683 results about "NetFlow" patented technology

The invention relates to the technical field of automatic logistics, in particular to an intelligent warehouse cargo scheduling device, which comprises a dynamic priority adjustment module, a self-adaptive classified storage module, a cargo flow optimization module, a resource allocation module, a fault analysis and maintenance module, a behavior monitoring module, an energy management module and a cost control module. According to the method, the cargo scheduling priority is optimized through a support vector machine algorithm and a decision tree method, the warehouse space utilization rate is improved by utilizing a convolutional neural network and a genetic algorithm, the cargo flow is optimized by adopting linear programming and a network flow analysis algorithm, and the cargo flow trend is estimated through an autoregressive integral moving average model and a recurrent neural network. The system utilizes a long short-term memory network to identify equipment faults and maintain, reduces the risk of accidental shutdown, improves the operation safety through a computer vision technology and a behavior identification algorithm, and utilizes an energy consumption mode analysis and cost-benefit analysis method to reduce the operation cost.

A system and method are provided for placing security operations at selected enforcement points in a distributed security fabric. The enforcement points at which the security operations are placed can be endpoints, nodes, and / or network devices within the network. The security operations can be updated by monitoring data flows through the network to generate network data, and then determining, based on the network data, one or more changes to the security operations, based on the generated network data. Recommended changes can be obtained by applying the network data to a machine-learning model that indicates suspicious data packets (e.g., disseminates packets suspected of being malicious from normal traffic) and crafts new policies to deny the suspicious data packets. Performance of the network can also be improved by analyzing the security operations for redundancies and / or inefficiencies and modifying the security operations to mitigate them.

A system for detecting anomalous network patterns based on analyzing network traffic data and method thereof are disclosed. The system comprises a flow aggregator subsystem, a flow feature generation subsystem, an anomaly detection subsystem, a dynamic score subsystem, and a calibration subsystem. The system is configured to receive the network traffic data from one or more network endpoints for aggregating the network traffic data into network flow data. The system is configured to generate one or more flow features for each packet associated with the aggregated network traffic data based on a rolling window-based analysis of the one or more attributes. The system is configured to analyze the one or more flow features by utilizing one or more deep-learning models to detect the one or more anomalous network patterns.

The invention relates to the technical field of network security, in particular to a dynamic access blocking method based on zero trust. Comprising the following steps: step 1, collecting whole network flow data in real time in a bypass monitoring mode through a flow mirroring function of a network switch, performing deep packet inspection analysis on the collected original flow data, and extracting network flow characteristic parameters; 2, maintaining a dynamic identity information base; 3, performing real-time behavior analysis on each network session; 4, according to the risk assessment result and the real-time security context, generating a dynamic access control strategy based on a minimum permission principle; 5, implementing access control at the network execution point; and 6, continuously monitoring the network flow and the strategy execution effect, collecting feedback data, optimizing the risk assessment model and the strategy generation algorithm based on the feedback data, and forming closed-loop control. By dynamically updating the identity and asset information, the system can identify new assets or changes in real time, so that the adaptability and response capability of a network environment are improved.

A network traffic classification process, including the steps of: monitoring network traffic flows to dynamically generate, for each of the network traffic flows and in real-time, time series data sets representing, for each of upstream and downstream directions of the network traffic flow, for each of a plurality of successive timeslots, and for each of a plurality of packet length bins, a packet count and a byte count of packets received within the timeslot and having one or more lengths within the corresponding packet length bin; and processing the time series data sets of each network traffic flow to classify the network flow into one of a plurality of predetermined network traffic classes, without using payload content of the network traffic flow.

The present disclosure includes systems and methods for multi-cloud network analysis and threat intelligence correlation. In various embodiments, systems are adapted to perform steps of retrieving network flow logs associated with one or more Virtual Private Cloud (VPC) networks; processing the network flow logs to identify new files and enriching critical fields from the network flow logs; transforming and aggregating the network flow logs for further processing; and identifying threats associated with the one or more VPC networks.

The invention discloses a network intrusion detection method and system based on edge attention learning, and a storage medium, and the method comprises the steps: converting an original network flow into a network flow diagram, and constructing a training diagram and a test diagram under the condition that a coarse-grained label and a fine-grained label are reserved; edge embedding representation is obtained through edge feature reservation, adaptive weight distribution and multi-layer feature extraction of the training graph and the test graph; based on the edge embedding representation, performing coarse-grained detection to identify a basic attack category, and performing fine-grained classification by using multi-scale feature fusion related to global graph attributes; and adversarial training: through initializing adversarial disturbance and optimizing disturbance based on loss function gradient iteration, superposing final disturbance into the training graph, and based on loss function back propagation updating, obtaining a trained network intrusion detection model. The method provided by the invention can effectively capture the depth characteristics of the key attack and maintain the stable detection performance in the confrontation environment.

A VCN process may receive, by a value chain network digital twin, information associated with a value chain network. A VCN process may provide the information to a set of Artificial Intelligence (AI)-based learning models, wherein at least one member of the set of AI-based learning models is trained to classify at least one of: an operating state, a fault condition, an operating flow, or a behavior of the value chain network and at least one member of the set of AI-based learning models is trained to determine a task to be completed for the value chain network. A VCN process may provide at least one of an instruction for executing the task in the value chain network digital twin and a recommendation for executing the task in the value chain network digital twin.

Technologies for creating an optimized and accelerated network pipeline using an emulated network pipeline abstraction layer (NPAL) of an emulated data processing unit (DPU), including an emulated processing device and an emulated acceleration hardware engine, are described. The emulated NPAL supports multiple network protocols and network functions in an emulated network pipeline. The emulated network pipeline includes a set of tables and logic organized in a specific order to be accelerated by the emulated acceleration hardware engine. The emulated acceleration hardware engine can process network traffic data using the emulated network pipeline.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for policy-based routing (PBR) over Service Function Chaining (SFC) are described. A DPU includes acceleration hardware engine to provide a single accelerated data plane. A processing device can generate a first virtual bridge and a second virtual bridge, the first virtual bridge to be controlled by a first network service hosted on the DPU and having a set of one or more network rules, and the second virtual bridge having a policy-based routing policy (PBR policy). The processing device can add the virtual port between the first virtual bridge and the second virtual bridge. The acceleration hardware engine, in the single accelerated data plane, can route network traffic data using the PBR policy and process the network traffic data using the set of one or more network rules.

A method for screening inter-PLMN messages at a SEPP to implement roaming agreements includes storing an originating and target network mapping database containing records including mappings between originating network identifiers and target network identifiers. The method further includes receiving, at the SEPP, an inter-PLMN SBI request message originating from an NF in a network served by the SEPP. The method further includes determining originating and target network identifiers from the message, locating a matching record in the database, and determining, from the record, whether the message should be allowed to flow from the originating network to the target network. The method further includes forwarding the message to the target network or preventing the forwarding of the message to the target network based on results of the determining.

The invention provides a reliability-aware dependent task unloading method based on topology reconstruction in industrial internet edge computing, which comprises the following steps of: constructing a system model covering an edge cloud network platform, an industrial cloud platform and internet of things equipment, and establishing a transmission delay model and a reliability model; constructing a task unloading mathematical model with the maximum reliability level; the method comprises the following steps: modeling a micro-service dependency relationship into a weighted directed acyclic graph based on a network flow theory, and carrying out topology reconstruction on micro-services applied to the Internet of Things through a Ford-Fulkerson approximation algorithm to obtain a micro-service grouping structure formed by minimum cut division; the micro-service grouping structure serves as priori knowledge to be input into the deep Q network, the deep Q network is used for solving a task unloading mathematical model, a task unloading strategy is dynamically adjusted, resource allocation is optimized, and an optimal calculation unloading scheme in the industrial internet edge calculation environment is obtained. The micro-service deployment is optimized, the communication overhead is reduced, and the system reliability and the resource utilization rate are improved through real-time network state dynamic decision making.

The invention discloses an operation and maintenance platform data acquisition system based on big data, and relates to the technical field of big data, and the system comprises the steps: capturing a data packet from a network flow of an operation and maintenance platform, and storing the data packet in a buffer area; performing preliminary screening on the data packets in the buffer area, and allocating priorities for the data packets based on a dynamic weight scheduling mechanism to complete preliminary preprocessing of the data packets; based on a circular sorting and block optimization technology, distributing the plurality of decomposed analysis tasks to a plurality of threads for parallel processing; formatting the analysis result, and performing batch parallel processing according to the data scale of the analysis result; formatting the analyzed data, writing the formatted data into a time sequence database according to a time sequence, and generating an index based on the tag field; through a dynamic cache management mechanism, the cache size is dynamically adjusted according to the throughput and the maximum delay of the network flow, and the problems of data loss and processing delay are avoided.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) are described. A DPU includes DPU hardware and memory that stores DPU software with the NPAL that supports multiple network protocols and network functions in a network pipeline. The network pipeline includes a set of tables and logic organized in a specific order to be accelerated by an acceleration hardware engine of the DPU. The acceleration hardware engine processes network traffic data using the network pipeline.

System and techniques for network flow-based hardware allocation are described herein. A workload for is obtained for execution. Here, the workload includes a flow that has a processing component and a network component. Then, during execution of the workload, the flow is repeatedly profiled and assigned a network service and a processing service during a next execution based on a network metric and a processing metric obtained from the profiling.

Techniques for augmenting deep packet inspection capabilities of a network security device provisioned in a networked computing environment with inference-based flow selection to focus processing resources on network traffic that is likely to be malicious. The network device(s) may receive decryption policies comprising one or more decrypt and / or do not decrypt rules for applying the decryption policy to the network traffic. The network device may receive network traffic associated with a given connection flow through the network between a client device and a workload application, and the network device may determine whether to decrypt or refrain from decrypting the network traffic associated with the network flow based on a risk score that is generated by the network device using connection fingerprints associated with the client device and the workload application, respectively, based on behavioral characteristics of the client device and the workload, respectively.

The invention relates to a malicious traffic detection method based on a dynamic graph neural network. Compared with the prior art, the malicious traffic detection method solves the defect that malicious traffic is difficult to effectively detect. The method comprises the following steps: acquiring flow data and constructing a heterogeneous graph; performing representation setting of dynamic nodes; capturing a cluster representation evolving over time using dynamic graph representation learning; and malicious traffic detection is carried out. According to the method, a set of network flows with the same behaviors is presented by proposing the concept of the superflow, meanwhile, a superflow-host association diagram with a timestamp is created, a learning framework is represented based on a dynamic diagram, continuous changes of network flow behaviors are simulated through dynamic node representation of a learning host and the superflow, and malicious flow detection is achieved.

Mobile management method, system and client. The method includes receiving a DNS query for a host name from an application on a client; retrieving reputation data associated with the host name from a local cache on the client; determining a policy for the host name, which is associated with the host name and the reputation data associated with the host name; based on the determined policy for the host name, blocking attempted network flows to a host corresponding to the host name; sending at least attempted network flow metadata related to the blocked attempted network flows to a collector on the client; and transmitting the attempted network flow metadata in the collector to a VPN server pool via a VPN tunnel.

A networking device in a HA configuration processes network flows for a VNIC. Network configurations include networking policies that govern network packet processing by the networking device. Global epoch values are associated with each version of the network configuration. The networking device has a control plane, a data plane, and a flow table. The control plane uses the most recent network configuration to produce flow table entries to be stored in the flow table and the data plane uses the flow table entries to process network packets. Flow table entries include flow epoch values that match the global epoch value associated with the network configurations used to create the flow entries. A datapath epoch value, a VNIC peer epoch value, and a VNIC local epoch value are associated with each VNIC. The various epoch values are used to ensure consistent flow table entries among the peers in the HA configuration.

The invention discloses an active source dynamic monitoring and tracking method and system for DDoS attack defense, and the method comprises the steps: collecting Netflow data transmitted by a router in real time; cleaning, normalization processing and feature extraction are carried out on the acquired Netflow traffic data; carrying out statistics on the extracted features, and constructing a traffic baseline; monitoring a reputation value corresponding to each source IP, and constructing an active attack source library for quickly identifying active attack sources; analyzing and detecting the activeness of each monitored source IP based on a sliding time window and a traffic baseline, and further verifying the detected active attack source in combination with the trained LSTM model; performing hop-by-hop tracing, TTL analysis, multi-path probability tracking and probe packet verification on the identified active attack source to realize accurate tracing of the active attack source; and dynamically updating the traffic baseline and the active attack source library according to the traceability result. According to the method and the system, an active attack source is identified through multi-level feature analysis and a cooperative tracking mechanism.

The invention discloses a network flow association method and system based on tetrad metric learning, and the method comprises the following steps: constructing a tetrad data set containing an adversarial disturbance sample through extracting the packet interval and packet size characteristics of network flow; a double-branch feature embedded network is combined with a channel attention and space attention module, so that the dynamic sensing ability of key features is enhanced; introducing a tetrad loss function to optimize a feature embedding space, and compulsorily confronting a rejection relationship between a disturbance sample and a negative sample; based on a dynamic mixed quantile method, a correlation threshold is adaptively selected, and the robustness is improved in combination with a multi-window voting mechanism. According to the method, the association discrimination of the network flow is realized by adopting a tetrad metric learning method, the anti-disturbance capability and the calculation efficiency are remarkably improved, the distribution characteristics of the original flow are not changed, and the method is suitable for a large-scale real-time anonymous network flow association scene.

The invention discloses an encrypted traffic detection method based on LLM enhanced semi-supervised learning. The method comprises the following steps: firstly, training a traffic detection model for detecting encrypted traffic under an LESS framework; and detecting the encrypted traffic by using the trained traffic detection model. Components of the LESS framework include a Prompt orchestrator, an NSSN, and an LLM optimizer. The components work cooperatively, a detection model is trained by using a labeled training set and a label-free training set, and each piece of data in a data set is formed by arranging length values of data packets in a network flow in sequence; the Prompt composer guides the LLM to generate label-free enhanced data in different scenes; the NSSN automatically sets a pseudo label for the enhanced label-free traffic data, and learns traffic detection knowledge accordingly; under the guidance of the SSL loss, the LLM optimizer adjusts the enhancement strategy of the LLM to align the semi-supervised training requirements of the detection model. The training steps of the detection model include LLM pre-fine tuning; marking the LLM enhanced data; and continuous demand alignment can be realized.

Technologies for creating an optimized and accelerated network pipeline using a virtual switch and a network pipeline abstraction layer (NPAL) for fast link recovery are described. The virtual switch can monitor a link availability of each of a plurality of links to a destination, the plurality of links being specified in an initial group of identifiers. The virtual switch can detect a link failure of a first link of the plurality of links. The NPAL can remove a first link identifier, associated with the first link, from the initial group of link identifiers to obtain a modified group of link identifiers. The NPAL can cause a routing table in the NPAL to be updated to remove the first link identifier. The acceleration hardware engine can process network traffic data using the network pipeline and distribute the network traffic data to only the remaining links of the plurality of links.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for split interfaces are described. A DPU includes a physical port configured to couple to a breakout cable that physically couples to a set of a plurality of devices, DPU hardware, and a memory operatively coupled to the DPU hardware. The NPAL supports a plurality of logical split ports, each logical split port corresponding to one of the plurality of devices, wherein the network pipeline comprises a set of tables and logic organized in a specific order to be accelerated by the acceleration hardware engine. The acceleration hardware engine is to process the network traffic data using the network pipeline.

The invention discloses an organization internal communication efficiency improvement method based on social network analysis. The method comprises the following steps: S1, collecting internal communication data of an organization; s2, preprocessing and standardizing the collected data; s3, constructing a communication network graph, and identifying communication frequency and intensity; s4, identifying communication bottlenecks and key nodes in combination with a social physics model and a graph attention network; s5, introducing a network fluid dynamic model and a swarm intelligence method to optimize a communication strategy; s6, continuously optimizing the network structure based on an adaptive optimization method and a context awareness technology; and S7, generating personalized communication optimization suggestions, and dynamically displaying communication network changes. According to the invention, the communication efficiency and decision-making ability in the organization are effectively improved.

Methods and apparatus for interfaces to manage inter-regional connectivity for direct network peerings. A system may include a connectivity coordinator, a first resource collection in a first geographical zone and a second resource collection in a second geographical zone. The coordinator implements a programmatic interface defining connectivity operations. The coordinator receives a request via the interface to establish a logically isolated network path to the second resource collection on behalf of a client that has a dedicated physical link set up to connect to the first resource collection. In response to the request, the coordinator performs one or more configuration operations to enable traffic to flow from the client's network to the second resource collection over a logically isolated network path using the dedicated physical link.

The invention provides an intelligent optical cable performance prediction method and system for a data center, and relates to the technical field of data center performance analys.The intelligent optical cable performance prediction method comprises the steps that firstly, an optical cable microstructure disturbance quantization model is constructed, and an optical cable is divided into a plurality of virtual quantization units in the longitudinal direction; each unit packages a real-time stress-strain state parameter and a response sensitivity coefficient of the basic structure unit, inputting a Brillouin scattering spectrum frequency shift data flow collected in real time into the model for disturbance source analysis, generating a physical excitation decomposition sequence, driving a virtual quantization unit to perform state evolution iterative operation according to the physical excitation decomposition sequence, and obtaining a Brillouin scattering spectrum frequency shift data flow model; a stress-strain state evolution track set is obtained, a time-space correlation network of optical cable link disturbance propagation is constructed according to the stress-strain state evolution track set, network flow characteristic analysis is conducted on the time-space correlation network, an early warning node set is extracted, the future evolution trend of the early warning node set is calculated, and serialized optical cable performance abnormity early warning information is generated. The optical cable performance abnormity can be predicted in advance, and stable operation of the data center optical cable is guaranteed.

Tunnel endpoints may encapsulate the packets of a network flow, such as a forward flow from one computer to another, in encapsulating packets. A forward flow packet of the forward flow may include static header fields, pseudo-dynamic header fields, and dynamic fields. The control plane and the data plane of a tunnel endpoint may omit the static header fields and may omit the pseudo-dynamic header fields from encapsulating packets after sending a first encapsulating packet that includes the forward flow packet and a forward flow value associated with the forward flow. Subsequent encapsulating packets may include the forward flow value and the dynamic field values of subsequent forward flow packets of the forward flow. The static header fields and / or the pseudo-dynamic header fields of the subsequent forward flow packets may be omitted from the subsequent encapsulating packet.

The invention provides a low-delay SDN (Software Defined Network) flow table updating method, and belongs to the technical field of network communication. The method comprises the following steps: firstly, proposing a shortest mobile rule chain for updating a single forwarding rule; and then, aiming at a plurality of concurrency rules which simultaneously reach the switch, designing a dynamic mode to update the concurrency rules, and heuristically updating the plurality of rules in a TCAM limited area, so that the flow table updating efficiency is improved. The method and the device are used for reducing updating delay caused by the rule dependency relationship.