Abstract: Systems and methods for implementing a system for analyzing large amounts of event data to determine any potential security threats or anomalies. Event data may be obtained and processed. The processed event data may be analyzed to detect any potential security threats or anomalies.

Abstract: A network monitoring system is provided that includes a processor and a memory coupled to the processor. A plurality of services provided by a network operator is identified. A plurality of Key Performance Indicators (KPIs) associated with the identified plurality of services is calculated on a per service basis. Individual services provided by the network operator are characterized based on the calculated plurality of KPIs. A root cause of service level failures for one or more of the plurality of services is identified, in response to determining that at least one of the characterized service levels does not meet predefined service level objectives for the one or more of the plurality of services.

Abstract: A method for monitoring tunneled Internet Protocol (IP) traffic in a communication network includes monitoring tunnel signaling flows to determine relationships between tunnels and subscriber sessions for each established tunnel. A first tunnel signaling state is stored in a data repository for each established tunnel. The first tunnel signaling state is indicative of the determined relationship between the tunnel and corresponding subscriber sessions. A second tunnel signaling state is validated based on the stored first tunnel signaling state to identify incorrect association between a monitored tunnel and corresponding subscriber session, in response to detecting a monitoring gap.

Abstract: A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes session data of one or more transactions in a multiprotocol wireless communication system. The network monitoring system further includes a rule engine configured and operable to store rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured to identify a root cause of a failure for one or more of the transactions based on at least one rule in the rule set.

Abstract: A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes key performance indicator (KPI) records for monitoring a wireless communication system. The network monitoring system further includes a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured and operable to identify a list of root causes identifying failure events based on the at least one KPI rule in the at least one rule set.

Abstract: A method for monitoring tunneled Internet Protocol (IP) traffic in a communication network includes monitoring tunnel signaling flows to determine relationships between tunnels and subscriber sessions for each established tunnel. A first tunnel signaling state is stored in a data repository for each established tunnel. The first tunnel signaling state is indicative of the determined relationship between the tunnel and corresponding subscriber sessions. A second tunnel signaling state is validated based on the stored first tunnel signaling state to identify incorrect association between a monitored tunnel and corresponding subscriber session, in response to detecting a monitoring gap.

Abstract: A computer implemented method and telecommunications diagnostic apparatus that correlates packets on a core network with those on the access network. Generated is an identification attribute from Information Elements (IEs) in S1AP packets present in the core network and accessible to the access network. The generated identification attribute is integrated to an access and core session of the access and core network to correlate data packets between the access and core session by comparing if a core session contains the same identification attribute as that of an access session within the life span of the access session.

Abstract: A network monitoring device monitors at least one tap point corresponding to a network interface between User Equipment (UE) and one or more additional nodes in the communication network, detects one or more transactions at the at least one tap point corresponding to the network interface with each transaction including request data and response data. The network monitoring device further determines a time associated with the request data and a time associated with the response data for each transaction, determines a delay time for each transaction for the at least one tap point by a difference between the time associated with the request data and the time associated with the response data, assigns the delay time for each transaction to one or more a predefined time ranges, and increments a count corresponding to the one or more predefined time ranges when the delay time is assigned.

Abstract: A system and method for monitoring a communication network is provided. The method includes capturing network data from network traffic of the communication network by a plurality of probes monitoring the communication network. The method further includes detecting by lightweight analysis a data packet of the captured network data that includes information related to a transactional procedure failure transacted by an end-user device and determining an identity of the end-user device. The method further includes sharing the identity of the end-user device with other probes of the plurality of probes, adding the end-user device's identity to respective whitelists associated with the probes of the plurality of probes, and performing, for end-user device identities included in the respective whitelists, detailed analysis of network data during a predetermined time period.

Abstract: A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes session data of one or more transactions in a multiprotocol wireless communication system. The network monitoring system further includes a rule engine configured and operable to store rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured to identify a root cause of a failure for one or more of the transactions based on at least one rule in the rule set.

Abstract: A system and method for monitoring a communication network is provided. The method includes capturing network data from network traffic of the communication network by a plurality of probes monitoring the communication network. The method further includes detecting by lightweight analysis a data packet of the captured network data that includes information related to a transactional procedure failure transacted by an end-user device and determining an identity of the end-user device. The method further includes sharing the identity of the end-user device with other probes of the plurality of probes, adding the end-user device's identity to respective whitelists associated with the probes of the plurality of probes, and performing, for end-user device identities included in the respective whitelists, detailed analysis of network data during a predetermined time period.

Abstract: A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes key performance indicator (KPI) records for monitoring a wireless communication system. The network monitoring system further includes a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured and operable to identify a list of root causes identifying failure events based on the at least one KPI rule in the at least one rule set.

Abstract: A network monitoring system is provided that includes a processor and a memory coupled to the processor. A plurality of services provided by a network operator is identified. A plurality of Key Performance Indicators (KPIs) associated with the identified plurality of services is calculated on a per service basis. Individual services provided by the network operator are characterized based on the calculated plurality of KPIs. A root cause of service level failures for one or more of the plurality of services is identified, in response to determining that at least one of the characterized service levels does not meet predefined service level objectives for the one or more of the plurality of services.

Abstract: Transaction and session processing of packets within a network monitoring system may be distributed among tightly-coupled processing elements by marking each received packet with a time-ordering sequence reference. The marked packets are distributed among processing elements by any suitable process for transaction processing by the respective processing element to produce transaction metadata. Where a session-owning one of the processing elements has indicated ownership of the session to the remaining processing elements, the transaction-processed packet and transaction metadata are forwarded to the session owner. The session owner aggregates transaction-processed packets for the session, time-orders the aggregated packets, and performs session processing on the aggregated, time-ordered transaction-processed packets to generate session metadata with the benefit of context information.

Abstract: A distributed network monitoring device monitors via a lightweight session tracking module of a network monitoring device, control plane data for connectivity sessions of User Equipment (UE) in a communication network. The lightweight session tracking module selectively identifies at least one bearer for a corresponding connectivity session according to one or more control plane attributes and associates each selectively identified bearer for the corresponding connectivity session with a bearer routing rule for user plane data. A packet routing module receives user plane data for connectivity sessions of UE and transmits the user plane data of the connectivity sessions according to the bearer routing rule of the lightweight session tracking module to a flow processing module for subsequent data flow analysis.

Abstract: A method for monitoring GPRS Tunneling Protocol (GTP) sessions in a mobile communication network having a monitoring module. The method includes the steps of monitoring, by the monitoring module, a plurality of subscriber GTP sessions, and storing recovery parameters related to the subscriber GTP sessions and subscribers associated therewith in records in a database in the monitoring module, wherein the recovery parameters are associated with initial session data for each subscriber GTP session. Upon an outage in monitoring, the method restarts the monitoring module to determine restart parameters associated with existing subscriber GTP sessions and subscribers associated therewith in the records in the database wherein the restart parameters are associated with subsequent session data for each subscriber GTP session.

Abstract: Network monitoring devices and network monitoring techniques are disclosed and use inferential statistical approaches to determine one or more Key Performance Indicators, particularly for Circuit Switched FallBack (CSFB) scenarios. For example, the network monitoring node monitors a plurality of ciphered or clear text messages for a network interface in a communication network, determines a Mobile Terminating (MT) count for MT calls and a Mobile Originating (MO) count for User Equipment (UE) from at least one message of the plurality of messages and defines an inferred MT ratio based on the MT count and the MO count for a total number of messages. The network monitoring device further applies the inferred MT ratio to a CSFB idle mode count for UE and/or a CSFB active mode count for UE to yield an estimated total number of CSFB idle mode successes and an estimated total number of CSFB active mode successes, respectively.

Abstract: Network monitoring devices and network monitoring techniques are disclosed and use inferential statistical approaches to determine one or more Key Performance Indicators, particularly for Circuit Switched FallBack (CSFB) scenarios. For example, the network monitoring node monitors a plurality of ciphered or clear text messages for a network interface in a communication network, determines a Mobile Terminating (MT) count for MT calls and a Mobile Originating (MO) count for User Equipment (UE) from at least one message of the plurality of messages and defines an inferred MT ratio based on the MT count and the MO count for a total number of messages. The network monitoring device further applies the inferred MT ratio to a CSFB idle mode count for UE and/or a CSFB active mode count for UE to yield an estimated total number of CSFB idle mode successes and an estimated total number of CSFB active mode successes, respectively.

Abstract: A network monitoring device monitors at least one tap point corresponding to a network interface between User Equipment (UE) and one or more additional nodes in the communication network, detects one or more transactions at the at least one tap point corresponding to the network interface with each transaction including request data and response data. The network monitoring device further determines a time associated with the request data and a time associated with the response data for each transaction, determines a delay time for each transaction for the at least one tap point by a difference between the time associated with the request data and the time associated with the response data, assigns the delay time for each transaction to one or more a predefined time ranges, and increments a count corresponding to the one or more predefined time ranges when the delay time is assigned.

Abstract: There is provided a passive network monitoring device that monitors one or more network interfaces between network nodes including a SGW node, a PGW node, an ePDG node, and a PCRF node and a PCEF node. The device receives a handover indication for UE from untrusted non-3GPP network access to 3GPP network access and receives a response to an attach request from one or more of the network interfaces, the response including a MSIP address and a charging ID for the UE. The device determines the UE is from a single subscriber based on each of the handover, the MSIP address of the response and the charging ID of the response, and correlates information for the UE at each of the one or more network interfaces with the single subscriber.