Abstract: We propose a method for predicting a port number of a NAT equipment according to results of inquiring a STUN server twice in this invention. A network terminal device A in a private network sends an inquiry packet to the STUN server before and after sending a hole punching request, acquires two endpoint mappings of the NAT equipment used respectively in the two inquiries from the STUN server, and delivers the endpoint mappings to another network terminal device B in another private network through a SIP server. The network terminal device B predicts a range of port numbers of the NAT equipment probably used when the hole punching request was sent, according to the endpoint mappings and a port differential of the NAT equipment, and sends packets to the predicted port numbers sequentially until a response packet is received from the network terminal device A. Hence, a connection channel is established.

Abstract: A machine-implemented method for determining whether a to-be-analyzed software is a known malware or a variant of the known malware includes the steps of: (A) configuring a processor to execute the to-be-analyzed software, and obtain a to-be-analyzed system call sequence that corresponds to the to-be-analyzed software with reference to a plurality of system calls made in sequence as a result of executing the to-be-analyzed software; (B) configuring the processor to determine a degree of similarity between the to-be-analyzed system call sequence and a reference system call sequence that corresponds to the known malware; and (C) configuring the processor to determine that the to-be-analyzed software is neither the known malware nor a variant of the known malware when the degree of similarity determined in step (B) is not greater than a predefined similarity threshold value.

Abstract: A recording, recovering, and replaying method for real traffic is used for processing a plurality of network packets of a plurality of network connections. A recording procedure of the method includes the following steps. A recording parameter (N, M, P) is received. A header and a payload of each network packet of the network connections are completely recorded, and a payload accumulation value of each network connection is accumulated. When one of the payload accumulation values exceeds N, the header of each network packet and first M bytes of the payload are recorded for P consecutive network packets corresponding to the payload accumulation value. When one of the payload accumulation values exceeds N and after the P consecutive network packets of the network connection corresponding to the payload accumulation value are recorded, the header of each network packet is recorded for the network connection corresponding to the payload accumulation value.

Abstract: A frame-merging method is adapted for a network that includes mesh and terminal units, in which any two units capable of communication form a communication pair, and one of the units operates as a key unit to transmit pending frames according to the frame-merging method. The frame-merging method includes: determining whether the key unit is a mesh or a terminal unit; for the communication pair recorded in each pending frame, selecting a suitable scheme from a plurality of frame-merging schemes, and extracting at least one of the pending frames from among the pending frames for use as part or all of a priority frame set; and comparing a total size of all frames included in the priority frame set with a suitable frame size, so as to determine whether the key unit is to send an aggregated frame. A frame-merging apparatus is also disclosed.

Abstract: We propose a method for predicting a port number of a NAT equipment according to results of inquiring a STUN server twice in this invention. A network terminal device A in a private network sends an inquiry packet to the STUN server before and after sending a hole punching request, acquires two endpoint mappings of the NAT equipment used respectively in the two inquiries from the STUN server, and delivers the endpoint mappings to another network terminal device B in another private network through a SIP server. The network terminal device B predicts a range of port numbers of the NAT equipment probably used when the hole punching request was sent, according to the endpoint mappings and a port differential of the NAT equipment, and sends packets to the predicted port numbers sequentially until a response packet is received from the network terminal device A. Hence, a connection channel is established.

Abstract: A channel utilizing method for a wireless network is adapted for channel utilization by a switch node having a number (N) of transceivers in an environment with a number (M) of channels, wherein (N)<(M). The channel utilizing method includes the steps of: calculating a channel weight set, and selecting one of the (M) channels according to the channel weight set; determining a notify mechanism according to a relation between the switch node and a neighbor node; using the notify mechanism to notify the neighbor node of a current state of the switch node; and calculating a channel stay-in period, and causing the switch node to stay in the selected one of the channels for a duration of the channel stay-in period. A channel utilizing system is also disclosed.

Abstract: A string matching system includes a text string, a plurality of patterns, an m-byte search window and a plurality of Bloom filters, wherein the m-byte search window stands for an m-byte sub-string in the text string under inspection. Every Bloom filter comprises sub-strings of a plurality of patterns. These Bloom filters are queried for membership of the rightmost block in the search window to determine the shift length. The acceleration efficiency of matching many bytes can be achieved simultaneously by shifting the search window for many bytes. Meanwhile, the patterns are stored into an embedded memory through a memory-efficient mechanism —the Bloom filter.

Abstract: An identification and administration system applied to P2P gateway and a method for the same are proposed. The system is installed in a kernel space, and a plug-in kernel module is in the kernel space to finish preprocessing and application processing of packets on the kernel space without the need of copying data to the user space for processing. Moreover, a connection cache is provided in the kernel space to process source/destination IP addresses, connection ports and protocol identifiers of all packets to recognize and then block identical request packets in reconnections. Therefore, the throughput of content-level security gateway can be increased, and the processing efficiency of packets can also be enhanced.

Abstract: A string matching system includes a text string, a plurality of patterns, an m-byte search window and a plurality of Bloom filters, wherein the m-byte search window stands for an m-byte sub-string in the text string under inspection. Every Bloom filter comprises sub-strings of a plurality of patterns. These Bloom filters are queried for membership of the rightmost block in the search window to determine the shift length. The acceleration efficiency of matching many bytes can be achieved simultaneously by shifting the search window for many bytes. Meanwhile, the patterns are stored into an embedded memory through a memory-efficient mechanism-the Bloom filter.

Abstract: An apparatus, a system and a method for stream-based data filtering are disclosed. The apparatus is for filtering data transmitted from a sending end. The data is transmitted one by one by using a plurality of data segments. The data filtering apparatus includes a receiving module, a processing module and a transmission module. The receiving module is for receiving the data segments transmitted from the sending end. The processing module implements virus scanning for the data segments one by one. The transmission module then transmits the data segments which have passed through the virus scanning to a receiving end.

Abstract: A duplex aware adaptive playout method includes detecting a packet communication mode as either a full-duplex mode or a half-duplex mode, calculating a playout delay for a current packet based on the detected packet communication mode, and delaying playout of the current packet by the calculated playout delay. When the packet communication mode is detected to be the half-duplex mode, the calculated playout delay for the current packet is set longer than when the packet communication mode is detected to be the full-duplex mode. A duplex aware adaptive communications device includes a playout buffer, a playout controller, a network delay estimator, and an active detector that detects a packet communication mode. The playout controller determines playout delays of packets in the playout buffer from estimated network delays and a detected packet communication mode being a full-duplex mode or a half-duplex mode.

Abstract: A codec aware adaptive playout method estimates playout delays for a current packet based on a loss mean opinion score (LMOS), a delay mean opinion score (DMOS), and a mean mean opinion score (MMOS) of packets with reference to the codec used in voice over Internet protocol (VoIP), streaming audio, and streaming video transmissions. The method selects an estimated playout delay having an optimum MMOS, or playout quality, from the plurality of estimated playout delays, and delays the playout of the current packet by the selected estimated playout delay. A codec aware adaptive playout device includes a playout controller for controlling playout of packets in a playout buffer. The playout controller references network delay estimates provided by a network delay estimator, and codec information such as the LMOS, DMOS, and MMOS provided by a codec detector to determine playout delays for the packets of the playout buffer.

Abstract: Apparatus and method use pre-order queuing and scheduling. Reordering of the transmission sequence of packets that could be sent out in one round is allowed according to the quantum consumption status of the flow within the round. Per-packet time complexity is maintained independent from an increase in flow number and packets of variable-length are processed.

Abstract: A system for providing differentiated service by using category/resource scheduling and the method thereof are provided. The system and the method are mainly used in the Internet environment, and apply computer executable programs executed at relay points or in a servo system to schedule the processes of external requests according to classified categories of and resources consumed by the external requests when the servo system receives the external requests from the Internet. The time points when individual external requests are released to the servo system to be processed are determined by the category weight corresponding to each external request, the proportion of resource consumed by each external request, and the capacity of available resources in the servo system.

Abstract: A method for objective playout quality measurement of a packet based network transmission includes determining a normalized total delay of a packet for playout and assigning a corresponding delay mean opinion score (DMOS) to the packet, then further determining a normalized packet loss rate of the packet and assigning a corresponding loss mean opinion score (LMOS) to the packet. The method includes averaging the DMOS and the LMOS to determine a mean mean opinion score (MMOS) of the packet and outputting the MMOS of the packet to a display device. The DMOS and LMOS can be assigned referencing continuous modeling equations or can be assigned referencing discrete value lookup tables. The method is performed by a processor.

Abstract: A system and a method of request scheduling for differentiated quality of services at an intermediary are provided. An intermediary located between clients and a server is used to schedule requests from the clients in the Internet. The intermediary classifies the requests and decides resources required for each request according to the administrative policies. Then the intermediary decides the order and the time the requests being transferred to the server by the size of the responses corresponding to the requests, window control and server loading. Therefore, the system is transparent to clients and servers and is capable of high compatibility with other systems.

Abstract: The present invention provides a method of web content filtering, which can be applied to gateway devices at client ends. When an access request for a web page from a browser is sent, by analyzing the web page content returned from the web site, we can decide whether the page is allowed or not, by early blocking and early bypassing algorithms. It allows making the decision as early as we have enough confidence that the web content should belong to some forbidden category or a normal one. Therefore, the web content determination speed can be improved and users' waiting time can be reduced. Moreover, by the present method, the network gateway devices will be allowed to analyze more web content.

Abstract: The present invention provides a method of web content filtering, which can be applied to gateway devices at client ends. When an access request for a web page from a browser is sent, by analyzing the web page content returned from the web site, we can decide whether the page is allowed or not, by early blocking and early bypassing algorithms. It allows making the decision as early as we have enough confidence that the web content should belong to some forbidden category or a normal one. Therefore, the web content determination speed can be improved and users' waiting time can be reduced. Moreover, by the present method, the network gateway devices will be allowed to analyze more web content.

Abstract: A system for network address port translation. The system comprises a storage device and a translation module. The storage device stores a plurality of private address tables and a private port table, wherein each private address table and private port table comprises at least one entry, and each entry is assigned an index number. The translation module, connected to the storage device, receives a private IP address and a private port number, wherein the private IP address comprises a plurality of private address subsets, stores the private address subsets and private port number as entries in the private address tables and the private port table, respectively, and translates the private IP address and port number to and from a public port number, wherein the public port number comprises a plurality of public port subsets corresponding to the index numbers in the private address tables and the private port table.

Abstract: A method of optimal contention region allocation for medium access control in multipoint-to-point networks, and in particular a method of obtaining optimal contention region allocation so that to achieve optimal throughput. The method establishes an optimal table so that the object of optimal allocation to reduce collision for medium access in multipoint-to-point networks can be achieved. Based on the aspects of present invention, optimal throughput can be achieved, thus reducing the wastage of bandwidth.