An example method for discovering and grouping application endpoints in a network environment is provided and includes discovering endpoints communicating in a network environment, calculating affinity between the discovered endpoints, and grouping the endpoints into separate endpoint groups (EPGs) according to the calculated affinity, each EPG comprising a logical grouping of similar endpoints for applying common forwarding and policy logic according to logical application boundaries. In specific embodiments, the affinity includes a weighted average of network affinity, compute affinity and user specified affinity.

The disclosure relates to an electronic apparatus and a method of controlling the same. The electronic apparatus includes: a communication interface; and a processor configured to receive log data of a plurality of devices connected to a network through the communication interface, acquire operation time information of each of the devices from the received log data, calculate similarity of the operation time between the plurality of devices based on the acquired operation time information, and determine a device group including two or more devices with relatively high calculated similarity among the plurality of devices.

A method for detecting anomalies in one or more network performance metrics stream for one or more monitored object comprising using a discrete window on the stream to extract a motif from said stream for a first of said network performance metric for a first of said monitored object. Maintaining an abnormal and a normal cluster center of historical time series for said first network performance metric for said first monitored object. Classifying said motif based on a distance between said new time series and said abnormal and said normal cluster center. Determining whether an anomaly for said motif occurred based on said distance and a predetermined decision boundary.

A method for detecting anomalies in one or more network performance metrics stream for one or more monitored object comprising using a discrete window on the stream to extract a motif from said stream for a first of said network performance metric for a first of said monitored object. Maintaining an abnormal and a normal cluster center of historical time series for said first network performance metric for said first monitored object. Classifying said motif based on a distance between said new time series and said abnormal and said normal cluster center. Determining whether an anomaly for said motif occurred based on said distance and a predetermined decision boundary.

An anomaly flow detection device and an anomaly flow detection method thereof are provided. The device can retrieve a plurality of training data transmitted between a monitored network and an external network, preprocess a plurality of packet headers of the pluralities of training data to obtain a plurality of training feature vectors, construct a flow recognition model with an unsupervised learning method, input the pluralities of training feature vectors to the flow recognition model to train the flow recognition model, retrieve a plurality of testing data transmitted between the monitored network and the external network, preprocess a plurality of packet headers of the pluralities of testing data to obtain a plurality of testing feature vectors, input the pluralities of testing feature vectors to the flow recognition model to identify whether the pluralities of packet headers of the pluralities of testing data are normal or abnormal, and determine the flow of the monitored network is abnormal according to the recognition result of the flow recognition model.

A method, a device, and a non-transitory storage medium are described in which a network performance spread service is provided. The service may include generating a dependency graph representative of a network and identifying current or prospective poor performance spread of network elements based on correlations between the network elements and performance data. The service may also include providing remedial services that address the poor performance spread in the network.

A method, a device, and a non-transitory storage medium are described in which a network performance spread service is provided. The service may include generating a dependency graph representative of a network and identifying current or prospective poor performance spread of network elements based on correlations between the network elements and performance data. The service may also include providing remedial services that address the poor performance spread in the network.

Embodiments of the present disclosure provide a method, system and device for content delivery network (CDN) scheduling, and a storage medium. The method includes: acquiring CDN data in real time from a CDN node device to generate a CDN index system; acquiring metropolitan area network, MAN, data in real time from a MAN to generate a MAN index system; generating a CDN node load intelligent image based on the CDN index system, and generating an intra-region scheduling algorithm through artificial intelligence, AI, training and algorithm optimization; generating a CDN region load intelligent image based on the CDN index system and the MAN index system, and generating an inter-region scheduling algorithm through the AI training and the algorithm optimization; and determining a CDN scheduling policy according to the intra-region scheduling algorithm and the inter-region scheduling algorithm, and executing the CDN scheduling policy.

A method of generating a synthetic network includes receiving, by a group structure identification module, anonymized input data related to an original network. The anonymized input data includes an anonymized list of nodes, a list of edges and a list of groups. The method further includes determining, by the group structure identification module, for each pair of nodes, a probability of an edge between the pair of nodes. A resulting list of probabilities corresponds to a summary group structure. The method further includes generating, by a synthetic random network generation module, at least one synthetic random network based, at least in part, on the determined probabilities.

One or more computing devices, systems, and/or methods for system parameter identification and network component configuration are provided. A state comprising a system parameter combination, a traffic model, and a channel assignment may be generated. A network traffic scenario is executed through a virtualized testbed using the state. A reward for the system parameter combination may be generated based upon key performance indicators output by the network traffic scenario. A reward policy and rewards generated for system parameter combinations are used to select a system parameter combination that is used to configure a network component of a communication network.