Methods and apparatus are disclosed for monitoring a network connection (13) at a first sampling rate to generate monitoring data for the network connection for determining a performance issue in the network. The method involves identifying a communication occurring via the network connection (13), wherein performance metrics are available for the communication; and responsive to a trigger in respect of the communication, adapting the sampling rate to a second sampling rate greater than the first sampling rate so as to determine whether a performance degradation in the communication is attributable to the network connection (13). The adapting of the sampling rate to a second sampling rate is triggered by comparison of one or more of the available performance metrics for the communication with an adjustable threshold.

A plurality of metrics records, including some records indicating metrics for which anomaly analysis has been performed, is obtained. Using a training data set which includes the metrics records, a machine learning model is trained to predict an anomaly analysis relevance score for an input record which indicates a metric name. Collection of a particular metric of an application is initiated based at least in part on an anomaly analysis relevance score obtained for the particular metric using a trained version of the model.

This application provides a data collection method and a device. A data collection device determines, based on a threshold corresponding to a target indicator, a collection interval for to-be-collected data of the target indicator from a plurality of available collection intervals; and the data collection device collects the data of the target indicator based on the collection interval.

A mechanism for adaptively performing in-band network telemetry (INT) by a network controller is disclosed. The mechanism includes receiving one or more congestion indicators from a collector. An adjusted sampling rate is generated. The adjusted sampling rate is a specified rate of insertion of instruction headers for INT and is generated based on the congestion indicators. The adjusted sampling rate is transmitted to a head node, which is configured to perform INT via instruction header insertion into user packets.

In accordance with an embodiment, a method includes: receiving, by a dedicated security chip, first traffic from a first network interface of the protection device, where the first network interface is configured to receive traffic sent by a first network device, and a destination internet protocol (IP) address of the first traffic comprises a first IP address; determining, by the dedicated security chip, whether the first IP address exists in a first destination IP table stored on the dedicated security chip, wherein the first destination IP table comprises at least one IP address having a risk of being attacked; and in response to a determination that the first IP address exists in the first destination IP table, sending, by the dedicated security chip, the first traffic to the CPU.

A test and measurement instrument includes an acquisition memory and a processor structured to store a stream of sampled incoming data samples in the acquisition memory. As the memory fills, the instrument automatically decimates either the data samples already stored in the acquisition memory, the incoming data samples, or both. The instrument may also store two copies of the incoming data samples, one at an increased decimation rate. The two copies are tied together with a timestamp or using other methods. The more highly decimated copy may be used to produce a video output of the stored data samples, saving the instrument from generating the video output from the larger sized sample.

Monitoring an operational characteristic of a data communication device within a network includes sampling an operational characteristic of the data communication device at a fine-grain sample rate over a first sampling interval to produce fine-grain samples of the operational characteristic of the data communication device, training a machine learning algorithm using the fine-grain samples of the operational characteristic of the data communication device, the fine-grain sample rate, and a coarse-grain sample rate that is less than the fine-grain sample rate, sampling the operational characteristic of the data communication device at the coarse-grain sample rate over a second sampling interval to produce coarse-grain samples of the operational characteristic of the data communication device, and using the machine learning algorithm to process the coarse-grain samples of the operational characteristic of the data communication device to produce accuracy-enhanced samples of the operational characteristic of the data communication device.

Monitoring an operational characteristic of a data communication device within a network includes sampling an operational characteristic of the data communication device at a fine-grain sample rate over a first sampling interval to produce fine-grain samples of the operational characteristic of the data communication device, training a machine learning algorithm using the fine-grain samples of the operational characteristic of the data communication device, the fine-grain sample rate, and a coarse-grain sample rate that is less than the fine-grain sample rate, sampling the operational characteristic of the data communication device at the coarse-grain sample rate over a second sampling interval to produce coarse-grain samples of the operational characteristic of the data communication device, and using the machine learning algorithm to process the coarse-grain samples of the operational characteristic of the data communication device to produce accuracy-enhanced samples of the operational characteristic of the data communication device.

A method of recovering data from one or more failed data sectors includes estimating a reader offset position from a first or a second read attempt of the one or more failed data sectors at a current set of channel parameters and basing the estimated reader offset position on, at least in part, a position error signal generated during the first or second read attempt. At least one read is performed on the one or more failed data sectors at the estimated reader offset position to obtain one or more samples. The one or more samples are processed to obtain a processed sample. Iterative outer code recovery is performed on the processed sample.

In a system for efficiently detecting large/elephant flows in a network, the rate at which the received packets are sampled is adjusted according to the measured heavy tailedness of the arriving traffic, such that the measured heavy tailedness reaches a specified target level. The heavy tailedness is measured using the estimated sizes of different flows associated with the arriving packets. When the measured heavy tailedness reaches and remains at the specified target level, the flows having the largest estimated sizes are likely to be the largest/elephant flows in the network.