In an embodiment, a computer implemented method receives flow data for a network flows. The method extracts a tuple from the flow data and calculates long-term and short-term trends based at least in part on the tuple. The long-term and short-term trends are compared to determine whether a potential network anomaly exists. If a potential network anomaly does exist, the method initiates a heavy hitter detection algorithm. The method forms a low-complexity intermediate stage of processing that enables a high-complexity heavy hitter detection algorithm to execute when heavy hitters are likely to be detected.

In an embodiment, a computer implemented method receives flow data for a network flows. The method extracts a tuple from the flow data and calculates long-term and short-term trends based at least in part on the tuple. The long-term and short-term trends are compared to determine whether a potential network anomaly exists. If a potential network anomaly does exist, the method initiates a heavy hitter detection algorithm. The method forms a low-complexity intermediate stage of processing that enables a high-complexity heavy hitter detection algorithm to execute when heavy hitters are likely to be detected.

Systems and methods are disclosed herein for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model. To this end, control circuitry may determine a respective network endpoint, of a plurality of network endpoints, to which each respective record of a plurality of received records corresponds. The control circuitry then may assign a dedicated queue for each respective network endpoint, and transmit, to each dedicated queue, each record that corresponds to the respective network endpoint to which the respective dedicated queue is assigned. The control circuitry may then determine, for each respective network endpoint, a respective behavior model, and may store each respective behavior model to memory.

Systems and methods are disclosed herein for reducing storage space used in tracking behavior of a plurality of network endpoints by modeling the behavior with a behavior model. To this end, control circuitry may determine a respective network endpoint, of a plurality of network endpoints, to which each respective record of a plurality of received records corresponds. The control circuitry then may assign a dedicated queue for each respective network endpoint, and transmit, to each dedicated queue, each record that corresponds to the respective network endpoint to which the respective dedicated queue is assigned. The control circuitry may then determine, for each respective network endpoint, a respective behavior model, and may store each respective behavior model to memory.

A method for operating a communication network includes: receiving, by a business support system of a resource reservation system, a reservation request, the reservation request indicating a Quality of Service (QoS) for an upcoming connection to be provided at a time distance from a reservation by the communication network for a terminal device and an application or service accessed by the terminal device via the upcoming connection; checking, by a bookkeeper decision engine of the resource reservation system, whether the business support system has availability for the indicated QoS; in response to confirming the availability for the indicated QoS, sending, by the bookkeeper decision engine, a reservation confirmation; and providing, by the communication network, the upcoming connection with the indicated QoS assigned for the terminal device at the time distance from the reservation.

An electronic device that assesses communication performance is described. During operation, the electronic device receives information specifying a location in an environment. For example, the information may correspond to user-interface activity associated with a user interface. Notably, the user interface may include an augmented reality and the user-interface activity may include defining the location, such as by dropping a pin in the augmented reality. Then, the electronic device provides the information to an access point and/or a controller of the access point, where the location is within communication range of the access point. Next, the electronic device receives, from the access point and/or the controller, measurements of one or more communication performance metrics at or proximate to the location during a time interval. Moreover, the electronic device provides a graphical representation of the communication performance at or proximate to the location based at least in part on the measurements.

An electronic device that assesses communication performance is described. During operation, the electronic device receives information specifying a location in an environment. For example, the information may correspond to user-interface activity associated with a user interface. Notably, the user interface may include an augmented reality and the user-interface activity may include defining the location, such as by dropping a pin in the augmented reality. Then, the electronic device provides the information to an access point and/or a controller of the access point, where the location is within communication range of the access point. Next, the electronic device receives, from the access point and/or the controller, measurements of one or more communication performance metrics at or proximate to the location during a time interval. Moreover, the electronic device provides a graphical representation of the communication performance at or proximate to the location based at least in part on the measurements.

A communication management apparatus suppresses occurrence of a communication anomaly in a cluster by including: an acquisition unit acquiring quantities of traffic of communications performed by one or more communication units operating in each of a plurality of computers constituting a cluster; a prediction unit predicting future quantities of traffic of the communications; an identification unit calculating, for each of the computers, a total of the future quantities of traffic of the communication units operating in the computer and identifying a first computer for which the total exceeds a threshold; and a move control unit controlling, for a communication unit operating in the first computer, move to a second computer.

A communication management apparatus suppresses occurrence of a communication anomaly in a cluster by including: an acquisition unit acquiring quantities of traffic of communications performed by one or more communication units operating in each of a plurality of computers constituting a cluster; a prediction unit predicting future quantities of traffic of the communications; an identification unit calculating, for each of the computers, a total of the future quantities of traffic of the communication units operating in the computer and identifying a first computer for which the total exceeds a threshold; and a move control unit controlling, for a communication unit operating in the first computer, move to a second computer.

Described herein are a device and a method for performing a network analysis. In one aspect, the device includes a reconfigurable neural network circuit to determine an indication of a predicted network characteristic. In one aspect, the reconfigurable neural network circuit includes a control circuit to select a packet attribute or a flow attribute of a raw packet stream from a pipeline, and determine a configuration setting corresponding to the packet attribute or the flow attribute. The configuration setting may indicate a configuration of the reconfigurable neural network circuit to implement a neural network. In one aspect, the reconfigurable neural network circuit includes a storage to provide neural network parameters of the neural network, according to the configuration setting. In one aspect, the reconfigurable neural network circuit includes computational circuits to perform computations based on the neural network parameters from the storage to determine the indication of the predicted network characteristic.