Abstract: Automated, intelligent selection of regions for cloud-based firewall deployment and scaling of firewalls down to as few as zero in a cloud region is described herein. The service collects and evaluates Usage metrics pertaining to firewalls deployed in each region are collected and evaluated to determine whether to scale firewalls in a region up or down. Scaling down of firewalls to zero is conditioned on at least one other region having a firewall(s) available for traffic inspection such that the number of total firewalls available for inspection of network traffic is at least one at any given time. When scaling up through deployment of additional firewalls, if endpoint devices located near a region in which a firewall is not available contribute substantially to firewall usage in another region, the region nearest to those endpoint devices is determined and selected for deployment of the additional firewalls.

Abstract: Apparatuses and methods for providing and interpreting command packets for direct control of memory channels are disclosed herein. An example apparatus includes flash memories configured into channels and a controller coupled to the flash memories. The controller receives packets and interpret the packets based at least on a first protocol, and determines whether any packets are linked based on a link identifier included in a block of each packet. The controller arranges the subset of packets based on an index included in the block of each packet of the subset of packets, and the subset of packets are arranged in order based on the respective indexes. A target flash memory and a target channel are determined by the controller based on flash memory and channel identifiers included in the block of each of the packet of the subset of packets.

Abstract: A network device may receive, from a transmission network device, a link state message associated with an origination network device. The network device may determine an order of a set of one-hop neighbor network devices from the transmission network device. The network device may determine, based on the link state message and the order of the set of one-hop neighbor network devices, whether the network device is to send a copy of the link state message to at least one one-hop neighbor network device of the network device. The network device may send, or refraining from sending, by the network device and based on determining whether the network device is to send the copy of the link state message to the at least one one-hop neighbor network device of the network device, the link state message to the at least one one-hop neighbor network device of the network device.

Abstract: Examples described herein relate to an interface that is to receive data for transmission and based on indication of failure of receipt of one or more packets that carry segments of the data, cause re-transmission of solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets. In some examples, the interface is to encrypt the data using an encryption engine and to segment the data for transmission using one or more packets. In some examples, the interface is to receive the data and an indication of which segment of the data to re-transmit; encrypt the data; segment the encrypted data into one or more packets; and based on the indication of which segment of the data to re-transmit, transmit solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets.

Abstract: The technologies described herein are generally directed toward monitoring file sharing commands between network equipment to identify adverse conditions. According to an embodiment, a system can comprise a processor and a memory that can enable performance of operations including monitoring resource sharing communication between first network equipment and second network equipment via a network. In one or more embodiments, the method can additionally include based on the resource sharing communication, detecting a condition of the resource sharing communication that has a likelihood of indicating a defined adverse event that has at least a threshold likelihood. Further, the method can include, but are not limited to, in response to detecting the condition, facilitating suspending the resource sharing communication between the first network equipment and the second network equipment.

Abstract: In an approach to improve internet protocol (IP) classification, embodiments of the present invention classify, by an IP classifier, a set of samples from a given IP range. Further, embodiments utilize the IP classifier to predict whether an IP address is dynamic or static and apply, by a client computer, an error-correction tree to the set of samples. Additionally, embodiments split, by the client computer, the range into two or more sub-ranges of a smaller size in response to determining a classification certainty does not exceed or is not within a predetermined threshold.

Abstract: There is provided a wireless end-user device configured to assign one of classifications to each of end-user applications to allow for a differential network access control of the end-user applications. The classifications include a background classification and a foreground classification. The differential network access control includes a service usage control policies applicable when a network service is available via a wireless modem, the service usage control policies including a first policy that allows data associated with a first end-user application of the end-user applications to be communicated via the wireless modem, and a second policy that defers the data associated with the first end-user application to be communicated via the wireless modem until a state change occurs.

Abstract: A method for initiating a private communication session by a user equipment (UE) includes: initiating, by the initiating UE, at least one private communication session with a terminating UE using a Session Initiation Protocol (SIP) INVITE message including an I_MESSAGE; and reusing, by the initiating UE, the I_MESSAGE for initiating at least one subsequent private communication session with the terminating UE.

Abstract: A data processing system includes a plurality of coherent masters, a plurality of coherent slaves, and a coherent data fabric. The coherent data fabric has upstream ports coupled to the plurality of coherent masters and downstream ports coupled to the plurality of coherent slaves for selectively routing accesses therebetween. The coherent data fabric includes a probe filter and a directory cleaner. The probe filter is associated with at least one of the downstream ports and has a plurality of entries that store information about each entry. The directory cleaner periodically scans the probe filter and selectively removes a first entry from the probe filter after the first entry is scanned.

Abstract: A vehicle-mounted apparatus includes a first processing unit that is connected to each of the plurality of vehicle-mounted ECUs and performs relay processing on the messages; a second processing unit that is connected to each of the plurality of vehicle-mounted ECUs and performs relay processing on the messages; a first routing table including a relay destination of each message to be processed at the first processing unit; and a second routing table including a relay destination of each message to be processed at the second processing unit. Each of the first processing unit and the second processing unit includes a connection unit to which wiring connected to the plurality of vehicle-mounted ECUs is connected, the first processing unit performs the relay processing based on the first routing table, and the second processing unit performs the relay processing based on the second routing table.

Abstract: An apparatus includes a memory and control circuitry. The control circuitry is configured to receive packets, which are en-route to undergo transport-layer processing in a network device in accordance with a transport protocol that requires arrival of the packets in a sequential order, to detect that one or more of the packets deviate from the sequential order, to buffer the one or more deviating packets in the memory, and, using the memory, to reorder the packets and provide the packets in the sequential order to the network device.

Abstract: A data download method, performed by a computer device. The method includes querying fog node information of a fog node corresponding to target data upon receiving a data download request for the target data, the fog node information comprising a communication protocol type of the fog node; identifying a target fog node from the fog node based on the fog node information; slicing the target data to be downloaded according to the communication protocol type of the target fog node to obtain slice information of a data slice to be downloaded; transmitting a slice download request to the target fog node corresponding to the data slice to be downloaded based on the slice information of the data slice to be downloaded; and obtaining the target data by combining the data slice returned by each target fog node in response to the corresponding slice download request.

Abstract: Data transfer for access points or switches in a cluster upon data tunnel failure is described. An example includes receiving uniform mapping information for a cluster including a bucket map mapping an active gateway and a standby gateway for each of multiple entries, the bucket map including mapping a first gateway node as a standby gateway and a second gateway node as an active gateway for an entry. Synchronized user information is received from the second gateway node including identification of a user indexed to the first entry. A message is received from a first AP or switch requesting activation of the user on the first gateway node as a standby gateway upon failure of a data tunnel between the first AP or switch and the second gateway node. The user is activated on the first gateway node.

Abstract: Examples of the present disclosure describe systems and methods for using a host DNS local cache to enable DNS resolution during network connectivity issues. In examples, a DNS request from a virtual environment executing on a host device is received by a DNS forwarder implemented within the host device. The DNS forwarder determines that a DNS resolver external to the host device is unreachable to provide a DNS response for a domain name in the DNS request. In response to determining the DNS resolver is unreachable, the DNS forwarder identifies a DNS response corresponding to the domain name within a DNS local cache implemented within the host device. The DNS forwarder provides the DNS response to the virtual environment to satisfy the DNS request.

Abstract: Provided are a method and an apparatus for switching a length of a Bidirectional Forwarding Detection (BFD) packet, and a storage medium. The method includes: in a case where a length of a current BFD packet needs to be switched to a preset length, sending a pre-switching packet independent of the current BFD packet to a second node, wherein a BFD session running in an asynchronous mode is established between a first node and the second node, and the pre-switching packet is used for notifying the second node that the length of the current BFD packet needs to be switched to the preset length; and in a case where an echo packet fed back by the second node in response to the pre-switching packet is received, performing an operation of switching the length of the current BFD packet.

Abstract: According to certain embodiments, a provisioning manager comprises an interface and processing circuitry. The interface is configured to obtain provisioning data from a provisioning database. The processing circuitry is configured to prepare one or more configuration files based on the provisioning data and provide the one or more configuration files to the one or more service instances using file distribution technology. The one or more configuration files indicate how to provision one or more service instances used in sending or receiving electronic messages.

Abstract: Data associated a plurality of user interface elements may be retrieved from at least one database associated with a service business, such as a casino. At a first time, a first indication to turn on a first subset of the plurality of user interface elements may be received. The user interface elements may include content management, task management, property management, action management, player profiling, comp management, player development, asset tagging and flagging, profitability and comparative analysis, etc. Each of the first subset of user interface elements may be populated with the respective data associated that user interface element.

Abstract: A maze-based switch generally having three functional blocks is disclosed. The first functional block handles communications by accepting an entered maze pattern from an external system controller and outputting the entered maze pattern (and optionally its directional complement) to the second functional block. The second functional block stores the maze pattern (and optionally its directional complement) to a permanent storage element and outputs the stored, entered maze pattern and its directional complement to a series of transistors in the third functional block. The third functional block is an electronic maze in which a correct maze pattern and its directional complement must be received by the transistors for the transistors to pass electrical power through the electronic maze to a connected element. The third functional block may alternatively be implemented with optical elements, optoelectronic elements, microelectromechanical elements, or elements formed by other microsystem technologies.

Abstract: A method for determining an internal time of a time-sensitive networking (TSN) network card includes generating at least one initial packet with a launch time parameter at a computing device. The computing device sends the at least one initial packet to a TSN network card for transmission and receives a transmit completion signal from the TSN network card confirming that the TSN network card transmitted the at least one initial packet. The computing device determines an approximate current internal time of the TSN network card using the launch time parameter and the received transmit completion signal.

Abstract: In one embodiment, a domain name system (DNS) server processes a DNS query based on a policy statement that is attached to the DNS query. Upon receiving the DNS query, the DNS server executes one or more commands specified in the policy statement to generate a query state. The query state controls DNS resolution behavior that the DNS server implements as part of processing the DNS query. The DNS server then performs one or more DNS resolution operations based on DNS query and the query state to generate a response. Advantageously, because the semantics of the policy statement are encapsulated within the policy statement, the policy statement enables a client to unambiguously control DNS resolution behavior. By contrast, conventional DNS resolution guidance mechanisms that rely on DNS servers to infer policies based on client data may not reflect the preferences of the clients.

Abstract: A system for the cryptographically-secure, autonomous control of devices comprising, connected to or remotely operating devices in an electrically powered network and the transaction of the benefits, costs or value created by or transacted through the devices in this electrically powered network.

Abstract: Systems, apparatuses and methods may provide for technology that detects a generic cloud service call in an application, wherein platform-specific parameters are unspecified in the cloud service call. The technology may also select a first cloud platform based on one or more performance constraints associated with the first cloud platform and automatically generate a first platform-specific service call based on the cloud service call and the first set of parameters. In one example, the technology also maps the cloud service call to the first platform-specific service call. Additionally, the technology may migrate the cloud service call to a second cloud platform without rewriting the generic cloud service call.

Abstract: A method for transmitting a model file is provided. The method includes: transmitting, in response to a target sticker triggered by a user, an algorithm acquisition request to a transmission platform of a model file, and receiving a sticker resource packet fed back by the transmission platform of the model file, where the sticker resource packet includes a target algorithm corresponding to a target sticker; determining a target model corresponding to the target algorithm according to a pre-stored correspondence table between algorithms and model files; determining whether a model file of the target model is stored locally; and transmitting a request for downloading the model file of the target model to the transmission platform of the model file, to acquire the model file of the target model, if it is determined that the model file of the target model is not stored locally.

Abstract: A network device may communicate with another network device via a media access control security (MACsec) key agreement (MKA) communication link, wherein an MKA session has been established between the network device and the other network device. The network device may determine that the other network device is unavailable. The network device may cause, based on determining that the other network device is unavailable, an MKA state of the network device to be placed in a paused state. The network device may receive, after causing the MKA state of the network device to be placed in the paused state, a packet from the other network device via the MKA communication link. The network device may determine, based on the packet, that the MKA session has not ended. The network device may continue, based on the MKA session having not ended, the MKA session by reactivating the MKA state.

Abstract: Network devices that are inserted inline into network links and process in-transit packets may significantly improve their packet-throughput performance by not assigning L3 IP addresses and L2 MAC addresses to their network interfaces and thereby process packets through a logical fast path that bypasses the slow path through the operating system kernel. When virtualizing such Bump-In-The-Wire (BITW) devices for deployment into clouds, the network interfaces must have L3 IP and L2 MAC addresses assigned to them. Thus, packets are processed through the slow path of a virtual BITW device, significantly reducing the performance. By adding new logic to the virtual BITW device and/or configuring proxies, addresses, subnets, and/or routing tables, a virtual BITW device can process packets through the fast path and potentially improve performance accordingly. For example, the virtual BITW device may be configured to enforce a virtual path (comprising the fast path) through the virtual BITW device.

Abstract: A method in the field of networking technologies for sending a wake up packet, an apparatus, and a device. The method for sending a wake up packet is applied to a first node, wherein the first node maintains a first contention window (CW1) on a first channel, the first channel is a channel on which a main transceiver of a second node works, and the method includes generating a backoff count based on CW1, executing backoff based on the backoff count, and sending a wake up packet to the second node on a second channel when backoff ends, wherein the second channel is a channel on which a wake up receiver of the second node works.

Abstract: Gateway and bridge devices for internet of things systems are described. The gateway device is configured to communicate with a server using signals encrypted according to a first encryption protocol and to communicate with bridge device using signals encrypted with a second protocol. The bridge device is configured to decrypt the signals received from the gateway device and to communicate with sensors and actuators. The bridge device is further configured to encrypt data signals from the sensors for sending to the gateway device.

Abstract: A method for performing authentication of a client device using a hash chain includes: receiving a first data request from a client device, the first data request including at least a user identifier and a first hash value; transmitting a first data response message to the client device; receiving a second data request from the client device, the second data request including at least the user identifier and a second hash value; generating a validating hash value by applying a hashing algorithm to the second hash value; validating the first hash value as being equal to the generated validating hash value; and transmitting a second data response message to the client device upon successful validation of the first hash value, wherein the second data response message includes one or more data values associated with the user identifier.

Abstract: Embodiments include systems and methods for delivering Dynamic Adaptive Streaming Over Hypertext Transfer Protocol (DASH) content through Web Real-Time Communication (WebRTC). Various embodiments may enable the mapping of DASH content onto WebRTC transport sessions. Various embodiments may enable the reuse of encryption contexts.

Abstract: A network device may delegate a first prefix length to a primary WAN interface and delegate a second prefix length to a backup WAN interface. The network device may assign a first primary prefix and a first backup prefix to a first VLAN interface and may assign a second primary prefix and a second backup prefix to a second VLAN interface. The network device may provide egress traffic from host devices, connected to the first VLAN interface and to the second VLAN interface, to the primary WAN interface and without prefix translation, when the primary WAN interface is available. The network device may provide ingress traffic to the host devices, via the primary WAN interface and without prefix translation, when the primary WAN interface is available.

Abstract: A policy interpreter detects that an application container has been added in a container system, and opens a stored manifest for the application container. The policy interpreter retrieves running services information regarding the application container, and generates a security policy for the application container. The security policy defines a set of actions for which the application container can perform, and the set of actions are determined using the manifest and the running service information associated with the application container. The policy interpreter loads the security policy at a security container. The security container blocks an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy. The policy interpreter transmits the security policy to a graphical user interface container for presentation to a user via a display device.

Abstract: A maze-based switch generally having three functional blocks is disclosed. The first functional block handles communications by accepting an entered maze pattern from an external system controller and outputting the entered maze pattern (and optionally its directional complement) to the second functional block. The second functional block stores the maze pattern (and optionally its directional complement) to a permanent storage element and outputs the stored, entered maze pattern and its directional complement to a series of transistors in the third functional block. The third functional block is an electronic maze in which a correct maze pattern and its directional complement must be received by the transistors for the transistors to pass electrical power through the electronic maze to a connected element. The third functional block may alternatively be implemented with optical elements, optoelectronic elements, microelectromechanical elements, or elements formed by other microsystem technologies.

Abstract: The invention is directed to a computer readable medium storing a display control program for causing a computer to execute: a setting procedure of setting display control information of protected content to be protected based on authentication information; and a determination procedure of determining whether to permit display of the protected content and whether to cancel an authenticated state of the protected content based on the display control information set by the setting procedure.

Abstract: A system and method for improving network performance of DNS queries. The system includes a terminal which receives DNS queries from a customer premise equipment (CPE), and supplies matching DNS records in response to the queries. The terminal monitors all traffic from the CPE and generates a preload list containing domains and a time schedule at which name resolution should be requested for the domains. A DNS preload client in the CPE receives the preload list from the terminal, and submits preload DNS queries for name resolution of domains contained in the preload list at times specified in the time schedule. Preload records supplied in response to the preload DNS queries are stored by the CPE and used to resolve DNS queries from applications installed on the CPE.

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: Systems and techniques are provided herein to enable an authoritative DNS zone to utilize a forwarding service to resolve domain names that cannot be resolved by the authoritative DNS zone.

Abstract: Network devices that are inserted inline into network links and process in-transit packets may significantly improve their packet-throughput performance by not assigning L3 IP addresses and L2 MAC addresses to their network interfaces and thereby process packets through a logical fast path that bypasses the slow path through the operating system kernel. When virtualizing such Bump-In-The-Wire (BITW) devices for deployment into clouds, the network interfaces must have L3 IP and L2 MAC addresses assigned to them. Thus, packets are processed through the slow path of a virtual BITW device, significantly reducing the performance. By adding new logic to the virtual BITW device and/or configuring proxies, addresses, subnets, and/or routing tables, a virtual BITW device can process packets through the fast path and potentially improve performance accordingly. For example, the virtual BITW device may be configured to enforce a virtual path (comprising the fast path) through the virtual BITW device.

Abstract: Disclosed is an electronic device including at least one wireless communication circuit configured to provide a first radio access technology (RAT) and a second RAT, at least one processor operatively connected to the at least one wireless communication circuit and configured to provide a first packet data convergence protocol (PDCP) related to the first RAT and a second PDCP related to the second RAT, a volatile memory operatively connected to the at least one processor and including, in at least a partial region thereof, a first buffer, and a nonvolatile memory operatively connected to the at least one processor or coupled to the processor. The electronic device may change a PDCP version of a data packet based on a change of a PDCP version. Besides, other various embodiments recognized through the present disclosure can be made.

Abstract: Techniques are described for adapting the format of streaming media based on received interactions with the media. In an embodiment, a client computer system receives from media streaming service an initial version of media in an initial media format. After the media is presented, a request to interact with the initial version of the media may be received. Such a request may cause the client system to generate a change request data for the initial version of media. Based at least in part on the change request data for the initial version of the media, the new format for streaming the media to the client computer system is determined. The client computer system receives the media streamed in the new format.

Abstract: Systems and methods for securely and remotely storing data in a remote, distributed redundant array of independent drives (RAID) is provided. RAID storage is accomplished through a series of mapped drives, non-routable Internet protocol (IP) addresses, and routable IP addresses. In addition, authorization to access a RAID controller, network address translation (NAT) system, and domain name system (DNS) system may all be separated, increasing security and allowing storage to be securely distributed among a variety of dispersed storage locations.

Abstract: A method for a proxyless protocol includes intercepting, from a client, a first Transmission Control Protocol (TCP) connection request requesting to establish a TCP connection between the client and a proxy for routing data to a destination server. The request includes client information and a first sequence number. The method also includes transmitting, to the destination server, a second TCP connection request to establish a TCP connection between the client and the destination server. The second request includes a second sequence number less than the first sequence number. The method also includes intercepting, from the destination server, an acknowledgment message indicating acknowledgment of the second TCP connection request. The method also includes transmitting, to the destination server, a proxy protocol header message with the client information.

Abstract: A data retrieval system can include a computing device that is configured to, in response to receiving a uniform resource locator from a user device, parse the uniform resource locator to identify a dynamic path variable. The computing device can be configured to generate a set of execution steps based on the received uniform resource locator. The computing device can also be configured to execute the set of execution steps to retrieve a set of data, the set of execution steps being executed based on the dynamic path variable in response to the dynamic path variable being identified. The computing device can further be configured to transform a user interface of the user device based on the set of data.

Abstract: Measures for providing timer services in a network including a cluster of nodes responsible for providing timer services to clients. At a given node in the cluster, a request to provide a timer is received from a client. Configuration of a primary replica of the requested timer on a first node in the cluster to pop after a first time has elapsed is initiated. A first timer replication message is transmitted to a second node in the cluster, the first timer replication message indicating that the second node should configure a first backup replica of the requested timer. A second timer replication message is transmitted to a third node in the cluster, the second timer replication message indicating that the third node should configure a second backup replica of the requested timer. Popping of the primary, first backup or second backup timer replicas includes initiating callback of a given client.

Abstract: Systems and methods are described for allocating requests to implement new workloads within a dynamic set of servers. Existing load balancing techniques can result in “focus firing” on new servers added to the set, since a load balancer may view a new server as underloaded. With sufficient intensity, focus firing can result in overshooting target load for the new server, and the new server in fact becoming overloaded. The present disclosure modifies selection of servers as potential targets for a workload by at least partly biasing against selection of young servers. The bias imposed can be scaled to avoid overloading new servers.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for connecting to an independent software vendor (ISV). The method includes receiving, at an integrated platform, a request to initiate a data connection with the ISV. The request may include a web address of the ISV. The method also includes associating, through the integrated platform, the data connection with a unique identifier. The method also includes issuing an authorization code based on authentication of an authorization request for the data connection. The method also includes exchanging, with a connector service, the authorization code for tokens utilized for establishing the data connection with the ISV. The method also includes receiving access to the ISV through the integrated platform.

Abstract: One embodiment provides a network interface controller (NIC). The NIC can include a storage device, a network interface, a hardware list-processing engine (LPE), and a message state table (MST) logic block. The storage device can store an MST. The network interface can couple the NIC to a network. The LPE can perform message matching on a first packet of a message received via the network interface. The MST logic block can store results of the message matching in the MST and receive a request to read the results of the message matching from the MST if the NIC receives a second packet associated with the message.

Abstract: Embodiments detect malicious code in distributed software components. A detector element references a source code repository (e.g., open source, commercial) containing lines of various files of a distributed artifact. Subject to certain possible optimizations, the detector inspects the individual files and lines of the artifact file-by-file and line-by-line, to identify whether any commit history information is available from a Versioning Control System (VCS). A risk assessor element receives from the detector element, results identifying those lines and/or files for which no VCS commit history is available. The risk assessor then references code features (e.g., file extension, security-critical API calls) in the results, to generate a probability of the malicious nature of the source code lacking VCS commit history information. An analysis report including this probability and additional relevant information, is offered to a user to conduct further manual review (e.g.

Abstract: There is provided methods and devices for network management. A method includes receiving at least one data flow, transmitting in-band management packet periodically for each of the at least one data flow, receiving in-band acknowledgement packets for each of the at least one data flow, and producing network management data based on received in-band acknowledgement packets. A device includes a processor, and a non-transient computer readable memory having stored thereon machine executable instructions which when executed by the processor configure the device to execute the methods disclosed herein. A system includes a source node, a receiver and a data-plane device, the system configured to execute the methods disclosed herein.

Abstract: Embodiments include an electronic control unit comprising an audio input device for receiving an audio stream from an external audio source, the audio stream being split between an audio path and a haptic path; a wireless transceiver in the haptic path for transmitting the audio stream to at least one wearable haptic device using short-range wireless communication; and a processor coupled to the transceiver and configured to calculate an amount of latency associated with transmission of the audio stream to the wearable haptic device(s), and partition the audio stream into a plurality of audio packets including a time-to-play based on the calculated latency. The control unit further includes a buffer in the audio path for inserting a time delay into the audio stream based on the calculated latency, and an audio output device in the audio path for outputting the time-delayed audio stream to an external audio listening device.

Abstract: System and method for detecting a likely threat from a malicious attack is disclosed. Communication between a user computer and a destination computer is monitored by a security appliance. Selective information from the communication is extracted. One or more weak signals of a threat is detected based on the selective information. One or more weak signals are evaluated for a likely threat based on a threshold value. A corrective action is initiated for the likely threat, based on the evaluation.