NetScout Systems, Inc.

A method for detecting PCI confusion during cellular network handovers includes identifying a geographic location of a handover failure of a user device from a first cell to a second cell, determining a strength of a signal to be received by the user device from the second cell, identifying, based on the strength of the signal to be received by the user device from the second cell, a hidden neighbor cell of the first cell, determining a strength of a signal to be received by the user device from the hidden neighbor cell, classifying, based on the determined signal strength of the hidden neighbor cell, a cause of the confusion during cellular network handovers, modifying, based on the classified cause of confusion, one or more parameters of the second cell or the hidden neighbor cell to prevent confusion during future cellular network handovers.

A system and method for analyzing error codes includes detecting a failure condition on a network, identifying a subset of subscribers impacted by the failure condition, determining for each subscriber in the subset of subscribers a first set of error codes associated with the failure condition, creating a Bayesian network comprising one or more error codes from the first set of error codes of each the subset of subscribers, computing a Conditional Probability Distribution (CPD) for each of the one or more error codes of the Bayesian network, and determining a second set of error codes based on the CPD, the second set of error codes indicative of a cause of the failure condition.

Systems and methods for network element clustering include identifying a plurality of network elements, each network element configured to send and receive a plurality of data packets across a communications network, assigning each network element of the plurality of network elements to a cluster of a first plurality of clusters according to a location of each network element, determining a distance between each network element assigned to a cluster and a centroid of the cluster, executing an optimization algorithm using the distances to reassign the plurality of network elements to clusters of a second plurality of clusters that reduces a cost value of the optimization algorithm, generating a matrix indicating an assignment of each network element of the plurality of network elements to a cluster of the second plurality of clusters, and routing one or more data packets received from the plurality of network elements according to the generated matrix.

Systems and methods for network traffic monitoring are provided. A system may obtain a data packet of a data packet exchange between the server and a network device, extract a time to live (TTL) value and an internet protocol (IP) address of the network device from the data packet, compare the TTL value with a TTL value range or signature determined based on TTL values observed from data packets transmitted across a communications network, determine that the TTL value violates an authentication policy based on the TTL value being outside of the TTL value range or signature, and apply a tag to the IP address of the network device in a database stored memory.

A system includes instructions that cause processors to store a directed acyclic graph including nodes comprising selector nodes, mitigator nodes, and actor nodes, each of the nodes linked to another node, receive a data packet, inspect, using a selector node, a header of the data packet to determine a protection group, tag the data packet with an identification of the protection group based on the inspection, apply, using a mitigator node, criteria of a protection group policy corresponding to the protection group to the data packet based on the identification of the protection group tagged to the data packet, tag the data packet with a mitigation flag corresponding to a mitigation measure selected based on the application of the criteria of the protection group policy to the data packet, and apply, using an actor node, the mitigation measure corresponding to the mitigation tag to the data packet.

The present disclosure describes a system including one or more processors to store a plurality of inspection tools in memory; detect a plurality of data packet exchanges between pairs of network devices communicating across a communications network; store metadata generated from the plurality of data packet exchanges in respective records corresponding to the different data packet exchanges; receive a data packet transmitted from a first network device to a second network device across a communications network; extract session information from a header of the data packet; responsive to determining the extracted session information matches stored session information for a communication session, tag the data packet with an indication of an active session; and process the data packet based on the tag of the data packet indicating the active session.

A system may include one or more memory devices storing instructions thereon that, when executed by one or more processors, cause the one or more processors to detect a transmission of a first data packet between a computing device and a server, determine a first amount of time elapsed between the transmission of the first data packet and a transmission of a second data packet, store the first amount of time in a data structure in a database, detect a transmission of a third data packet between the computing device and the server, determine a second amount of time elapsed between the transmission of the second data packet and the transmission of the third data packet, and determine that the computing device is utilizing a proxy device to communicate with the server.

A method for detecting cell positioning anomalies is disclosed. Control plane signaling data packets are collected associated with multiple cells of a communications network. Distance and azimuth values for individual communication sessions are calculated for each cell. A machine learning model is executed using various communication parameters as input to generate a classification for each cell. A list identifying which cells are experiencing anomalies is generated.

Systems and methods for source-based misuse detection are provided. A system may store a managed objects in memory. Each of the managed objects corresponding to one or more computing devices configured to communicate over a communications network and having a configuration including one or more thresholds corresponding to network parameters for detecting an attack on the communications network. The system may monitor network traffic. The system may detect a first network parameter exceeds a threshold of a first misuse type. The system may identify a source internet protocol (IP) address associated with the first network parameter exceeding the threshold. The system may generate a tag for each source IP address indicating misuse of the communications network by the source IP address.

Systems and methods for USN monitoring via virtual tap is provided. A system may obtain, from a virtual tap, virtual network data packets associated with a first type of wireless communication protocol. The system may extract a first ID from the virtual network data packets. The system may query a first database associated with the first type of wireless communication protocol or a second database using a second type of wireless communication protocol using the first ID. The system may determine a second ID and a security context based on the query. The system may convert the security context from a first type to a second type of security context. The system may store the converted security context into a field based on the second ID.