Abstract: In one embodiment, a server may receive both layer-2 topology information and layer-2 telemetry information from a plurality of layer-2 switches. The server may then apply behavioral learning to both the layer-2 topology information and the layer-2 telemetry information to detect layer-2 patterns that are indicative of one or more problematic layer-2 behaviors. As such, based on the behavioral learning, the server then creates predictive rules to be applied within layer-2 networks to predict the one or more problematic layer-2 behaviors. The predictive rules may then be used within a particular layer-2 network to cause i) prediction of one or more particular problematic layer-2 behaviors within the particular layer-2 network based on data from a plurality of switches within the particular layer-2 network, and ii) mitigation against the predicted one or more particular problematic layer-2 behaviors within the particular layer-2 network.

Abstract: Computing systems, devices, and associated methods of managing secure communication using hardware accelerators are disclosed herein. In one embodiment, a method includes receiving a data request from a user kernel requesting to read a message stored in a buffer. In response to receiving the data request, transmitting to a processor, data representing a request to validate content in the message. The method also includes receiving from the processor, data representing a validation result containing an indication whether the content in the message is valid and a header size of the message. When the indication indicates that the content of the message is valid, a header of the message is removed from the message according to the header size in the validation result to extract the payload and providing the extracted payload to the user kernel.

Abstract: A memory system is disclosed, which relates to technology for implementing data communication between memory devices. The memory system includes a plurality of memory devices and a memory controller. The memory devices allow a data packet composed of data and header information to be directly communicated between the memory devices. The memory controller transmits the data packet to a source memory device from among the plurality of memory devices, and receives the data packet from a last memory device from among the plurality of memory devices. Each of the memory devices hashes the header information such that the data is accessed, using a result of the hash, in address regions located at different positions.

Abstract: Methods and apparatus for registering and handling access violations of host memory. In one embodiment, a peripheral processor receives one or more window registers defining an extent of address space accessible from a host processor; responsive to an attempt to access an extent of address space outside of the extent of accessible address space, generates an error message; stores the error message within a violation register; and resumes operation of the peripheral processor upon clearance of the stored error message.

Abstract: The application disclose a packet processing method that includes: receiving, by a service distribution node, service routing information sent by a controller, where the service routing information includes a flow identifier, a service identifier, and a next-hop address, the flow identifier is used to identify a packet flow, the service identifier is used to identify a sequence of a service node instance that processes the packet flow, and the next-hop address is used to identify the service node instance that processes the packet flow; receiving a first packet; acquiring a first flow identifier according to the first packet, and searching the service routing information according to the first flow identifier to acquire a matched service identifier and a matched next-hop address; and sending a second packet to a first service node instance that has the matched next-hop address, which implements service processing on a packet flow.

Abstract: To enable a wireless terminal to run an application program by using resources of other apparatuses, a base station system 1 includes a plurality of base stations 100 configured to execute assigned functions, each assigned function being a part of a plurality of functions of a virtual machine executing an application program for a wireless terminal apparatus 400. The plurality of functions of the virtual machine are distributedly executed by servers 115, 125, 135 of the plurality of base stations 100.

Abstract: A message display terminal comprising at least one processor configured to: display a message object representing a message input by each of a plurality of users in a display mode that enables a user having input the message to be identified; receive a selection operation for selecting the message object; obtain message data, which is generated in response to the selection operation, relating to a second message which is determined based on a first message represented by a first message object which is the selected message object; and display a second message object representing the second message in a display mode that enables a user having conducted the selection operation to be identified as a user having input the second message based on the obtained message data.

Abstract: This disclosure relates to a method of improving switching capacity in a software-based network switch. The method may involve storing a data packet in a first local buffer, storing one or more header fields of the data packet in a second local buffer. A common identifier may be assigned to the data packet stored in the first local buffer and the one or more header fields stored in the second local buffer. The one or more header fields may be directly sent from the NIC to the CPU for the data packet processing. At least one header field of the one or more header fields may be modified by the CPU. Further, the one or more header fields may be overwritten with the at least one modified header field in the data packet stored in the first local buffer of the NIC based on the common identifier.

Abstract: An attack detection device includes: a receiver configured to receive messages that are periodically transmitted from a communication device in a network; and a processor. The processor predicts a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value. The processor counts a number of messages received by the receiver in the specified monitor range so as to generate a count value. The processor detects an attack in the network according to a result of a comparison between the predicted value and the count value.

Abstract: Control information for configuring an audiovisual device to present multimedia content according to a first service type may be generated. A method may include generating first control information for configuring an audiovisual device to decode a multimedia stream, generating first data that indicates a structure of the first control information, and transmitting the first data and the first control information. The first control information may be generated according to a first protocol version. Second data and second control information may be similarly generated and transmitted according to a second protocol version. Disclosed techniques may facilitate receiving devices to determine whether they support received wireless transmissions and decode the transmissions based on the control information.

Abstract: A method and system to improve datacenter security by configuring a security layer as a set of nano-services that are executed to service a single tenant of the datacenter such that the nano-service protects the single tenant from other entities in the datacenter and the nano-service being compromised does not compromise the security of other tenants of the datacenter. The method includes receiving a request to instantiate a virtual resource for a tenant, generating a nano-service to implement at least one security layer function for the virtual resource, and connecting the nano-service to the virtual resource and a virtual bridge in the datacenter to enable communication between the virtual resource (vR) and a network of the datacenter with the security layer function processing traffic between the virtual resource and the virtual bridge. The nano-service can be immutable once it begins execution. The security layer function can be an L2 or L3 function.

Abstract: Handling supplementary services offered in association with Internet Protocol multimedia services based on particular policies is described. In an example, server(s) can receive, from a first user device, a policy associated with handling one or more communications directed to a particular identifier. The server(s) can subsequently receive a communication from a second user device, the communication being associated with a header identifying the particular identifier as the intended recipient of the communication. The server(s) can determine whether the policy is to be applied to the communication and, based at least partly on determining that the policy is to be applied to the communication, the server(s) can update the header based at least in part on the policy. The server(s) can transmit the communication based at least in part on the header, thereby transmitting the communication pursuant to the policy.

Abstract: Embodiments of a multi-processor array are disclosed that may include a plurality of processors and configurable communication elements coupled together in a interspersed arrangement. Each configurable communication element may include a local memory and a plurality of routing engines. The local memory may be coupled to a subset of the plurality of processors. Each routing engine may be configured to receive one or more messages from a plurality of sources, assign each received message to a given destination of a plurality of destinations dependent upon configuration information, and forward each message to assigned destination. The plurality of destinations may include the local memory, and routing engines included in a subset of the plurality of configurable communication elements.

Abstract: One embodiment provides a system that facilitates routable prefix queries in a CCN. During operation, the system generates, by a client computing device, a query for one or more indices based on a name for an interest, wherein a name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level. An index indicates a number of the contiguous name components beginning from the most general level that represent a routable prefix needed to route the interest to a content producing device that can satisfy the interest. In response to the query, the system receives the one or more indices, which allows the client computing device to determine a remaining number of name components of the interest name which can be encrypted, thereby facilitating protection of private communication in a content centric network.

Abstract: Methods and systems are provided for latency-oriented router. An incoming packet is received on a first interface. The type of the incoming packet is determined. Upon the detection that the incoming packet belongs to latency-critical traffic, the incoming packet is duplicated into one or more copies. Subsequently, the duplicated copies are sent to a second interface in a delayed fashion where the duplicated copies are spread over a time period. The duplicated copies are received and processed at the second interface.

Abstract: Methods, devices, and systems for mapping transport segment labels to packet network endpoints using a mapping server. In some implementations, an end point address in an edge domain is received from an edge router, a mapping of one of the end point address to a transport segment label is received from a network device, the mapping is stored in a non-transitory memory device, and the mapping is transmitted to the edge router.

Abstract: Provided are techniques for interactive adjustment of decision rules. A modified decision rule with one or more decision rule conditions is received for adjusting an original decision tree, wherein at least one of the decision rule conditions has been modified. A decision rule condition that has been modified and a corresponding decision tree node of the original decision tree are selected. Data records from a database are selected for a parent node of the corresponding decision tree node. The selected data records that match the decision rule condition are filtered. A sub-tree is generated using the filtered data records with a first splitting variable from the modified decision rule condition. An original sub-tree is replaced with the generated sub-tree and the decision rule condition to form an adjusted decision tree. The adjusted decision tree is used to predict a value of a target variable based on available predictors.

Abstract: Described herein are systems, devices, methods, computer-readable media, techniques, and methodologies for cloud-to-edge data flow migration. More specifically, example embodiments relate to migrating at least a portion of cloud-based data processing functionality from a cloud environment to network edge environment. The functionality can be migrated to anywhere along the network edge. Input data received or generated at a network edge device may be classified according to one or more classification criteria. At least a portion of cloud-based data processing functionality may then be selected for migration to the network edge based at least in part on the classified input data and/or one or more network characteristics. After migration, at least a portion of the input data may be processed by the migrated functionality. The input data processed at the network edge may then be sent to the cloud environment for additional processing by cloud-based data processing functionality.

Abstract: Migration of partially completed instructions. A determination is made that processing of an operation of an instruction executing on a processor has been interrupted prior to completion. The instruction is re-executed on a selected processor to resume forward processing of the instruction. The re-executing includes determining whether model-dependent metadata is to be used by the selected processor in re-executing the instruction. Based on determining the model-dependent metadata is to be used, the model-dependent metadata is used in re-executing the instruction. Based on determining the model-dependent metadata is not to be used, proceeding with re-executing the instruction without using the model-dependent metadata.

Abstract: Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network to forward the ingress traffic to a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of a computing resource hosted in the logically isolated network. The edge routing device may identify the route in the route table to override the destination in the network packet with the network appliance and forward the network packet to the network appliance according to the route.

Abstract: Source routing techniques include sending data across several networks, while limiting source routing overhead. For example, the source routing techniques may use a first address format to route data to nodes along a routing path that are within a first network where a source node is located, and use a second address format to route the data to a node along the routing path that is within a second, different network. The node in the second network may similarly route the data through the second network using the first address format for nodes within the second network and, if needed, route the data to a node within a third network using the second address format. This may be repeated for any number of networks to reach a destination.

Abstract: In accordance with one or more preferred implementations, an overlay network in the form of a dispersive virtual network is implemented utilizing data deflects to implement and facilitate routing in a data plane and call processing deflects to implement and facilitate routing in a control plane. Various nodes in the dispersive virtual network, such as end devices running dispersive virtual networking client software, establish communication channels to these deflects running dispersive virtual networking protocols transported by user datagram protocol (UDP) frames, transmission control protocol (TCP) streams, and hypertext transfer protocol (HTTP) streams.

Abstract: In a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, a method comprises provisioning at least a given one of the first and second security edge protection proxy elements with configuration information that enables the given security edge protection proxy element to identify at least one security operation to be applied to at least one information element in a received message before sending the message to the other one of the first and second security edge protection proxy elements.

Abstract: A network provisioning device comprises an administrative interface for instantiating a virtual circuit definition to communicatively couple a set of endpoint devices in a network fabric, and a virtual circuit constructor. The virtual circuit constructor converts the virtual circuit definition into Layer-2 provisioning commands, selects a target set of networking nodes that connect to the endpoint devices, and transmits the Layer-2 provisioning commands to the target set of networking nodes. VXLAN virtual circuit provisioning in the target set of networking nodes establishes a VXLAN circuit to communicatively couple the endpoint devices.

Abstract: An encoder apparatus includes an encoder input, an encoder output, and processing circuitry. The encoder input may receive at least native video data. The encoder output may transmit Ethernet frames. The processing circuitry may be operably coupled to the encoder input and encoder output. The processing circuitry may be configured to receive a video frame of native video data from the encoder input. The processing circuitry may be further configured to generate an Ethernet frame including a video segment of the video frame. The processing circuitry may still further be configured to transmit the Ethernet frame including the video segment using the encoder output.

Abstract: One embodiment of the present invention relates to a method by which a terminal transmits and receives a vehicle to everything (V2X) related signal in a wireless communication system, comprising the steps of: selecting a resource pool by comparing at least one piece of measurement information with a resource pool parameter; and transmitting data by using the resource pool, wherein the at least one piece of measurement information is related to a geographical location of the terminal.

Abstract: A method for communication includes configuring a router to forward data packets in a network in accordance with MPLS labels appended to the packets. A group of two or more of the interfaces is defined as a multi-path routing group in a forwarding table within the router. A plurality of records are stored in an ILM in the router, corresponding to different, respective label IDs, all pointing to the set of the entries in the forwarding table that belong to the multi-path routing group. Upon receiving in the router an incoming data packet having a label ID corresponding to any given record in the plurality, one of the interfaces in the group is selected, responsively to the given record and to the set of the entries in the forwarding table to which the given record points, for forwarding the incoming data packet without changing the label ID.

Abstract: In the present invention, unauthorized access from outside a facility to a device disposed inside the facility is detected by effectively using the output from a mirror port of a network switch. A gateway device has: a monitored data acquisition unit for saving in a monitored data storage unit, as monitored data, packet data that is outputted from a mirror port of a switch, the packet data being outputted from a device being monitored; an unauthorized access detection unit for detecting unauthorized access by determining whether the monitored data is abnormal on the basis of a comparison between the monitored data and assessment rules; and an unauthorized access notification unit for notifying a server of a monitoring center, which is connected to an external network via an external communication unit, that unauthorized access has been detected.

Abstract: Internet-of-Things messages can be transported, encoded and decoded using inventive source and destination attribute labels.

Abstract: A system and method for implementing functionality within a network on behalf of first and second devices communicating with each other through the network. A front-end device is provided within the network that communicates data traffic with the first device. A back-end device is also implemented within the network and communicates data traffic with the second device. A communication channel couples the front-end device and the back-end device. Data traffic may be encoded into a different type or protocol for transport through the communication channel by the front-end device and back-end device. The front-end device and back-end device exchange quality of service information and may alter characteristics of the data traffic through the communication channel according to the quality of service information.

Abstract: Disclosed is a display device connection method for rapidly delivering data to a plurality of display devices. A peer-to-peer (P2P) overlay network including the plurality of display devices as member peers is configured to distribute content. In this case, an overlay management server (OMS) connects first member peers through a network as a tree topology using a source peer providing the content as a root node, and transmits fragments of the content to a child peer based on a number of peers to which each of the member peers is capable of transmitting the fragments of the content for a preset period of time, and the source peer directly transmits the fragments of the content to a second member peer that is not included in the tree topology among the member peers based on a predetermined limit on a hop count.

Abstract: Described herein are systems, methods, and software to enhance connectivity between cloud computing service endpoints and virtual machines. In one implementation, a method of managing data packet addressing in a first namespace includes receiving a data packet at a first interface for the first namespace, wherein the first interface is paired with a second interface of a second namespace. The method also includes identifying if the packet is destined for a service node in an underlay network outside of an overlay network for the second namespace, and if destined for a service node outside of an overlay network for the second namespace, modifying addressing in the data packet to support the underlay network and transferring the data packet over a virtual network interface for the virtual machine.

Abstract: A network system includes a communication apparatus, and a control apparatus configured to control the communication apparatus. The communication apparatus includes a memory configured to store program instructions, and a processor configured to execute the instructions to receive an address of a destination virtual machine from the control apparatus, receive a packet from a source virtual machine, identify, based on the address of the destination virtual machine corresponding to the received packet, an identifier of an edge node connected to the destination virtual machine, and add the identifier of the edge node to the received packet.

Abstract: An example communications device may include communication ports and processing circuitry. The communications device may, when the communication device and peer network nodes are connected in a ring topology to form an access network, detect that a loop exists between the access network and a customer network. In response to detecting the loop, the communication device may automatically block any uplink to the customer network that the communication device may have, and send a message to all of the peer network nodes instructing them to block any uplinks to the customer network they may have.

Abstract: A method for providing a visual representation of data stored in a database may include generating a graphic user interface configured to receive inputs for constructing a hierarchical measure based on the data stored in the database. An indication to add, to the hierarchical measure, a first measure and a second measure may be received via the graphic user interface. In response to the indication, the hierarchical measure may be constructed to include, based on the first measure being added prior to the second measure, the first measure as a parent measure and the second measure as a child measure. A first value of the first measure may correspond to an aggregate of at least a second value of the second measure. The graphic user interface may be updated to provide a visual representation of the hierarchical measure. Related systems and articles of manufacture are also provided.

Abstract: Network architectures and methods including addressing and dynamic network topology construction schemes that guarantee maximally efficient and scalable routing are disclosed herein. The network architectures and methods introduce a new approach to network design. The network architectures and methods include an addressing scheme based on geographic position of network nodes, and a network topology construction scheme based on the addressing scheme and that can reproduce properties of the existing Internet topology. A routing algorithm for the network architecture is shown to be maximally scalable and efficient. According to an example embodiment, a network includes a plurality of nodes, where each node has a network address based on a latitude of a location of the node, a longitude of the location of the node, and a centrality of the location of the node.

Abstract: In general, embodiments relate to a method for processing packets in a network. The method includes receiving, by a first network element, a route comprising a first loopback address (LBA) associated with a second network element, and a loopback network layer reachability information (loopback NLRI) specifying the LBA and a plurality of interfaces on the second network element associated with the LBA. The method further includes receiving, by the first network element, a packet, making a first determination that the LBA is a next hop for the packet, based on the first determination, selecting a first interface of the plurality of interfaces, transmitting the packet towards the first interface.

Abstract: Methods and systems for transmitting data packets through a selected connection that the first data packet of a data session satisfies a match condition. The match condition is received through a user interface. When data packets of the data session are received, the data packets will then be transmitted through a selected connection. The selected connection is selected from connections based on a connection selection criteria. Further differentiated services code point (DSCP) of first data packet is changed when sent by a computing device. After a network node receives the first data packet, then resets the DSCP value before sending the first data packet.

Abstract: For a multi-tenant environment, some embodiments of the invention provide a novel method for forwarding tenant traffic through a set of service machines to perform a set of service operations on the tenant traffic. In some embodiments, the method performs a classification operation on a data message flow of a tenant, in order to identify a set of service operations to perform on the data message flow. For some data message flows, the classification operation selects the identified set of service operations from several candidate sets of service operations that are viable service operation sets for similar data message flows of the tenant. In some embodiments, the classification operation is based on a set of attributes associated with the data message flow (e.g., five tuple identifier, i.e., protocol and source and destination ports and IP addresses).

Abstract: The present teaching generally relates to providing optimized access control rules. A request may be received from a client device. A determination may be made, based on the request, that an update is needed for access control rule information for the client device. Rule data may be generated. The rule data may include a plurality of data buckets each including one or more access control rules, each data bucket of the plurality being associated with a range of destination port numbers, and where each of the one or more access control rules comprise a set of tuples having a common source network and source port number, and one or more destination port numbers associated with the common source network and source port number. The rule data may be sent to the client device.

Abstract: A service function chain (SFC) path selection method. The disclosed method receives an SFC request for scheduling an SFC, rearranges SFC with respect to workload of service function forwarders (SFFs) utilized in the SFC while conforming to SFC arrangement rules concluded from a history of deployed SFC. The SFC arrangement rules may be created from machine learning processes or manually created by an administrator.

Abstract: A system and a method for prioritizing network traffic using application awareness and network awareness in a network environment is disclosed. An exemplary method can include receiving a network traffic priority for network traffic associated with a job performed by a distributed application; and based on the network traffic priority, assigning the network traffic to a network classification model, such as an access control list, associated with a network element for directing the network traffic in a network. The network classification model is associated with a network traffic priority class having defined quality of service (QoS) features, such that the network traffic traverses the network according to the defined QoS features.

Abstract: The present disclosure relates to a relay UE for relaying protocol data units between a remote UE and a radio base station. A control packet is received by the relay UE from the remote UE via a first sidelink bearer, comprising a priority indication associated with protocol data units transmitted by the remote user equipment via the first sidelink bearer. The relay UE stores an association between the priority indication and a radio bearer used by the relay UE to relay the protocol data packets. The relay UE determines, based on the stored association, the priority according to which a protocol data unit, received from the base station via the first radio bearer, should be transmitted to the remote UE, and relays the received protocol data unit to the remote user equipment using a second sidelink bearer that corresponds to the determined priority.

Abstract: A device may receive a message from a source. The device may send, to a server device, a request for classification information that identifies a classification of the message after receiving the message. The device may receive a response message to the request for the classification information after sending the request. The response message may include the classification information identifying the classification. The device may dynamically provide the message to a channel based on the classification identified by the classification information after receiving the response message.

Abstract: In an embodiment, a method of payload matching via a single pass transformation of an HTTP payload includes receiving a payload packet destined for a recipient and parsing the payload packet in a single scan of the packet using a combined regular expression. The combined regular expression includes a plurality of regular expressions that correspond to a set of replacement rules. The method includes determining a scatter-gather list conforming to the rule, constructing a new payload packet based on the scatter-gather list, and sending the new payload packet to the recipient.

Abstract: A software defined network (SDN)-based network management apparatus includes: an SDN controller including a first management unit to store a plurality of heterogeneous protocol information items, and an SDN switch controlled by the SDN controller and including a second management unit to store at least one heterogeneous protocol information item acquired from the SDN controller and a gateway to communicate with a vehicle network. In particular, upon receiving a packet corresponding to a new protocol that has not been used for access, from an external source, the SDN switch sends a request to the SDN controller for analysis of the received packet, and the SDN controller forwards protocol information corresponding to the received packet among the plurality of heterogeneous information items stored in the first management unit, to the SDN switch.

Abstract: In one embodiment, an electronic device maintains one or more tunnel-based overlays for a communication network. The communication network includes two or more physical provider networks. The device maintains a mapping between a particular application and the one or more overlays for the communication network. The device adjusts the mapping between the particular application and the one or more overlays for the communication network. The device causes one or more routers in the communication network to route traffic for the particular application according to the adjusted mapping between the application and the one or more overlays for the communication network.

Abstract: A method of suppressing ARP packets in a logical network comprising a set of data compute nodes (DCNs). The DCNs are hosted on a set of physical hosts. Each DCN has a protocol address and is connected to a forwarding elements (FE) on the corresponding host. Each FE has a set of flows that specifies a set of conditions to match a set of fields of each received packet and a set of actions to take on a packet that matches the set of conditions. An FE on a physical host receives a packet sent by a first DCN on the physical host and determines that the received packet is an ARP request packet by matching a set of fields in the packet with a set of conditions of a particular flow. The ARP request packet identifies a protocol address of a second DCN on the logical network.

Abstract: Systems, methods, and computer-readable media for flow stitching network traffic flow segments across middleboxes. A method can include collecting flow records of traffic flow segments at a first middlebox and a second middlebox in a network environment including one or more transaction identifiers assigned to the traffic flow segments. Sources and destinations of the traffic flow segments can be identified with respect to the first middlebox and the second middlebox. Corresponding subsets of the traffic flow segments can be stitched together to from a first stitched traffic flow at the first middlebox and a second stitched traffic flow at the second middlebox. The first and second stitched traffic flows can be stitched together to form a cross-middlebox stitched traffic flow across the first middlebox and the second middlebox. The cross-middlebox stitched traffic flow can be incorporated as part of network traffic data for the network environment.

Abstract: The present disclosure discloses a flow specification (FlowSpec) message processing method. In the method, a controller forwards device interface information reported by the forwarding device; selects at least one forwarding device interface to which a FlowSpec rule needs to be applied from the received forwarding device interface information; generates an application interface rule based on the at least one forwarding device interface to which the FlowSpec rule needs to be applied; and sends a FlowSpec message to the forwarding device.