Abstract: A network management system manages a virtual network includes an interface system communicatively coupled to one or more servers, a director engine, and a configuration engine. The one or more servers implement a virtual network including one or more virtual machines and one or more containers organized into one or more virtual domains. The interface system generates a graphical user interface displaying graphical representations of the one or more virtual machines and the one or more containers and of the one or more servers; and information associated with the virtual network. The director engine receives a user selection of at least one server, virtual machine, container, or virtual domain, accesses information associated with the user selection, and identifies one or more of servers, virtual machines, containers, and virtual domains associated with the user selection.

Abstract: A method, system, and apparatus configured to use a Bayesian inference model for detecting botnets in a network is disclosed. The system and apparatus may include an event generator and a controller. The event generator may detect at least one event in received data, and provide information associated with the at least one event. The controller may receive the information associated with the at least one event, determine, using a Bayesian learning process, a Bayesian network model based on the information associated with the at least one event, and determine whether at least one host associated with the received data is a bot.

Abstract: The input characteristics of a real-time IDS change continuously with time therefore setting a rigid (time and behavior invariant) classification threshold limits the accuracy that the IDS can potentially achieve. A generic threshold tuning method and system is proposed which can adaptively tune the detection threshold of a real-time IDS in accordance with varying host and network behavior. The method and system perform statistical and information-theoretic analysis of network and host-based IDSs' anomaly based intrusions to reveal a consistent time correlation structure between benign activity periods which is used to predict future anomaly scores and to adapt an IDS' detection threshold accordingly.

Abstract: The input characteristics of a real-time IDS change continuously with time therefore setting a rigid (time and behavior invariant) classification threshold limits the accuracy that the IDS can potentially achieve. A generic threshold tuning method and system is proposed which can adaptively tune the detection threshold of a real-time IDS in accordance with varying host and network behavior. The method and system perform statistical and information-theoretic analyses of network and host-based IDSs' anomaly based intrusions to reveal a consistent time correlation structure between benign activity periods which is used to predict future anomaly scores and to adapt an IDS' detection threshold accordingly.

Abstract: A method is provided for estimating the header of a data packet in a wireless communication system. The method includes: maintaining a list of data packets received without an error at a receiver; receiving at the receiver a corrupt data packet having errors in its header; computing a likelihood score for the header of the corrupt data packet in relation to each entry in the list of data packets; and selecting an entry having the highest likelihood score as an estimated header for the corrupt data packet.

Abstract: A worm propagation modeling system for use with a mobile ad-hoc network (MANET) includes an infection detection module receiving temporal dynamics information relating to temporal dynamics of worm spread in the MANET and spatial dynamics information relating to spatiality of nodes in the MANET. The infection detection module detects infection in a network segment of the MANET based on the temporal dynamics information and the spatial dynamics information.