An apparatus and associated method for processing packets transmitted in a packet-switched communication network includes a sampling module that identifies amongst the received packets a plurality of samples distributed in a statistically uniform way amongst at least two non-overlapping sample sequences. Each sample sequence is then subjected to at least one identification rule, thereby identifying in the sample sequence at least one sub-sequence of samples fulfilling the at least one identification rule. The identification rule comprises a condition on the value of at least one identification field of the packets. Then, at least one parameter indicative of a behavior of the at least one sub-sequence of samples is provided.

A stream processing system in a first zone of a telecommunication network may obtain at least one policy for processing trace data of virtual network functions (VNFs) in the first zone, and obtain the trace data of the VNFs from a data distribution platform of the telecommunication network, where the trace data is published in accordance with a topic to the data distribution platform by the VNFs, and where the stream processing system comprises a subscriber to the topic. The first stream processing system may additionally forward at least a first portion of the trace data to a second stream processing system of the telecommunication network in accordance with the at least one policy, where the first portion comprises less than all of the trace data, and where the second stream processing system is for a region of the telecommunication network that includes the first zone and a second zone.

A system controls a transmission of data. A sensor datum measured by a sensor is received. Whether to send the received sensor datum to a multiplexer is determined based on a predefined real time download rate. When the determination indicates to send the received sensor datum to the multiplexer, the received sensor datum is sent to the multiplexer. When the determination does not indicate to send the received sensor datum to the multiplexer, the received sensor datum is written to a data file. The written sensor datum is sent from the data file to the multiplexer when there is an indicator of excess available bandwidth.

Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.

Provided are a data sampling method and apparatus for a network device, a device, and a medium. The data sampling method for a network device includes: configuring, by a central processing unit (CPU), a sampling parameter of target data to a coprocessor; generating, by the coprocessor, a sampling instruction packet at a set frequency according to the sampling parameter, and sending the sampling instruction packet to a network processing unit (NPU); and generating, by the NPU, a sampling reporting packet of the target data according to the sampling instruction packet, and sending the sampling reporting packet to the CPU.

An information processing device capable of reducing an amount of data to be monitored in an onboard system is provided. The information processing device obtains a first log including, per unit time, some communication data flowing through the onboard system. The information processing device determines whether an abnormality is included in the communication data, using the first log. In a case where the abnormality is included in the communication data, the information processing device outputs first detection results to the onboard system. The first detection results cause transmission of a second log from the onboard system. The second log includes, per the unit time, more of the communication data than the first log.

An information processing device capable of reducing an amount of data to be monitored in an onboard system is provided. The information processing device obtains a first log including, per unit time, some communication data flowing through the onboard system. The information processing device determines whether an abnormality is included in the communication data, using the first log. In a case where the abnormality is included in the communication data, the information processing device outputs first detection results to the onboard system. The first detection results cause transmission of a second log from the onboard system. The second log includes, per the unit time, more of the communication data than the first log.

A system for detecting the topology and phase information of an electrical power distribution system is provided. For example, the system includes a group of meters connected to an electrical power distribution system and can communicate with each other through local network connections such as a mesh network. Each of the meters is configured to generate and transmit voltage data to a correlator of the group of meters. The correlator calculates the correlations between each pair of meters in the group based on the voltage data received and further transmits the calculated correlations to a mapper through the mesh network. The mapper determines the topological or phase relationship between at least the group of meters based on the received correlations.

A network device that operates as an analysis platform for analysis of event data records that can provide a flexible approach to event data record aggregation. For example, aggregation can be flexibly turned on or off and dynamically adjusted based on event record volume and other factors such as network capacity or throughput. Devices that are instructed to aggregate records can also be instructed to archive the raw records, e.g., to maintain a full fidelity log of events. Devices can further be instructed to utilize a mixed queue approach to determine an order to deliver those records that includes both older records and newer records.

A monitoring apparatus includes: a data collection unit that collects from a wireless communication apparatus log information including information indicating change in a modulation scheme within a previously fixed first time period; an analysis unit that fixes the wireless communication apparatus as a monitored apparatus, in a case where the number of changes in the modulation scheme exceeds a first threshold value in the first time period; a data collection unit that collects from the wireless communication apparatus information on a modulation scheme applied when wireless communication is performed for each second time period shorter than the first time period, and information on a data amount transmitted and received by applying the modulation scheme in the second time period; and a line use rate calculation unit that calculates a line use rate of a wireless line in a wireless section using the information collected in the data collection unit.