Abstract: An edge computing-based method for fine determination of an urban traffic state includes the following steps: preprocessing lane-level data collected by edge nodes; dividing a complete road segment; computing an average delay per vehicle of a lane by using the edge nodes; inputting the preprocessed and computed data into a fuzzy logic model to determine a lane-level traffic state of an approach region; and based on the characteristic that edge nodes at the intersections can be interconnected, linking upstream and downstream intersection information to compute an average travel speed of a remaining road segment, and determining a traffic state of the remaining road segment.

Abstract: An edge computing-based method for fine determination of an urban traffic state includes the following steps: preprocessing lane-level data collected by edge nodes; dividing a complete road segment; computing an average delay per vehicle of a lane by using the edge nodes; inputting the preprocessed and computed data into a fuzzy logic model to determine a lane-level traffic state of an approach region; and based on the characteristic that edge nodes at the intersections can be interconnected, linking upstream and downstream intersection information to compute an average travel speed of a remaining road segment, and determining a traffic state of the remaining road segment.

Abstract: A method for recognizing multi-dimensional anomalous urban traffic events based on a ternary Gaussian mixture model includes: reading a data sample of urban road traffic events; randomly dividing the data sample into a first subsample and a second subsample; performing modeling based on the first subsample by using the ternary Gaussian mixture model to obtain a second ternary Gaussian mixture model to calculate a distribution probability p of any sample point; clustering the second subsample, recognizing an outlier in the second subsample, and labeling the outlier and a normal point to obtain a labeled subsample; calculating the labeled subsample to obtain the distribution probability p corresponding to each sample point in the labeled subsample; when a new traffic event occurs, obtaining features of three dimensions of the new traffic event, calculating a distribution probability p by using the second model, and recognizing the new traffic event as anomalous if p<t-score.

Abstract: A method for recognizing multi-dimensional anomalous urban traffic events based on a ternary Gaussian mixture model includes: reading a data sample of urban road traffic events; randomly dividing the data sample into a first subsample and a second subsample; performing modeling based on the first subsample by using the ternary Gaussian mixture model to obtain a second ternary Gaussian mixture model to calculate a distribution probability p of any sample point; clustering the second subsample, recognizing an outlier in the second subsample, and labeling the outlier and a normal point to obtain a labeled subsample; calculating the labeled subsample to obtain the distribution probability p corresponding to each sample point in the labeled subsample; when a new traffic event occurs, obtaining features of three dimensions of the new traffic event, calculating a distribution probability p by using the second model, and recognizing the new traffic event as anomalous if p<t-score.

Abstract: In one embodiment, functionality is disclosed for commissioning a target device based, at least in part, on providing identifying information that identifies a target device, where that identifying information is configured to be included in a request for authorization to commission the target device, and that request for authorization to commission the target device comprises one or more requested commissioning actions; receiving a commissioning authorization, where the commissioning authorization comprises information regarding one or more authorized commissioning actions for which a license is available, where the one or more authorized commissioning actions were selected from among the one or more requested commissioning actions; and performing the one or more authorized commissioning actions.

Abstract: A mechanism for secure enrollment of devices with a cloud platform is provided. This serves as a foundation for securing devices, such as edge computing and internet-of-things gateways, that can be provisioned and managed from the cloud. A public key infrastructure mechanism is provided for enrollment that is split into three phases. The first and second phases of the secure enrollment process authenticate the device and ensure that the device is within agreed to manufacturing limits for the device manufacturer. The third phase of the secure enrollment process provides a long-term operating certification to the device for cloud resource access.

Abstract: A mechanism for secure enrollment of devices with a cloud platform is provided. This serves as a foundation for securing devices, such as edge computing and internet-of-things gateways, that can be provisioned and managed from the cloud. A public key infrastructure mechanism is provided for enrollment that is split into three phases. The first and second phases of the secure enrollment process authenticate the device and ensure that the device is within agreed to manufacturing limits for the device manufacturer. The third phase of the secure enrollment process provides a long-term operating certification to the device for cloud resource access.

Abstract: In one embodiment, functionality is disclosed for commissioning a target device based, at least in part, on providing identifying information that identifies a target device, where that identifying information is configured to be included in a request for authorization to commission the target device, and that request for authorization to commission the target device comprises one or more requested commissioning actions; receiving a commissioning authorization, where the commissioning authorization comprises information regarding one or more authorized commissioning actions for which a license is available, where the one or more authorized commissioning actions were selected from among the one or more requested commissioning actions; and performing the one or more authorized commissioning actions.

Abstract: In one embodiment, a system and method are disclosed for receiving a request for authorization to commission a target device based, at least in part, on a plurality of requested commissioning actions; determining whether each of the requested commissioning actions is authorized; sending a commissioning authorization, which includes information identifying the one or more authorized commissioning actions; receiving a commissioning complete confirmation message, which includes information identifying one or more completed commissioning actions; validating the commissioning complete confirmation message, in order to ensure that each of the completed actions had been previously authorized; and if all of the completed commissioning actions were previously authorized, sending an acknowledgement message.

Abstract: In one embodiment, a device receives control logic programmed within at least one controller included within an industrial network. The device also determines a network topology of the industrial network, and derives a network policy for the industrial network based upon, at least in part, the control logic and the network topology.

Abstract: In one embodiment, a system and method are disclosed for receiving, at a first network routing element, a discovery message sent via a network, where the discovery message comprises identifying information that identifies a physical location of a first network device. The method modifies the identifying information in the discovery message by adding additional information to the identifying information, where the additional information can, for example, identify a physical location of the first network routing element. Subsequent to modifying the identifying information, the method forwards the discovery message to a network element, where the network element can be, for example, either a second network routing element or a server.

Abstract: In one embodiment, a virtual firewall is installed on a port of a device that communicates across a zone boundary within an industrial network. The virtual firewall is then configured based on operation of the industrial network, such that the port may then communicate via the firewall to a remote virtual firewall of a remote port of a remote device across the zone boundary.

Abstract: In one embodiment, a device receives a network policy based upon, at least in part, a physical network, and configures a design of an industrial network overlay on the physical network based upon, at least in part, the network policy. The configuring, according to the techniques herein, may generally include: determining a number of virtual local area networks (VLANs) within the industrial network overlay; determining which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; and determining at least one communication path for the industrial network overlay between at least two devices.

Abstract: In one embodiment, a system and method are disclosed for receiving, at a first network routing element, a discovery message sent via a network, where the discovery message comprises identifying information that identifies a physical location of a first network device. The method modifies the identifying information in the discovery message by adding additional information to the identifying information, where the additional information can, for example, identify a physical location of the first network routing element. Subsequent to modifying the identifying information, the method forwards the discovery message to a network element, where the network element can be, for example, either a second network routing element or a server.

Abstract: In one embodiment, a system and method are disclosed for sending a discovery message, via a network, from a first network device. The sending is performed in response to the first network device being associated with a first machine. The method involves receiving an offer message via the network, where the offer message includes network name information that indicates a physical location of the device within a topology of the network. The method also involves using the network name information to communicate with a second network device via the network.

Abstract: In one embodiment, a device receives a network policy based upon, at least in part, a physical network, and configures a design of an industrial network overlay on the physical network based upon, at least in part, the network policy. The configuring, according to the techniques herein, may generally include: determining a number of virtual local area networks (VLANs) within the industrial network overlay; determining which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; and determining at least one communication path for the industrial network overlay between at least two devices.

Abstract: In one embodiment, a virtual firewall is installed on a port of a device that communicates across a zone boundary within an industrial network. The virtual firewall is then configured based on operation of the industrial network, such that the port may then communicate via the firewall to a remote virtual firewall of a remote port of a remote device across the zone boundary.

Abstract: In one embodiment, a device receives control logic programmed within at least one controller included within an industrial network. The device also determines a network topology of the industrial network, and derives a network policy for the industrial network based upon, at least in part, the control logic and the network topology.

Abstract: In one embodiment, a system and method are disclosed for receiving a request for authorization to commission a target device based, at least in part, on a plurality of requested commissioning actions; determining whether each of the requested commissioning actions is authorized; sending a commissioning authorization, which includes information identifying the one or more authorized commissioning actions; receiving a commissioning complete confirmation message, which includes information identifying one or more completed commissioning actions; validating the commissioning complete confirmation message, in order to ensure that each of the completed actions had been previously authorized; and if all of the completed commissioning actions were previously authorized, sending an acknowledgement message.

Abstract: In one embodiment, a system and method are disclosed for sending a discovery message, via a network, from a first network device. The sending is performed in response to the first network device being associated with a first machine. The method involves receiving an offer message via the network, where the offer message includes network name information that indicates a physical location of the device within a topology of the network. The method also involves using the network name information to communicate with a second network device via the network.