Abstract: A software-defined network overlay capability is configured to control one or more overlay networks using software-defined networking (SDN) in which control functions and forwarding functions are separated. The software-defined network overlay capability may be configured to vertically move packets across network layers, e.g., into an overlay network (e.g., into a tunnel via encapsulation), out of an overlay network (e.g., out of a tunnel via decapsulation), or the like. The software-defined network overlay capability may be configured to move packets from native forwarding infrastructure into an overlay network, between overlay networks (e.g., into a first overlay network from a second overlay network without leaving the second overlay network, out of a first overlay network and into a second overlay network, out of a first overlay network while remaining within a second overlay network, or the like), from an overlay network onto native forwarding infrastructure, or the like.

Abstract: A method, apparatus, and computer-readable storage medium for generating a mobile flow record for a mobile flow of a mobile node are provided. A method includes receiving information associated with signaling traffic of the mobile node, receiving information associated with bearer traffic of the mobile node, and generating the mobile flow record by correlating the information associated with signaling traffic of the mobile node and the information associated with bearer traffic of the mobile node. The mobile flow record includes IP layer information associated with the mobile flow and wireless layer information associated with the mobile flow.

Abstract: A method and apparatus are provided for incrementally tracking quantiles in the presence of multiple record types. A method for performing incremental quantile tracking includes receiving a first data record of a first record type and a second data record of a second record type, and updating a quantile probability for a quantile value, based on the first record type of the first data record and the second record type of the second data record, to obtain a new quantile probability for the quantile value.

Abstract: A capability for incremental tracking of multiples quantiles is provided. A method for performing an incremental quantile update using a data value of a received data record includes determining an initial distribution function, updating the initial distribution function to form a new distribution function based on the received data value, generating an approximation of the new distribution function, and determining new quantile estimates from the approximation of the new distribution function. The initial distribution function includes a plurality of initial quantile estimates and a respective plurality of initial probabilities. The new distribution function includes a plurality of quantile points identifying the respective initial quantile estimates and a respective plurality of new probabilities associated with the initial quantile estimates.

Abstract: A method for estimating a geographic location of a mobile station includes calculating an angular position of a mobile station to a base station based on first and second signal strength measurements and an angular position reference for the base station, the signal strength measurements from the mobile station for RF signals from first and second sector antennas of the base station. Another method includes calculating a radial distance of a mobile station from a base station serving the mobile station, determining a signal strength report from the mobile station includes a signal strength measurement for an RF signal from a first sector antenna of the base station, and identifying a geographic location of the mobile station based on intersection of a circle around the base station with a radius of the radial distance with a sub-sector geographic area in an RF coverage map for the first sector antenna.

Abstract: A method and system for identifying causes of performance metric changes in a network by selecting, from a pool of network event counters, a plurality of candidate counters relevant to a performance metric; grouping the candidate counters into clusters of similar counters; selecting, from each cluster, one or more representative counters; and fitting the selected representative counters to a model of the performance metric to determine thereby a set of representative counters most relevant to the performance metric.

Abstract: A method of identifying application data associated with IP flows traveling between a plurality of mobiles and a network element in a communications network includes receiving, at a network element, one or more domain name system (DNS) packets being sent to one or more mobiles from among of the plurality of mobiles; and building, at the network element, a mapping table mapping one or more IP addresses, respectively, to corresponding application information, based on mapping information within the one or more DNS packets received at the network element.

Abstract: A method for mapping an operating parameter in a coverage area of a wireless network includes obtaining parameter measurements for an operating parameter associated with mobile stations operating in a select portion of a network coverage area for a wireless network, the network coverage area formed by base stations defining cellular coverage areas, the select portion formed by at least one base station, each at least one base station including multiple sector antennas, each sector antenna defining a sector coverage area within the cellular coverage area; and, for each obtained parameter measurement, estimating an instant geographic location of the mobile station in relation to the at least one base station serving the mobile station, each instant geographic location based on a round trip measurement and a signal strength measurement associated with the mobile station, each round trip measurement associated with the serving base station.

Abstract: A method for estimating a geographic location of a mobile station includes calculating an angular position of a mobile station to a base station based on first and second signal strength measurements and an angular position reference for the base station, the signal strength measurements from the mobile station for RF signals from first and second sector antennas of the base station. Another method includes calculating a radial distance of a mobile station from a base station serving the mobile station, determining a signal strength report from the mobile station includes a signal strength measurement for an RF signal from a first sector antenna of the base station, and identifying a geographic location of the mobile station based on intersection of a circle around the base station with a radius of the radial distance with a sub-sector geographic area in an RF coverage map for the first sector antenna.

Abstract: A method for estimating a geographic location of a mobile station includes calculating an angular position of a mobile station to a base station based on first and second signal strength measurements and an angular position reference for the base station, the signal strength measurements from the mobile station for RF signals from first and second sector antennas of the base station. Another method includes calculating a radial distance of a mobile station from a base station serving the mobile station, determining a signal strength report from the mobile station includes a signal strength measurement for an RF signal from a first sector antenna of the base station, and identifying a geographic location of the mobile station based on intersection of a circle around the base station with a radius of the radial distance with a sub-sector geographic area in an RF coverage map for the first sector antenna.

Abstract: In one embodiment, a method of monitoring a network. The method includes, at each node of a fixed set, constructing a corresponding vector of M components based on data packets received at the node during a time period, M being an integer greater than 1, the fixed set being formed of some nodes of the network; and, based on the constructed vectors, estimating how many of the received data packets have been received by all of the nodes of the set or estimating how many flows of the received data packets have data packets that have passed through all of the nodes of the set. The constructing includes updating a component of the vector of one of the nodes in response to the one of the nodes receiving a data packet. The updating includes selecting the component for updating by hashing a property of the data packet received by the one of the nodes.

Abstract: A method for estimating a geographic location of a mobile station within a coverage area of a wireless network includes: determining a radial distance of the mobile station from a serving base station based on a round trip measurement and calculating an angular position of the mobile station in relation to the radial distance based on a first signal strength measurement, a second signal strength measurement, and an angular position reference that extends outward from the serving base station. The signal strength measurements representative of power characteristics of RF signals received by the mobile station from first and second sector antennas of the serving base station. An apparatus associated therewith includes a distance module to perform the determining and an angular position module to perform the calculating. The apparatus may be implemented in a base station, a geo-location service node, a network management node, or other communication nodes.

Abstract: A method for estimating a geographic location of a mobile station within a coverage area of a wireless network includes: determining a radial distance of the mobile station from a serving base station based on a round trip measurement and calculating an angular position of the mobile station in relation to the radial distance based on a first signal strength measurement, a second signal strength measurement, and an angular position reference that extends outward from the serving base station. The signal strength measurements representative of power characteristics of RF signals received by the mobile station from first and second sector antennas of the serving base station. An apparatus associated therewith includes a distance module to perform the determining and an angular position module to perform the calculating. The apparatus may be implemented in a base station, a geo-location service node, a network management node, or other communication nodes.

Abstract: A method for estimating a geographic location of a mobile station includes calculating an angular position of a mobile station to a base station based on first and second signal strength measurements and an angular position reference for the base station, the signal strength measurements from the mobile station for RF signals from first and second sector antennas of the base station. Another method includes calculating a radial distance of a mobile station from a base station serving the mobile station, determining a signal strength report from the mobile station includes a signal strength measurement for an RF signal from a first sector antenna of the base station, and identifying a geographic location of the mobile station based on intersection of a circle around the base station with a radius of the radial distance with a sub-sector geographic area in an RF coverage map for the first sector antenna.

Abstract: A method for mapping an operating parameter in a coverage area of a wireless network includes obtaining parameter measurements for an operating parameter associated with mobile stations operating in a select portion of a network coverage area for a wireless network, the network coverage area formed by base stations defining cellular coverage areas, the select portion formed by at least one base station, each at least one base station including multiple sector antennas, each sector antenna defining a sector coverage area within the cellular coverage area; and, for each obtained parameter measurement, estimating an instant geographic location of the mobile station in relation to the at least one base station serving the mobile station, each instant geographic location based on a round trip measurement and a signal strength measurement associated with the mobile station, each round trip measurement associated with the serving base station.

Abstract: Various exemplary embodiments relate to a method and related network node including one or more of the following: identifying, at the network node, a packet associated with a first address; determining, at the network node, that an alternate address mapping is unknown to the network node for the first address; generating a request message based on at least a portion of the packet; transmitting the request message to a different node; receiving a response message, the response message including a second address, wherein the second address is an alternative address for the first address; and storing the first address and the second address together as an alternate address mapping.

Abstract: A method is provided, according to which data are collected on downstream packet losses at a single point in a network. From from the collected data, packet loss rates are estimated on at least two subnetworks downstream of the collection point. The respective subnetworks may differ by one or more links.

Abstract: A system and method for network based detection of wireless data subscribers using network address translation devices is provided. The method includes identifying a minimum number of devices showing the same internet protocol address. Packet identification sequences may include port numbers or internet protocol identification numbers. The method continues with grouping these applications by their packet identification sequences and applying detection logic where detection logic yields a conclusion that there are multiple host computers when a set of applications appears in a plurality of packet identification sequences. This method is particularly useful when internet protocol addresses are dynamic, as opposed to static. This method overcomes previous embodiments known in the art by being able to account for and work with live traffic, which enables real time detection.

Abstract: A method, apparatus, and computer-readable storage medium for generating a mobile flow record for a mobile flow of a mobile node are provided. A method includes receiving information associated with signaling traffic of the mobile node, receiving information associated with bearer traffic of the mobile node, and generating the mobile flow record by correlating the information associated with signaling traffic of the mobile node and the information associated with bearer traffic of the mobile node. The mobile flow record includes IP layer information associated with the mobile flow and wireless layer information associated with the mobile flow.

Abstract: Network architecture and related methods for maintaining traffic flow between clients and an end-server during a Denial of Service (DoS) attack are described herein. The network architecture includes a set of overlay nodes coupled between clients and a server. Each overlay node is able to rank and probe other nodes for purposes of selecting a best path for routing traffic to the end-server to resist a denial of service of attack. Probing is performed to detect overlay nodes having better performance based on one or more performance metrics (i.e., load, jitter, latency, loss rate). For instance, in one implementation probing detects lightly loaded overlay paths for purposes of routing traffic to the end-server, so as to maintain connectivity between the end-server and clients even under DoS attacks.