Abstract: A method, computer system, and a computer program product is provided for establishing a dynamically adaptive network firewall. A firewall model is established that identifies resources that can be used and a plurality of nodes that connect to one another to form a network. A set of external rules and policies are provided to each resource. The firewall implemented using the firewall model upon receiving of incoming data and upon traffic flow. The firewall expands or contracts the network by adding or removing resources according to work that needs to be performed. The work includes both tasks to be completed and efforts that has to be taken by the firewall to ensure security by preventing unauthorized access into the network.

Abstract: Embodiments related to using a foundational model for network packet traces. A technique includes receiving network traffic of a network and extracting features from the network traffic, the features having a function related to communications in the network. The technique includes generating tokens from the features, each of the features corresponding to a respective one of the tokens, training a machine learning model by inputting the tokens, the machine learning model being trained to output contextual embeddings for the tokens, and using the contextual embeddings to determine an anomaly in the network traffic.

Abstract: A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: A computer implemented method performs data skipping in a hierarchically organized computing system. A group of processor units determines leaf node data sketches for data in leaf nodes in the hierarchically organized computing system. The leaf node data sketches summarize attributes of data in the leaf nodes. The group of processor units aggregates the leaf node data sketches at intermediate nodes in the hierarchically organized computing system to form aggregated data sketches at the intermediate nodes and retains data sketches received at the intermediate nodes from a group of child nodes to form retained data sketches. The retained data sketches are one of leaf node data sketches and the aggregated data sketches. The group of processor units searches the data using the retained data sketches and the data skipping within the hierarchically organized computing system in response to queries made to the intermediate nodes in the hierarchically organized computing system.

Abstract: Systems and methods are provided for monitoring events impacting service in a network communications system. One embodiment includes monitoring an event data structure for one or more events. The events are based on faulty network components in the communications system. One or more tickets based on the events are created. The tickets may be used to address the events. Further, creating one or more lists of network components impacted by the events, and, based on the lists of impacted network components, correlating the tickets one to another. Finally, based on the correlation, updating the events in the event data structure.

Abstract: System and methods are provided for creating a topology of a communications network. One embodiment includes receiving a first instance of topology information at one or more integration sources and determining if the first instance of topology information includes a portion of topology information on a span of the communications network by the one or more integration sources. If the first instance of topology information only includes the portion of topology information, then receiving, at the one or more integration sources a second instance of topology information, and supplementing the first instance with the second instance of topology information to form complete topology information of the span of the communications network by the one or more integration sources and transferring the complete topology information to a topology data structure.

Abstract: Systems and methods are provided for determining if an alarm originating from a component within a communications network impacts service of said network. One embodiment includes scanning a first data structure for faulty network components which may potentially affect network service, determining network components that are supported by the faulty network component, calculating a percentage of the network components indicating a fault, and determining if the percentage of the network components is above a threshold. If the percentage is above the threshold the faulty network component is determined to be service impacting. Finally, communicating to a second data structure that the faulty network component impacts service of the communications network.

Abstract: System and methods are provided for automated alarm handling in a communications network by linking network failures to impacted resources. One embodiment includes correlating one or more network failures to a common network resource in a communications network, associating each network component of the communications network one to another, where the network components include one common network resource, attributing fault data originating from one or more of the network components to an associated common network resource, and collecting in a central data structure the attributed fault data with the associated common network resource.