The dynamically generation and evaluation of User Activity Records (UARs) is presented herein to determine which UARs to forward for analytics processing, and how much information to include with the forwarded UARs. To that end, UARs are identified as normal, e.g., those UARs satisfy an evaluation condition, e.g., a threshold condition, and or as abnormal, e.g., those UARs that do not satisfy an evaluation condition, e.g., the threshold condition. For those UARS identified as normal, only a small subset of the normal UARs are forwarded for further analysis to reduce the data volume associated with these normal UARs. For those UARs identified as abnormal, enrichment data is appended to the generated UAR to generate a detailed UAR, all which is forwarded for further analysis.

The disclosed subject matter is directed towards a clear channel assessment procedure based on a common preamble, such as for use with 3GPP and IEEE 802.11 technologies, or any other radio technology, including for use in the 6 GHz band. Detection of the common preamble is based on detecting known sequences in signal part, which can be detected without decoding the preamble's payload (channel) part to determine an ongoing transmission's duration. If an ongoing transmission is detected, subsequent energy detection monitoring is performed to determine when transmission ends, which can use a different energy detection threshold from what is used in the initial clear channel assessment's energy detection. The technology facilitates the usage of different sampling rates by different radio technologies that work concurrently in the same unlicensed band, by correlating a received preamble with a stored preamble that accounts for deterministic distortions arising from the different sampling rates.

Systems, methods, and other embodiments associated with autonomous cloud-node scoping for big-data machine learning use cases are described. In some example embodiments, an automated scoping tool, method, and system are presented that, for each of multiple combinations of parameter values, (i) set a combination of parameter values describing a usage scenario, (ii) execute a machine learning application according to the combination of parameter values on a target cloud environment, and (iii) measure the computational cost for the execution of the machine learning application. A recommendation regarding configuration of central processing unit(s), graphics processing unit(s), and memory for the target cloud environment to execute the machine learning application is generated based on the measured computational costs.

A method of optimizing network traffic visibility resources comprises receiving, by a controller associated with a network traffic visibility system, information indicative of operation of the network traffic visibility system. The method further comprises facilitating, by the controller, control of resources in the network traffic visibility system, according to a configured resource control policy. The facilitating can include providing, by the controller, control signaling to cause maximization of network traffic monitoring fidelity for a plurality of Quality of Service (QoS) classes of network traffic, based on a specified fixed amount of one or more network resources associated with the network traffic visibility system. Alternatively or additionally, the facilitating can include providing, by the controller, control signaling to cause minimization of use of the one or more network resources, based on a specified fixed level of traffic monitoring fidelity associated with the plurality of QoS classes.

A computer-implemented method for recommending a monitoring interval in provided. A non-limiting example of the computer-implemented method includes receiving, by a processor, monitoring data at an initial monitoring interval and calculating, by the processor, a set of aggregation data from the monitoring data including a first subset of aggregation data at a first interval of the initial monitoring interval. The method calculates, by the processor, a first density score for the first subset of aggregation data and a first indicator score for the first subset of aggregation data and provides, by the processor, the first interval as a recommended interval when the first density score does not exceed a density threshold and the first indicator threshold does not exceed an indicator threshold.

A monitoring system performs monitoring using a monitoring device connected to a facility to be monitored through the Internet via communication, wherein the facility is provided with a facility body and a data processing unit configured to process acquired data acquired from the facility body, the data processing unit includes: a low-density data acquisition unit configured to acquire low-density data, a high-density data acquisition unit configured to acquire high-density data having a larger data amount per unit time than the low-density data; a data conversion unit configured to convert the high-density data into feature quantity data which is reduced in density of the high-density data; and a transmission unit configured to transmit monitoring data including the low-density data and the feature quantity data, and the monitoring device configured to perform monitoring on the basis of the monitoring data transmitted from the transmission unit in the data processing unit.

Logging includes accessing a plurality of logs associated with network traffic in a distributed networking environment; selecting a subset of logs among the plurality of logs, wherein a log selection rate is pre-specified; determining weights associated with logs in the subset of logs; and collecting log information, including weight information of logs in the subset of logs relative to the plurality of logs.

It is disclosed a method for performing a performance measurement on a packet flow transmitted along a path through a packet switched communication network. Two or more measurement points are implemented on the path. Each measurement point calculates a sampling signature for each received packet by applying a hash function to a mask of bits of the packet. Then, it selects a number of measurement samples amongst the received packets, the measurement samples being selected as those packets whose sampling signatures comprise a portion of length S equal to a predefined sampling value. While performing the selection, the measurement point counts the number of selected measurement samples and retroactively adjusts the length based on this number. Then, the measurement point provides measurement parameters relating to the selected measurement samples.

A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.