Abstract: Leaf nodes of a tree structure, also having a root node and intermediate nodes, communicate with endpoints via access networks and store mappings from permanent virtual IP (VIP) addresses for the endpoints to physical IP (PIP) addresses for the endpoints on the access networks. The root node and intermediate nodes store pointers for the endpoints' leaf nodes and associated access networks. When a connection setup request (CSR) for a destination endpoint is received from a corresponding node, the receiving leaf node passes the CSR up through the tree structure to a lowest common ancestor (LCA) node for the receiving leaf node and one or more destination leaf nodes associated with the destination endpoint. The LCA node uses its pointers to pass the CSR down towards the one or more destination leaf nodes, which use the corresponding VIP-to-PIP mappings to forward the CSR to the destination endpoint.

Abstract: System, method, and software for detecting anomalies in data generated by microservices. In one embodiment, an anomaly detector collects performance metrics for a microservice deployed in a data center for an application. The anomaly detector transforms the performance metrics into a time-series structured dataset for the microservice, and feeds the structured dataset to a machine learning system to determine whether an anomaly exists in the structured dataset based on an anomaly detection model. The anomaly detector performs an anomaly classification with the machine learning system based on an anomaly classification model and the structured dataset when an anomaly is detected in the structured dataset, and performs an action based on the anomaly classification.

Abstract: Packet-processing circuitry including one or more flow caches whose contents are managed using a cache-entry replacement policy that is implemented based on one or more updatable counters maintained for each of the cache entries. In an example embodiment, the implemented policy enables the flow cache to effectively catch and keep elephant flows by giving to the caught elephant flows appropriate preference in terms of the cache dwell time, which can beneficially improve the overall cache-hit ratio and/or packet-processing throughput. Some embodiments can be used to implement an Open Virtual Switch (OVS). Some embodiments are advantageously capable of implementing the cache-entry replacement policy with very limited additional memory allocation.

Abstract: Network-based, unsupervised classifiers are provided. The classifiers identify both known and unknown attacks aimed at industrial networks without the need to have a priori knowledge of known malicious attack patterns.

Abstract: An apparatus may implement an ad hoc service switch to establish an ad hoc link between ad hoc devices, such that the apparatus is a transparent node in an ad hoc link between the ad hoc devices. The apparatus may implement rule-based control of at least one ad hoc device, based on processing a data packet received from an ad hoc device via the ad hoc link. Rule-based control may include performing at least one operation of selectively forwarding the data packet, selectively inhibiting the data packet from being forwarded, modifying the data packet, and generating and transmitting a new data packet. The apparatus may establish the ad hoc link via an initial ad hoc link between the apparatus and the first device, a network communication link between the apparatus and an external apparatus, and an ad hoc link between the external apparatus and the second device.

Abstract: A method for controlling packet routing in a network includes identifying segment identifications (IDs) for a number of switches and arranging a first number of the segment IDs into a multi-protocol label switching (MPLS) label field. The method further includes identifying an output port of a respective one of the number of switches located along a network path between source and destination nodes. The switches may route the packet based on corresponding ones of the segment IDs in the MPLS label field. In performing this routing operation, each switch may modify the MPLS label field with remaining ones of the segment IDs that have been shifted in position and padded with zeros, after the segment ID corresponding to the switch has been popped from the MPLS label field. The method therefore presents a technique for performing segment routing through network equipment designed to support MPLS routing.

Abstract: Network-based, unsupervised classifiers are provided. The classifiers identify both known and unknown attacks aimed at industrial networks without the need to have a priori knowledge of known malicious attack patterns.

Abstract: A method for controlling packet routing in a network includes identifying segment identifications (IDs) for a number of switches and arranging a first number of the segment IDs into a multi-protocol label switching (MPLS) label field. The method further includes identifying an output port of a respective one of the number of switches located along a network path between source and destination nodes. The switches may route the packet based on corresponding ones of the segment IDs in the MPLS label field. In performing this routing operation, each switch may modify the MPLS label field with remaining ones of the segment IDs that have been shifted in position and padded with zeros, after the segment ID corresponding to the switch has been popped from the MPLS label field. The method therefore presents a technique for performing segment routing through network equipment designed to support MPLS routing.

Abstract: In a data processing system, a received data stream comprises a plurality of tuples having respective key values. The received data stream is separated into portions that are delivered to respective ones of a first set of servers in a manner that permits different tuples having the same key value to be processed by different servers of the first set. For each distinct key value, each of at least a subset of the servers of the first set maintains a corresponding partial key result based on one or more of the tuples having that key value that are received by that server. The partial key results are periodically delivered from the servers of the first set to servers of a second set of servers in a manner that ensures that different partial key results having the same key value are processed by the same server of the second set.

Abstract: A method of determining a maximum flow on a network path using segment routing, the method including establishing a segment graph, establishing underlying dual weights on the segment graph, computing the dual weights from the segment graph, finding a minimum dual weight path not having more than a predetermined number of hops, augmenting a flow on the dual weight path, and updating the dual weights on the underlying segment graph.

Abstract: Various embodiments relate to a non-transitory computer readable medium and method thereof for finding a minimum hop path in a segment graph traversing the least number of links in a physical topology, the method including receiving a connection request for a connection between a source node and a destination node, computing the segment graph, the segment graph having a plurality of links, computing a bandwidth for each of the plurality of links in the segment graph, computing the number of links for a shortest path (“N(q)”) for each of the plurality of links, eliminating each of the plurality of link with a bandwidth less than the minimum bandwidth and selecting the shortest path in the physical topology between the plurality of links.

Abstract: Various embodiments relate to a method and apparatus for computing a minimum segment labeling of a given path on a segment cover graph, the method including receiving a connection request for a connection between a source node and a destination node, generating a Shortest Path Directed Acyclic Graph (“SPDAG”) from the source node to the destination node by running a shortest path algorithm from the source node, determining an end node, between the source node and the destination node, at which the SPDAG deviates from the given path, determining whether the end node is the end of an Equal Cost Multipath (“ECMP”) and terminating the shortest path algorithm at a predecessor node to the end node if the end node is the end of an ECMP and making the predecessor node to the end node the source node.

Abstract: Various exemplary embodiments relate to a method of offline traffic matrix aware segment routing. The method may include receiving a traffic matrix based upon all the traffic between nodes i and j that is routed in the network; and determining the amount of traffic between nodes i and j will be routed through node k, based on minimizing a maximum link utilization for the traffic matrix by determining that the total amount of flow on a link e in the network is less than the link's capacity.

Abstract: Various exemplary embodiments relate to a method and related network node including one or more of the following: receiving, at the cloud controller, a request message including a first request for a first cloud resource; identifying a set of potential devices for providing the first cloud resource; calculating a plurality of weight values corresponding to at least a portion of the set of potential devices for providing the first cloud resource, wherein the plurality of weight values are calculated based on a plurality of delta values associated with the at least a portion of the set of potential devices; selecting a device based on the plurality of weight values to provide the first cloud resource; and updating the delta value associated with the selected device.

Abstract: A resource assignment capability is presented. A resource specification associated with a plurality of elements is received. The resource specification includes, for each of the elements, a resource request including an indication of a quantity of resources requested by the element and a resource offer including an indication of a quantity of resources offered by the element for use by one or more other elements. A resource assignment, including an indication of an association between the resources requests and the resource offers, is determined using a resource assignment process. The resource assignment process may be a greedy assignment process or a maximum flow resource assignment process. The maximum flow resource assignment process includes constructing a maximum flow resource graph based on the one or more resource specifications and applying a maximum flow process to the maximum flow resource graph to determine thereby the resource assignment.

Abstract: An illustrative example method of processing image data includes dividing a block of data into a plurality of sub-blocks, the block of data corresponding to at least one image; selecting at least one of the sub-blocks according to a predetermined sequence; identifying a plurality of features of interest in the selected sub-block; and processing the selected sub-block to provide information regarding at least one of the features of interest.

Abstract: A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.

Abstract: An illustrative example method of processing image data includes dividing a block of data into a plurality of sub-blocks, the block of data corresponding to at least one image; selecting at least one of the sub-blocks according to a predetermined sequence; identifying a plurality of features of interest in the selected sub-block; and processing the selected sub-block to provide information regarding at least one of the features of interest.

Abstract: Various exemplary embodiments relate to a method and related network node including one or more of the following: obtaining a set of compute nodes, a set of data nodes, and a set of edges between compute nodes and data nodes; determining an assignment objective to be achieved in assigning compute nodes from the set of compute nodes to data nodes from the set of data nodes; applying an algorithm associated with the assignment objective to obtain a set of assignments based on a plurality of costs associated with the set of edges; and assigning a compute node of the set of compute nodes to a data node of the set of data nodes based on the set of assignments.

Abstract: A system and method for providing localization of a mobile electronic device within an environment includes at least one server in communication with the mobile electronic device. The at least one server is adapted to receive at least one picture and at least one accelerometer measurement from the mobile electronic device. The at least one server includes a localization module that provides localization to the mobile electronic device based on the at least one picture, the at least one accelerometer measurement and on at least one 3-dimensional map of the environment.