and congestion state.

Abstract: In one example, a wireless Access Point (AP) is configured to provide network connectivity between a User Equipment (UE) and a private wireless network. The wireless AP obtains, from the private wireless network, an indication that the UE is unregistered with the private wireless network. In response to the indication that the UE is unregistered with the private wireless network, the wireless AP provides, to the private wireless network, an indication to initiate an emergency attach procedure with respect to the UE. In response to the indication to initiate the emergency attach procedure, the wireless AP obtains, from the private wireless network, an indication that the UE is authorized to access the private wireless network. In response to the indication that the UE is authorized to access the private wireless network, the wireless AP provides guest access to the private wireless network on behalf of the UE.

Abstract: In one embodiment, an IoT server includes: processing circuitry, an I/O module operative to communicate with at least an IoT device and a vendor network server, and an onboarding application and operative to at least: receive an onboarding request from the IoT device via the I/O module, send a confirmation request to the vendor network server via the I/O module, where the confirmation request indicates a request to confirm an identity of the IoT device according to a connection to a network device authenticated by the vendor network server, receive a confirmation response from the vendor network server via the I/O module, where the confirmation response indicates whether the IoT device is connected to the network device, and if the confirmation response is a positive confirmation response that indicates that the IoT device is connected to the network device, onboard the IoT device for participation in an IoT-based system.

Abstract: Systems and methods provide for Selective Tracking of Acknowledgments (STACKing) to improve buffer utilization and traffic shaping for one or more network devices. A network device can identify a first flow that corresponds to a predetermined traffic class and a predetermined congestion state. The device can determine a current window size and congestion threshold of the first flow. In response to a determination to selectively track a portion of acknowledgments of the first flow, the device can track, in main memory, information of a first portion of acknowledgments of the first flow. The device can exclude, from one or more buffers, a second portion of acknowledgments of the first flow. The device can re-generate and transmit segments corresponding to the second portion of acknowledgments at a target transmission rate based on traffic shaping policies for the predetermined traffic class and congestion state.

Abstract: In one embodiment, a server generates expected levels of capability associated with possible combinations of settings for first and second adjustable parameters for an aspect of a software image feature. The server receives an indication of a desired level of capability for the aspect of the software image feature and, based on the indication, identifies a particular expected level of capability associated with a particular possible combination of the settings for the first and second adjustable parameters. The particular expected level of capability is closer to a desired level of capability for an aspect of a software image feature than the other expected levels of capability associated with the possible combinations of the settings for the first and second adjustable parameters. The server produces a software image that includes the particular possible combination of the settings for the first and second adjustable parameters.

Abstract: Various implementations disclosed herein enable identifying anomalies in a network. For example, in various implementations, a method of identifying anomalies in a network is performed by a network node. In various implementations, the network node includes one or more processors, and a non-transitory memory. In various implementations, the method includes generating a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type. In various implementations, the method includes determining, based on communications associated with the first device, a performance indicator that indicates a performance of the first device. In various implementations, the method includes synthesizing an anomaly indicator as a function of the performance indicator in relation to the characteristic indicator.

Abstract: Various implementations disclosed herein enable controlling access to networks. In various implementations, a method of controlling access to a network is performed by a computing device including one or more processors, and a non-transitory memory. In various implementations, the method includes obtaining an indication that a mobile device having access to a first network utilizing a first radio access technology (RAT) has requested access to a second network utilizing a second RAT. In some implementations, the method includes determining whether the access to the first network satisfies an authentication criterion associated with the second network. In some implementations, the method includes granting the mobile device access to the second network in response to determining that the access to the first network satisfies the authentication criterion associated with the second network.

Abstract: The disclosed technology relates to systems and methods for automatically scaling down network resources, such as servers or gateway instances, based on predetermined thresholds. A system is configured to detect a reduction in one or more network metrics related to a first server, and instruct the first server to issue a rekey request to a plurality of devices connected to the first server. The system is further configured to instruct a load balancer to route to at least one other server responses from the plurality of devices to the rekey request, and determine a number of connections remaining between the first server and the plurality of devices. The system may be further configured to instruct the load balancer to terminate the first server based on the detected number of connections remaining between the first server and the plurality of devices.

Abstract: Techniques for handling requests from a remote device are disclosed. A server receives a first unsolicited activation request from a first device of a plurality of devices. A probabilistic hash filter, associated with a data set, is queried using a first identifier associated with the first device. In response, a first result is received from the probabilistic hash filter indicating that the first device is not ready for activation. In response to receiving the first result, a back-off indication is transmitted to the first device.

Abstract: Systems and methods provide for generating traffic class-specific congestion signatures and other machine learning models for improving network performance. In some embodiments, a network controller can receive historical traffic data captured by a plurality of network devices within a first period of time that the network devices apply one or more traffic shaping policies for a predetermined traffic class and a predetermined congestion state. The controller can generate training data sets including flows of the historical traffic data labeled as corresponding to the predetermined traffic class and predetermined congestion state. The controller can generate, based on the training data sets, traffic class-specific congestion signatures that receive input traffic data determined to correspond to the predetermined traffic class and output an indication whether the input traffic data corresponds to the predetermined congestion state.

Abstract: The disclosed technology relates a system is configured to generate a protected configuration for a network device based on network connectivity data for a plurality of devices in a managed network associated with a cloud management system. The system is further configured to receive a configuration change for the managed network, determine that the configuration change is incompatible with the protected configuration, and generate a notification that the configuration change is incompatible with the protected configuration.

Abstract: A server receives a certificate signing request and onboarding information for an applicant device, and identifies a customer associated with the applicant device based on an applicant device identifier and a database identifiers associated with customers. The device determines a registered device associated with the customer is a trusted device, a location trust value for the applicant device based on a geolocation proximity between the applicant device and the trusted device, and an environment trust value for the applicant device based on a proximity in a network topology between the applicant device and the trusted device. The device further determines a trust score for the applicant device based on the location trust value and the environment trust value, and sends a signed certificate to the applicant device over the network when the trust score for the applicant device exceeds a threshold.

Abstract: In various implementations, a method includes receiving a request to establish an end-to-end encrypted session between a device in an enterprise network and an external entity that is outside the enterprise network. In some implementations, the end-to-end encrypted session allows encrypted packets to be transmitted between the device and the external entity. In various implementations, the method includes determining whether the request satisfies an enterprise security criterion for establishing the end-to-end encryption session. In various implementations, the method includes in response to determining that the request satisfies the enterprise security criterion, triggering the establishment of the end-to-end encrypted session between the device in the enterprise network and the external entity that is outside the enterprise entity.