Sandvine Corporation

A method for detecting fraudulent traffic in a computer network including: receiving a packet from a traffic flow; determining data associated with the traffic flow; determining a score associated with each piece of determined data; aggregating an overall score for the traffic flow; and determining whether the traffic flow is trusted based on the overall score. A system for detecting fraudulent traffic in a computer network including: a data processing engine configured to receive a packet from a traffic flow; a data collection module configured to determine data associated with the traffic flow; a data correlation module configured to determining a score associated with each piece of determined data and aggregating an overall score for the traffic flow; and a traffic classification module configured to determine whether the traffic flow is trusted based on the overall score.

A system and method for determining application quality of experience. The system including: a logic module configured to collect input data associated with network traffic flow parameters and extract a feature set based on the network flow parameters; a model module configured to train a machine learning model to determine MOS based on the extracted feature set; and a traffic action module configured to monitor the MOS based on the machine learning model and the traffic flow in the network and determining application quality of experience based on the MOS. The method including: collecting input data associated with network flow parameters; extracting a feature set based on the collected data; training a model to determine MOS of network traffic based on the extract feature set; deploying the model to monitor the MOS of traffic flow in the computer network; and determining the quality of experience based on the MOS.

A method and system for classifying a device accessing a computer network. The method including: determining fields of interest that are indicators for classifying the device; reviewing a network traffic flow associated with the device; extracting field/parameter values from a packet associated with the network traffic flow; comparing the extracted field/parameter values with values of the fields of interest to determine at least one device attribute; and classifying the device associated with the network traffic flow based on the comparison. The header fields/parameters may include application name and/or fields/parameters available in a TLS header. The system includes a processor, memory, and software modules and engines that implement the method above.

A method and system for social media monitoring, the method including: collecting data associated with a social media upload; determining subscriber identity information associated with the social media upload; creating an IPDR based on the subscriber identity and social media upload data; receiving a query having at least one social media upload event; determining at least one subscriber identity that may be associated with the upload event; and providing the at least one subscriber identity as a result of the query. The system includes: a collection module configured to collect data; an analysis module configured to determine subscriber identity information and create an IPDR based on the subscriber identity and social media upload data; and a query module configured to receive a query having at least one social media upload event, determine at least one subscriber identity that may be associated with the upload event.

A system and a method for measuring latency on a computer network. The method including: identifying a QUIC traffic flow; determining packet parameters associated with the QUIC traffic flow; determining a handshake latency associated with the packet parameters; and monitoring mid-flow latency for any changes in the latency of the QUIC traffic flow. The system for measuring and managing latency on a computer network including: a data processing engine configured to determine a QUIC traffic flow; a data collection module configured to determine packet parameters associated with the QUIC traffic flow; a state machine configured to determine a handshake latency associated with the packet parameters and monitor mid-flow latency for any changes in the latency of the QUIC traffic flow.

A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.

A method for traffic flow acceleration including: retrieving a Transmission Control Protocol (TCP) User Datagram Protocol (UDP) or Quick UDP Internet Connection (QUIC) traffic flow from the computer network; mapping the traffic flow to a subscriber; determining congestion control parameters associated with the traffic flow; determining subscriber buffer management parameters based on the subscriber and the congestion control parameters; and managing a buffer depth at a subscriber level based on the subscriber buffer management parameters. A system for traffic flow acceleration including: an analysis module configured to retrieve a TCP, UDP or QUIC traffic flow and map the traffic flow to a subscriber; a congestion control module configured to determine congestion control parameters associated with the traffic flow; and a buffer management module configured to determine subscriber buffer management parameters based on the subscriber and the congestion control parameters; and manage a buffer depth at a subscriber level.

A method for detecting fraudulent traffic in a computer network including: receiving a packet from a traffic flow; determining data associated with the traffic flow; determining a score associated with each piece of determined data; aggregating an overall score for the traffic flow; and determining whether the traffic flow is trusted based on the overall score. A system for detecting fraudulent traffic in a computer network including: a data processing engine configured to receive a packet from a traffic flow; a data collection module configured to determine data associated with the traffic flow; a data correlation module configured to determining a score associated with each piece of determined data and aggregating an overall score for the traffic flow; and a traffic classification module configured to determine whether the traffic flow is trusted based on the overall score.

A method and system for social media monitoring, the method including: collecting data associated with a social media upload; determining subscriber identity information associated with the social media upload; creating an IPDR based on the subscriber identity and social media upload data; receiving a query having at least one social media upload event; determining at least one subscriber identity that may be associated with the upload event; and providing the at least one subscriber identity as a result of the query. The system includes: a collection module configured to collect data; an analysis module configured to determine subscriber identity information and create an IPDR based on the subscriber identity and social media upload data; and a query module configured to receive a query having at least one social media upload event, determine at least one subscriber identity that may be associated with the upload event.

A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.