Abstract: A cloud gateway outage risk detector can receive, by an event listener module, user session data associated with a plurality of user sessions over a cloud gateway. The event listener module can store the data in a database. A run-time collection module can obtain at least a portion of the data. The run-time collection module can provide the portion of the data to a run-time risk criteria evaluation module that can determine, based upon the portion of the data, a run-time outage risk criteria for the cloud gateway. A baseline risk criteria evaluation module can obtain historical data from the database. The baseline risk criteria evaluation module can determine, based upon the data, a baseline outage risk criteria for the cloud gateway. The run-time risk criteria evaluation module can determine whether the run-time outage risk criteria meets or exceeds an outage risk threshold.

Abstract: A cloud gateway outage risk detector can receive, by an event listener module, user session data associated with a plurality of user sessions over a cloud gateway. The event listener module can store the data in a database. A run-time collection module can obtain at least a portion of the data. The run-time collection module can provide the portion of the data to a run-time risk criteria evaluation module that can determine, based upon the portion of the data, a run-time outage risk criteria for the cloud gateway. A baseline risk criteria evaluation module can obtain historical data from the database. The baseline risk criteria evaluation module can determine, based upon the data, a baseline outage risk criteria for the cloud gateway. The run-time risk criteria evaluation module can determine whether the run-time outage risk criteria meets or exceeds an outage risk threshold.

Abstract: Systems and methods for adaptive TCA threshold management are described. A technique can include receiving threshold crossing alert (TCA) data including operational TCA data, determining a TCA prediction trigger based on a current threshold, matching, in response to determining the TCA prediction trigger, the operational TCA data to a pattern from a TCA pattern bank, and calculating a predicted TCA threshold based on the pattern.

Abstract: Concepts and technologies directed to network fault originator identification for virtual network infrastructure are disclosed herein. Embodiments can include a control system that is communicatively coupled with network infrastructure. The control system can include a processor and memory that, upon execution, causes the control system to perform operations. The operations can include determining, based on a source ticket, a network fault condition associated with the network infrastructure. The operations can further include identifying, from the source ticket, a trap set and an alarm set that are associated with origination of the network fault condition. The operations can include the control system collecting network event data from the network infrastructure prior to a polling time of a fault reporting schedule; determining that a qualified source ticket should be created; and generating the qualified source ticket based on the network event data.

Abstract: Methods and systems associated with a microservice based predictive service level agreement (SLA) impact analytics system that may run on standardized container based virtual computing platform to enable capacity auto-scaling for on-demand, near-real-time resource allocation automatically supporting user data packet forwarding when SLA is potentially impacted to ensure SLA compliance.

Abstract: Concepts and technologies directed to network fault originator identification for virtual network infrastructure are disclosed herein. Embodiments can include a control system that is communicatively coupled with network infrastructure. The control system can include a processor and memory that, upon execution, causes the control system to perform operations. The operations can include determining, based on a source ticket, a network fault condition associated with the network infrastructure. The operations can further include identifying, from the source ticket, a trap set and an alarm set that are associated with origination of the network fault condition. The operations can include the control system collecting network event data from the network infrastructure prior to a polling time of a fault reporting schedule; determining that a qualified source ticket should be created; and generating the qualified source ticket based on the network event data.

Abstract: Concepts and technologies directed to network fault originator identification for virtual network infrastructure are disclosed herein. Embodiments can include a control system that is communicatively coupled with network infrastructure. The control system can include a processor and memory that, upon execution, causes the control system to perform operations. The operations can include determining, based on a source ticket, a network fault condition associated with the network infrastructure. The operations can further include identifying, from the source ticket, a trap set and an alarm set that are associated with origination of the network fault condition. The operations can include the control system collecting network event data from the network infrastructure prior to a polling time of a fault reporting schedule; determining that a qualified source ticket should be created; and generating the qualified source ticket based on the network event data.

Abstract: Concepts and technologies disclosed herein are directed to context-aware virtualized control decision support system (“DSS”) for providing quality of experience (“QoE”) assurance for Internet protocol (“IP”) streaming video services. A QoE assurance DSS can monitor QoE event and context data to be utilized for QoE assurance analytics, measure QoE performance, perform QoE assurance analytics, and determine whether the QoE assurance analytics indicate that the QoE has been degraded, and if so, construct a fault correlation information model to be utilized for root cause analysis to determine a root cause of the QoE being degraded. The QoE assurance DSS also can determine, based upon the fault correlation information model, whether the root cause of the QoE being degraded is due to a capacity reduction, and if so, the QoE assurance DSS can identify a new network resource for capacity reallocation to accommodate a virtual machine migration.

Abstract: A method and an apparatus for detecting a port scan in a network are disclosed. For example, the method extracts statistics from a message, detects the port scan for a source internet protocol address, determines whether a port scan record exists for the source internet protocol address, creates a port scan record for the source internet protocol address that is extracted when the port scan record does not exist, determines an elapsed time when the port scan record does exist, wherein the elapsed time is determined as a difference between the time stamp that is extracted and a recorded time stamp, sets the recorded time stamp to be the extracted time stamp when the elapsed time is less than an intra-scan time, and determines the port scan has ended for the source internet protocol address when the elapsed time is not less than the intra-scan time.

Abstract: Concepts and technologies disclosed herein are directed to data-driven feedback control systems for an acceptable level of real-time application transaction completion rate in virtualized networks, while maximizing virtualized server utilization. According to one aspect disclosed herein, a network virtualization platform (“NVP”) includes a plurality of hardware resources, a virtual machine (“VM”), and a virtual machine monitor (“VMM”). The VMM can track an execution state of each of a plurality of applications associated with the VM. The VMM can measure a real-time application transaction completion rate of the VM. The VMM can determine whether a trigger condition exists for priority scheduling of real-time applications based upon the real-time application transaction completion rate and a pre-set threshold value.

Abstract: Concepts and technologies disclosed herein are directed to an auto-scaling software-defined monitoring (“SDM”) platform for software-defined networking (“SDN”) service assurance. According to one aspect of the concepts and technologies disclosed herein, an SDM controller can monitor event data associated with a network event that occurred within a virtualized IP SDN network that is monitored by a virtualized SDM resources platform. The SDM controller can measure, based upon the event data, a quality of service (“QoS”) performance metric associated with the virtualized SDM resource platform. The SDN controller can determine, based upon the QoS performance metric, whether an auto-scaling operation is to be performed. The auto-scaling operation can include reconfiguring the virtualized SDM resources platform by adding virtual machine capacity for supporting event management tasks either by instantiating a new virtual machine or by migrating an existing virtual machine to a new hardware host.

Abstract: Concepts and technologies are disclosed herein for a realtime dynamic virtual network topology discovery engine to discover a dynamic network topology in virtualized networks in realtime. A processor that executes a network topology discovery engine can obtain network data that can describe elements of a data center and operational state of the elements. Obtaining network data can include obtaining network data from a network topology inventory database and through detecting operational state change events from virtual network components. The processor can construct a network topology model based upon the network data. The network topology model can include an object (representing an element of the data center) and an attribute representing a state of the element. The processor can update the network topology model in realtime. The network topology model and configurations can be stored for root cause analysis of fault events, resource orchestration in SDN networks, and other applications.

Abstract: A processor may determine a message type of a message of a message set and extract strings from the message based upon the message type, each string associated with a field type within the message type. The processor may write one of the strings to a string table, when not already stored in the string table, and add an offset position of the string in the string table to a column list for the field type associated with the string, when not already stored in the column list. There may be different column lists for different field types. The processor may populate an entry of a data table corresponding to the message and to the field type associated with the string with an index of the offset position within the column list, and store a compressed version of the message set including the string table, column lists, and data table.

Abstract: Systems and methods for adaptive TCA threshold management are described. A technique can include receiving threshold crossing alert (TCA) data including operational TCA data, determining a TCA prediction trigger based on a current threshold, matching, in response to determining the TCA prediction trigger, the operational TCA data to a pattern from a TCA pattern bank, and calculating a predicted TCA threshold based on the pattern.

Abstract: Concepts and technologies directed to network fault originator identification for virtual network infrastructure are disclosed herein. Embodiments can include a control system that is communicatively coupled with network infrastructure. The control system can include a processor and memory that, upon execution, causes the control system to perform operations. The operations can include determining, based on a source ticket, a network fault condition associated with the network infrastructure. The operations can further include identifying, from the source ticket, a trap set and an alarm set that are associated with origination of the network fault condition. The operations can include the control system collecting network event data from the network infrastructure prior to a polling time of a fault reporting schedule; determining that a qualified source ticket should be created; and generating the qualified source ticket based on the network event data.

Abstract: An IP network topology update system may update IP network topology in near real-time and on-demand with minimum overheads. It identifies likely impact area (e.g., layer 2 or layer 3), objects (e.g., link or node such a device), and timing (e.g., what topology objects located where or when the topology update process should be performed) in the IP Layer 3 network and its underlying SDN Layer 2 network under virtualized networking infrastructure as candidates of impacts for topology update.

Abstract: A method and an apparatus for detecting a port scan in a network are disclosed. For example, the method extracts statistics from a message, detects the port scan for a source internet protocol address, determines whether a port scan record exists for the source internet protocol address, creates a port scan record for the source internet protocol address that is extracted when the port scan record does not exist, determines an elapsed time when the port scan record does exist, wherein the elapsed time is determined as a difference between the time stamp that is extracted and a recorded time stamp, sets the recorded time stamp to be the extracted time stamp when the elapsed time is less than an intra-scan time, and determines the port scan has ended for the source internet protocol address when the elapsed time is not less than the intra-scan time.

Abstract: A method and an apparatus for detecting a port scan in a network are disclosed. For example, the method extracts statistics from a message, detects the port scan for a source internet protocol address, determines whether a port scan record exists for the source internet protocol address, creates a port scan record for the source internet protocol address that is extracted when the port scan record does not exist, determines an elapsed time when the port scan record does exist, wherein the elapsed time is determined as a difference between the time stamp that is extracted and a recorded time stamp, sets the recorded time stamp to be the extracted time stamp when the elapsed time is less than an intra-scan time, and determines the port scan has ended for the source internet protocol address when the elapsed time is not less than the intra-scan time.

Abstract: Methods and systems associated with a microservice based predictive service level agreement (SLA) impact analytics system that may run on standardized container based virtual computing platform to enable capacity auto-scaling for on-demand, near-real-time resource allocation automatically supporting user data packet forwarding when SLA is potentially impacted to ensure SLA compliance.

Abstract: Concepts and technologies disclosed herein are directed to an auto-scaling software-defined monitoring (“SDM”) platform for software-defined networking (“SDN”) service assurance. According to one aspect of the concepts and technologies disclosed herein, an SDM controller can monitor event data associated with a network event that occurred within a virtualized IP SDN network that is monitored by a virtualized SDM resources platform. The SDM controller can measure, based upon the event data, a quality of service (“QoS”) performance metric associated with the virtualized SDM resource platform. The SDN controller can determine, based upon the QoS performance metric, whether an auto-scaling operation is to be performed. The auto-scaling operation can include reconfiguring the virtualized SDM resources platform by adding virtual machine capacity for supporting event management tasks either by instantiating a new virtual machine or by migrating an existing virtual machine to a new hardware host.