Abstract: A packet sorting and reassembly circuit module, including a header parser, an information processing circuit, at least one state tracking and reassembly circuit, and an output arbiter, is provided. The header parser is configured to analyze multiple first packet segments to obtain header information corresponding to a first network packet, wherein the first network packet is transmitted based on a transmission control protocol (TCP) communication protocol. The information processing circuit is configured to transmit the first packet segments and sideband information corresponding to the first packet segments to a first state tracking and reassembly circuit among the at least one state tracking and reassembly circuit according to the header information. The first state tracking and reassembly circuit is configured to reassemble and sort the first packet segments according to the sideband information. The output arbiter is configured to output the first packet segments according to a sorting result.

Abstract: A packet sorting and reassembly circuit module, including a header parser, an information processing circuit, at least one state tracking and reassembly circuit, and an output arbiter, is provided. The header parser is configured to analyze multiple first packet segments to obtain header information corresponding to a first network packet, wherein the first network packet is transmitted based on a transmission control protocol (TCP) communication protocol. The information processing circuit is configured to transmit the first packet segments and sideband information corresponding to the first packet segments to a first state tracking and reassembly circuit among the at least one state tracking and reassembly circuit according to the header information. The first state tracking and reassembly circuit is configured to reassemble and sort the first packet segments according to the sideband information. The output arbiter is configured to output the first packet segments according to a sorting result.

Abstract: A packet information analysis method and a network traffic monitoring device are disclosed. The method includes the following. Network flow data including a plurality of network packets is obtained. An index parameter is generated according to packet information (e.g., header information) of the first network packet among the network flow. A target mapping model is determined from a plurality of candidate mapping models according to the index parameter. The index parameter is between a first sampling point and a second sampling point of the target mapping model. An interpolation mapping value is obtained according to the index parameter, the first sampling point, the second sampling point, and the target mapping model. An evaluation value is obtained according to the interpolation mapping value. The evaluation value reflects a distribution status of a monitoring item in the network traffic flows.

Abstract: A packet information analysis method and a network traffic monitoring device are disclosed. The method includes the following. Network flow data including a plurality of network packets is obtained. An index parameter is generated according to packet information (e.g., header information) of the first network packet among the network flow. A target mapping model is determined from a plurality of candidate mapping models according to the index parameter. The index parameter is between a first sampling point and a second sampling point of the target mapping model. An interpolation mapping value is obtained according to the index parameter, the first sampling point, the second sampling point, and the target mapping model. An evaluation value is obtained according to the interpolation mapping value. The evaluation value reflects a distribution status of a monitoring item in the network traffic flows.

Abstract: A packet information analysis method suitable for a device measuring and monitoring network traffic in real-time. The method includes: obtaining network data including a combination of multiple network packet header information; generating an index parameter according to packet header information of a monitored network packet in the network packets; querying at least one reference table according to the index parameter to obtain a first reference value and an offset correction value corresponding to the index parameter in the at least one reference table; obtaining a second reference value according to the first reference value and the offset value; and obtaining an evaluation value according to the second reference value. The evaluation value reflects the distribution status of a measuring and monitoring item in the network packets.

Abstract: A packet information analysis method suitable for a device measuring and monitoring network traffic in real-time. The method includes: obtaining network data including a combination of multiple network packet header information; generating an index parameter according to packet header information of a monitored network packet in the network packets; querying at least one reference table according to the index parameter to obtain a first reference value and an offset correction value corresponding to the index parameter in the at least one reference table; obtaining a second reference value according to the first reference value and the offset value; and obtaining an evaluation value according to the second reference value. The evaluation value reflects the distribution status of a measuring and monitoring item in the network packets.

Abstract: An automatic protocol test method by reverse engineering from packet traces to extended finite state machine is disclosed. The method includes following steps: parsing the plurality of packets to extract a plurality of sessions; conducting a keyword analysis and a clustering algorithm to obtain protocol messages; initializing the protocol messages and merging equivalent states to obtain a finite state machine; extracting fields and values of the protocol messages to obtain a plurality of sub-datasets and adding a data guard and set of memories on the finite state machine to obtain the extended finite state machine.

Abstract: An automatic protocol test method by reverse engineering from packet traces to extended finite state machine is disclosed. The method includes following steps: parsing the plurality of packets to extract a plurality of sessions; conducting a keyword analysis and a clustering algorithm to obtain protocol messages; initializing the protocol messages and merging equivalent states to obtain a finite state machine; extracting fields and values of the protocol messages to obtain a plurality of sub-datasets and adding a data guard and set of memories on the finite state machine to obtain the extended finite state machine.

Abstract: A method of cable sensing data collection applicable to an electronic apparatus having a counter array is provided. The electronic apparatus is for detecting a cable including a plurality of sensors and a plurality of RFID tags, where each of the RFID tags is used to receive cable sensing data of the cable obtained by the sensors. The method includes: scanning each of the RFID tags to retrieve the cable sensing data, where the cable sensing data includes a tag identifier of the RFID tag; converting the tag identifier to a plurality of array addresses through a plurality of hash functions; and transmitting the cable sensing data to a cloud platform according to whether a plurality of elements of the array addresses in the counter array having a zero or not. In addition, an electronic and a chip using the method are also provided.

Abstract: An embodiment of the invention provides a heavy network flow detection method for a software-defined networking (SDN) switch. The method includes: receiving a network packet through a network interface; analyzing the network packet to obtain routing information of the network packet; performing a plurality of hash calculations for the routing information to generate a plurality of index values, and updating a plurality of counting values in a plurality of hash tables according to the index values; obtaining a flow-amount evaluation value corresponding to the routing information according to the counting values; and identifying that the network packet belongs to a heavy network flow if the flow-amount evaluation value is larger than a threshold value.

Abstract: It is a challenge task to conduct Entropy computation on the attributes of packet header in high-speed networks. Motivated by Ashwin Lall et al., we present a stream-based scheme to estimate to the entropy norm based on Count Sketch algorithm. The system is implemented on a NetFPGA-10G platform. It is capable of processing IP packets and computing the entropy in 30 Gbps line rate.

Abstract: It is a challenge task to conduct Entropy computation on the attributes of packet header in high-speed networks. Motivated by Ashwin Lall et al., we present a stream-based scheme to estimate to the entropy norm based on Count Sketch algorithm. The system is implemented on a NetFPGA-10G platform. It is capable of processing IP packets and computing the entropy in 30 Gbps line rate.

Abstract: A network flow abnormality detection system and method for detecting at least one network packet to determine whether a flow condition of the network packet is abnormal. The network packet includes L bit data element values. The method is fetching M data element values in above-mentioned L bit data element values by data element value fetch unit, wherein M is an odd number and larger than 1; N parallel processing units receive and process above-mentioned M data element values; comparison module compares above-mentioned M data element values and a standard threshold to generate M comparison result values; sum unit sums above-mentioned M comparison result values to obtain a comparison sum value; determination unit compares the comparison sum value and an abnormality threshold, wherein when the comparison sum value is larger than the abnormality threshold, the determination unit determines the flow condition is abnormal.

Abstract: A network flow abnormality detection system and method for detecting at least one network packet to determine whether a flow condition of the network packet is abnormal. The network packet includes L bit data element values. The method is fetching M data element values in above-mentioned L bit data element values by data element value fetch unit, wherein M is an odd number and larger than 1; N parallel processing units receive and process above-mentioned M data element values; comparison module compares above-mentioned M data element values and a standard threshold to generate M comparison result values; sum unit sums above-mentioned M comparison result values to obtain a comparison sum value; determination unit compares the comparison sum value and an abnormality threshold, wherein when the comparison sum value is larger than the abnormality threshold, the determination unit determines the flow condition is abnormal.