Abstract: Leaf nodes of a tree structure, also having a root node and intermediate nodes, communicate with endpoints via access networks and store mappings from permanent virtual IP (VIP) addresses for the endpoints to physical IP (PIP) addresses for the endpoints on the access networks. The root node and intermediate nodes store pointers for the endpoints' leaf nodes and associated access networks. When a connection setup request (CSR) for a destination endpoint is received from a corresponding node, the receiving leaf node passes the CSR up through the tree structure to a lowest common ancestor (LCA) node for the receiving leaf node and one or more destination leaf nodes associated with the destination endpoint. The LCA node uses its pointers to pass the CSR down towards the one or more destination leaf nodes, which use the corresponding VIP-to-PIP mappings to forward the CSR to the destination endpoint.

Abstract: System, method, and software for detecting anomalies in data generated by microservices. In one embodiment, an anomaly detector collects performance metrics for a microservice deployed in a data center for an application. The anomaly detector transforms the performance metrics into a time-series structured dataset for the microservice, and feeds the structured dataset to a machine learning system to determine whether an anomaly exists in the structured dataset based on an anomaly detection model. The anomaly detector performs an anomaly classification with the machine learning system based on an anomaly classification model and the structured dataset when an anomaly is detected in the structured dataset, and performs an action based on the anomaly classification.

Abstract: Packet-processing circuitry including one or more flow caches whose contents are managed using a cache-entry replacement policy that is implemented based on one or more updatable counters maintained for each of the cache entries. In an example embodiment, the implemented policy enables the flow cache to effectively catch and keep elephant flows by giving to the caught elephant flows appropriate preference in terms of the cache dwell time, which can beneficially improve the overall cache-hit ratio and/or packet-processing throughput. Some embodiments can be used to implement an Open Virtual Switch (OVS). Some embodiments are advantageously capable of implementing the cache-entry replacement policy with very limited additional memory allocation.

Abstract: Network-based, unsupervised classifiers are provided. The classifiers identify both known and unknown attacks aimed at industrial networks without the need to have a priori knowledge of known malicious attack patterns.

Abstract: An apparatus may implement an ad hoc service switch to establish an ad hoc link between ad hoc devices, such that the apparatus is a transparent node in an ad hoc link between the ad hoc devices. The apparatus may implement rule-based control of at least one ad hoc device, based on processing a data packet received from an ad hoc device via the ad hoc link. Rule-based control may include performing at least one operation of selectively forwarding the data packet, selectively inhibiting the data packet from being forwarded, modifying the data packet, and generating and transmitting a new data packet. The apparatus may establish the ad hoc link via an initial ad hoc link between the apparatus and the first device, a network communication link between the apparatus and an external apparatus, and an ad hoc link between the external apparatus and the second device.

Abstract: Packet-processing circuitry including one or more flow caches whose contents are managed using a cache-entry replacement policy that is implemented based on one or more updatable counters maintained for each of the cache entries. In an example embodiment, the implemented policy enables the flow cache to effectively catch and keep elephant flows by giving to the caught elephant flows appropriate preference in terms of the cache dwell time, which can beneficially improve the overall cache-hit ratio and/or packet-processing throughput. Some embodiments can be used to implement an Open Virtual Switch (OVS). Some embodiments are advantageously capable of implementing the cache-entry replacement policy with very limited additional memory allocation.

Abstract: A method for controlling packet routing in a network includes identifying segment identifications (IDs) for a number of switches and arranging a first number of the segment IDs into a multi-protocol label switching (MPLS) label field. The method further includes identifying an output port of a respective one of the number of switches located along a network path between source and destination nodes. The switches may route the packet based on corresponding ones of the segment IDs in the MPLS label field. In performing this routing operation, each switch may modify the MPLS label field with remaining ones of the segment IDs that have been shifted in position and padded with zeros, after the segment ID corresponding to the switch has been popped from the MPLS label field. The method therefore presents a technique for performing segment routing through network equipment designed to support MPLS routing.

Abstract: An apparatus may implement an ad hoc service switch to establish an ad hoc link between ad hoc devices, such that the apparatus is a transparent node in an ad hoc link between the ad hoc devices. The apparatus may implement rule-based control of at least one ad hoc device, based on processing a data packet received from an ad hoc device via the ad hoc link. Rule-based control may include performing at least one operation of selectively forwarding the data packet, selectively inhibiting the data packet from being forwarded, modifying the data packet, and generating and transmitting a new data packet. The apparatus may establish the ad hoc link via an initial ad hoc link between the apparatus and the first device, a network communication link between the apparatus and an external apparatus, and an ad hoc link between the external apparatus and the second device.

Abstract: Network-based, unsupervised classifiers are provided. The classifiers identify both known and unknown attacks aimed at industrial networks without the need to have a priori knowledge of known malicious attack patterns.

Abstract: A method for controlling packet routing in a network includes identifying segment identifications (IDs) for a number of switches and arranging a first number of the segment IDs into a multi-protocol label switching (MPLS) label field. The method further includes identifying an output port of a respective one of the number of switches located along a network path between source and destination nodes. The switches may route the packet based on corresponding ones of the segment IDs in the MPLS label field. In performing this routing operation, each switch may modify the MPLS label field with remaining ones of the segment IDs that have been shifted in position and padded with zeros, after the segment ID corresponding to the switch has been popped from the MPLS label field. The method therefore presents a technique for performing segment routing through network equipment designed to support MPLS routing.

Abstract: System, method, and software for detecting anomalies in data generated by microservices. In one embodiment, an anomaly detector collects performance metrics for a microservice deployed in a data center for an application. The anomaly detector transforms the performance metrics into a time-series structured dataset for the microservice, and feeds the structured dataset to a machine learning system to determine whether an anomaly exists in the structured dataset based on an anomaly detection model. The anomaly detector performs an anomaly classification with the machine learning system based on an anomaly classification model and the structured dataset when an anomaly is detected in the structured dataset, and performs an action based on the anomaly classification.

Abstract: System, method, and software for managing packet forwarding by end devices that use Zigbee protocol. In one embodiment, a P4 switch is implemented at an edge of an IP network as an intermediary between the end devices that use Zigbee protocol so that packets forwarded by each of the end devices flow through the switch. The switch includes a transceiver configured to receive a packet forwarded by a first endpoint in an end device and destined for a second endpoint. The switch includes a P4 parser configured to parse the packet to identify fields of the packet, and a P4 analyzer configured to process a plurality of match-action tables and the fields of the packet to provide data plane handling of the packet.

Abstract: System, method, and software for managing packet forwarding by end devices that use Zigbee protocol. In one embodiment, a P4 switch is implemented at an edge of an IP network as an intermediary between the end devices that use Zigbee protocol so that packets forwarded by each of the end devices flow through the switch. The switch includes a transceiver configured to receive a packet forwarded by a first endpoint in an end device and destined for a second endpoint. The switch includes a P4 parser configured to parse the packet to identify fields of the packet, and a P4 analyzer configured to process a plurality of match-action tables and the fields of the packet to provide data plane handling of the packet.

Abstract: In a data processing system, a received data stream comprises a plurality of tuples having respective key values. The received data stream is separated into portions that are delivered to respective ones of a first set of servers in a manner that permits different tuples having the same key value to be processed by different servers of the first set. For each distinct key value, each of at least a subset of the servers of the first set maintains a corresponding partial key result based on one or more of the tuples having that key value that are received by that server. The partial key results are periodically delivered from the servers of the first set to servers of a second set of servers in a manner that ensures that different partial key results having the same key value are processed by the same server of the second set.

Abstract: A method of determining a maximum flow on a network path using segment routing, the method including establishing a segment graph, establishing underlying dual weights on the segment graph, computing the dual weights from the segment graph, finding a minimum dual weight path not having more than a predetermined number of hops, augmenting a flow on the dual weight path, and updating the dual weights on the underlying segment graph.

Abstract: Various embodiments relate to a non-transitory computer readable medium and method thereof for finding a minimum hop path in a segment graph traversing the least number of links in a physical topology, the method including receiving a connection request for a connection between a source node and a destination node, computing the segment graph, the segment graph having a plurality of links, computing a bandwidth for each of the plurality of links in the segment graph, computing the number of links for a shortest path (“N(q)”) for each of the plurality of links, eliminating each of the plurality of link with a bandwidth less than the minimum bandwidth and selecting the shortest path in the physical topology between the plurality of links.

Abstract: Various embodiments relate to a method and apparatus for computing a minimum segment labeling of a given path on a segment cover graph, the method including receiving a connection request for a connection between a source node and a destination node, generating a Shortest Path Directed Acyclic Graph (“SPDAG”) from the source node to the destination node by running a shortest path algorithm from the source node, determining an end node, between the source node and the destination node, at which the SPDAG deviates from the given path, determining whether the end node is the end of an Equal Cost Multipath (“ECMP”) and terminating the shortest path algorithm at a predecessor node to the end node if the end node is the end of an ECMP and making the predecessor node to the end node the source node.

Abstract: A method of determining a maximum flow network path between a source node and a destination node using segment routing when constrained by a maximum number of hops, the method including establishing a segment graph, calculating the bandwidth capacity of each link in the segment graph, calculating the multiplicity for each link in the segment graph, initializing a predecessor array indicating the predecessor node for each node and hop value, for each link in the segment graph and for each hop value up to the maximum number of hops: determining the maximum bandwidth path to the end of each segment and the associated number of hops based upon the bandwidth capacity, and updating a value of the predecessor array when the maximum bandwidth path to the end of segment is determined, and determining the maximum flow network path based upon the predecessor array.

Abstract: A method of determining a maximum flow on a network path using segment routing, the method including establishing a segment graph, establishing underlying dual weights on the segment graph, computing the dual weights from the segment graph, finding a minimum dual weight path not having more than a predetermined number of hops, augmenting a flow on the dual weight path, and updating the dual weights on the underlying segment graph.

Abstract: Various embodiments relate to a non-transitory computer readable medium and method thereof for finding a minimum hop path in a segment graph traversing the least number of links in a physical topology, the method including receiving a connection request for a connection between a source node and a destination node, computing the segment graph, the segment graph having a plurality of links, computing a bandwidth for each of the plurality of links in the segment graph, computing the number of links for a shortest path (“N(q)”) for each of the plurality of links, eliminating each of the plurality of link with a bandwidth less than the minimum bandwidth and selecting the shortest path in the physical topology between the plurality of links.