Abstract: We present a payload-based anomaly detector, we call PAYL, for intrusion detection. PAYL models the normal application payload of network traffic in a fully automatic, unsupervised and very effecient fashion. We first compute during a training phase a profile byte frequency distribution and their standard deviation of the application payload flowing to a single host and port. We then use Mahalanobis distance during the detection phase to calculate the similarity of new data against the pre-computed profile. The detector compares this measure against a threshold and generates an alert when the distance of the new input exceeds this threshold. We demonstrate the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset we collected on the Columbia CS department network. In once case nearly 100% accuracy is achieved with 0.1% false positive rate for port 80 traffic.

Abstract: An architecture for an integrated circuit apparatus and method that allows significant performance improvements for signature based network applications. In various embodiments the architecture allows high throughput classification of packets into network streams, packet reassembly of such streams, filtering and pre-processing of such streams, pattern matching on header and payload content of such streams, and action execution based upon rule-based policy for multiple network applications, simultaneously at wire speed. The present invention is improved over the prior art designs, in performance, flexibility and pattern database size.

Abstract: A digital payload for processing a sub-band spectrum received on an uplink beam at a communications satellite includes a digital channelizer, a digital switch matrix and a digital combiner. The digital channelizer divides the sub-band spectrum into a plurality of frequency slices that can be routed by the digital switch matrix to any of a number of receiving ports. A digital combiner receives the frequency slices and re-assembles them to form one or more output sub-bands for transmission on an output beam of the communications satellite. The digital payload may also include an embeddable digital regeneration module configured to demodulate some or all of the sub-band spectrum to extract a digital bitstream therefrom. The digital bitstream may be processed to implement code-based multiplexing, switching, access control, and other features.

Abstract: A method for encoding network data, such as Internet Protocol (IP) data, into a format for transmission over a satellite system is described. The network data is configured in a packet having a data block and header information. The network data packet is encoded into a variable-length multi-packet transport (MPT) frame. The MPT frame comprises a data frame to hold data and header information. The IP packet in inserted its entirety into the data frame of the MPT frame. The variable-length MTP frame is then encoded into one or more fixed-length MTP packets. Each MPT packet has a data fragment block comprising a portion of the MTP frame and associated header information to designate what portion of the MTP frame is contained in the data fragment block. The MPT packets are sized to be embedded as a specific size payload of the satellite packet that is transmitted over a satellite network. Using this method, data received over a data network (i.e., Ethernet or Internet) in large network data packets are broken into smaller packets defined by the mult-packet transport. These smaller packets are then inserted as the data payload within standard fixed-size packets suitable for transmission across a particular distribution medium, such as satellite network. The network data remains independent of the underlying network and can be easily extracted at the receiver for use by computer applications.

Abstract: According to one embodiment, a digital stream, inclusive of an Internet Protocol (IP) datagram, is transmitted to a digital device. IP datagram comprises an IP header and a body segmented including a plurality of packets in an MPEG format such as MPEG-2 or MPEG-4 for example. The plurality of packets comprises (i) a first packet including a payload having content and a header that comprises a first packet identifier to indicate a type of the content contained in the payload of the first packet, and (ii) a second packet including a payload and a secondary packet identifier to indicate that its payload includes content duplicative of the content contained in the first packet. The second packet precedes the first packet in the digital stream. Upon detecting the presence of duplicative content, the duplicative content is recovered, but the content contained in the payload of the first packet is disregarded.

Abstract: Modern Network Intrusion Detection Systems (NIDS) inspect the network packet payload to check if it conforms to the security policies of the given network This process, often referred to as deep packet inspection, involves detection of predefined signature strings or keywords starting at an arbitrary location in the payload String matching is a computationally intensive task and can become a potential bottleneck without high-speed processing Since the conventional software-implemented string matching algorithms have not kept pace with the increasing network speeds, special purpose hardware solutions have been introduced In this paper we show how Bloom filters can be used effectively to perform string matching for thousands of strings at wire speed We describe how Bloom filters can be implemented feasibly on commodity FPGA Our analysis shows that this approach for string matching is more effective than the current FPGA-based solutions which use Deterministic or Non-deterministic Finite Automata (DFA or NFA) Finally, we give the details of our implementation of string matching technique on Xilinx XCV 2000E FPGA

Abstract: A method is disclosed for reducing the sizes of application layer messages in a network element such as a network switch or router. According to one aspect, the network element receives data packets and determines an original application layer message that is collectively contained in payload portions of the data packets. The network element compresses the original application layer message into a compressed message, and sends the compressed message toward an application that is hosted on a device other than the network element. According to another aspect, the network element receives data packets and determines a compressed message that is collectively contained in payload portions of the data packets. The network element decompresses the compressed message into an original application layer message, and sends the original application layer message toward an application that is hosted on a device other than the network element. Compressed messages consume less network bandwidth.

Abstract: A method for pre-computing a streaming media payload in a server includes receiving a data file from a streaming media server, determining a plurality of data packets from the data file, dividing the plurality of data packets into a plurality of sets of data packets, forming a plurality of data objects, each data object comprising a set of data packets from the plurality of sets of data packets, and storing the plurality of data objects in a server memory, wherein each data object is individually accessible from the server memory.

Abstract: Techniques for transmitting overhead information to facilitate efficient reception of individual data streams are described. A base station may transmit multiple data streams on multiple data channels (or MLCs). The MLCs may be transmitted at different times and on different frequency subbands. The time-frequency location of each MLC may change over time. The overhead information indicates the time-frequency location of each MLC and may be sent as “composite” and “embedded” overhead information. The composite overhead information indicates the time-frequency locations of all MLCs and is sent periodically in each super-frame. A wireless device receives the composite overhead information, determines the time-frequency location of each MLC of interest, and receives each MLC at the indicated time-frequency location. The embedded overhead information for each MLC indicates the time-frequency location of that MLC in the next super-frame and is transmitted along with the payload of the MLC in the current super-frame.

Abstract: A method of embedding a digital watermark into a halftone image. The method redundantly encodes a multi-bit message, and transforms the encoded message to a multilevel per pixel watermark image. It then derives halftone thresholds from the multilevel per pixel watermark image. These thresholds are then used to convert target images into watermarked halftone images. The multilevel pixels in the target image are used to select corresponding halftone thresholds from the halftone thresholds derived from the watermark image. The selected thresholds are applied to corresponding multilevel pixels in the watermark image to create the watermarked halftone image of the target image. A method of measuring digital watermark strength. In this method, a watermarked signal is processed to extract estimates of error correction encoded bits embedded into the watermarked signal. Then, the error correction encoded bits are decoded to compute a message payload. The message payload is re-encoded to compute error correction encoded bits. A measure of watermark strength is computed from the error correction encoded bits and the estimates of error correction encoded bits. In particular, in one implementation the soft bit estimates decoded from the watermarked signal are multiplied by corresponding re-computed error correction encoded bits and summed to get a measure of the watermark signal strength. This measurement may be compared with a threshold to detect tampering with the watermarked signal, such as compression, scanning and re-printing, photo-copying, etc. For printing applications, the embedded digital watermark may be used to carry printer information that is later decoded by a watermark detector and used to examine a digital scan of a printed object and determine whether the printed object is authentic.

Abstract: Intrusion detection systems (IDSs) are relatively complex devices that monitor information systems in search for security violations. Characterizing the service times of network IDSs is a crucial step in improving their real time performance. We analyzed about 41 million packets organized in five data sets of 10 minutes each collected at the entry point of a large production network and processed by Snort, a commonly used IDS. The processing times of the three main stages in Snort were measured. The main conclusions of our study were: (1) rule checking accounts for about 75% of the total processing time in IDSs, with mean pay load checking time being 4.5 times larger than mean header checking time. (2) The distribution of rule checking limes is markedly bimodal, a direct consequence of the bimodality in packet composition in current high speed Internet traffic. (3) Header processing times have a small variance and small correlation coefficients. (4) In contrast, the distribution of payload processing times displays high variance, in a form that can be generally characterized as "slightly heavy-tailed". Explicitly, payload processing times have a lognormal upper tail, clipped at the top 1%. This extreme 1% upper tail is better fit by an exponential distribution. (5) Additionally, payload processing times were shown to be highly correlated, with correlation coefficients several orders of magnitude higher than the confidence bands for the standard whiteness test. The impact of these findings in the design of IDSs for real time operation in networks is discussed, and compared with existing results for processing times for Unix processes, which were shown to display pronounced heavy-tailed characteristics.

Abstract: A novel technique for optical multiplexing of label and payload using optical carrier suppression and separation is proposed and experimentally demonstrated. No power penalty is observed when the payload and label, with signal extinction ratio >11 dB, are transmitted over 60-km standard single-mode fiber with full-dispersion compensation. The technique of the optical label generation offers many advantages compared with previous techniques.

Abstract: A real-time transport protocol (RTP) describes a payload format for transporting IEC 61883-1 CIP compliant IEEE 1394-2000 isochronous transport data. The transport data includes a stream format, such as DV (Digital Video), AM824 (Audio/Music data format with an 8-bit header and 24 bits of audio), or MPEG, that has been packetized for isochronous transport by a source. The payload format is opaque to the transport mechanism. The isochronous transport clock is derived from the IEEE 1394-2000 cycle timer clock. The RTP is used to transport IEEE 1394-2000, IEC 61883 compliant data streams between IEEE 1394-2000 buses using IP (Internet Protocol), specifically, Ethernet/IP. Alternatively, other IP formats are used.

Abstract: A wireless local area network (WLAN) device transmits a header over an air interface, at a first modulation rate. The header may include an indication of a second modulation rate that will be used to transmit a consolidated payload. In one embodiment, the header includes information that enables a receiver to determine when an end of each of the multiple data units will occur. The device further transmits the consolidated payload at the second modulation rate. The consolidated payload includes multiple data units. In one embodiment, the consolidated payload includes information that enables the receiver to determine when an end of each of the multiple data units will occur.

Abstract: Systems and methods are disclosed for providing security to an identification document having at least one storage element capable of storing information. An encryption key is provided, the encryption key comprising a public key and a private key. An optically variable device (OVD) in a machine readable format is created, the OVD associated with the public key. A payload of data is generated for storage in the storage element. At least a portion of the payload of data is encrypted with the private key, and the encrypted payload of data is transmitted to at least one location on the identification document. At least a portion of the data payload can be based on data that is randomly selected from data stored in the storage element or that is encrypted from data that is stored in the storage element. The storage element can comprise an optically variable device (OVD), optical storage media, hologram, KINEGRAM, Exelgram, Pixelgram, three dimensional bar code, a two dimensional bar code, a magnetic stripe, and a chip. Transmitting the encrypted payload can comprise at least one of embedding, digitally watermarking, printing, and encoding encrypted data in at least one location on the identification document.

Abstract: Provided is an information recording medium which achieves high speed conversion of a signal input from external from MPEG-TS to MPEG-PS complying with DVD standard. An apparatus and a method for recording information to the information recording medium are also provided. A constrained format which enables conversion from a first stream (for example, MPEG transport stream) to a second stream (for example, MPEG program stream ) is provided. The constrained format defines that a first packet (for example, TS packet) is grouped and managed in multiplexing unit. The first one (AF#8) of complete audio frames in the multiplexing unit (402) is the first one of audio frames in a payload of a second packet (for example, PES packet) (413).

Abstract: A packet data generating method and apparatus for supporting multiple services in a wireless packet data communication system where an MS transmits two or more traffics to a BS on one of a reverse PDCH, a reverse FCH, and a reverse DCCH. To generate a PDU using non-signaling traffic and/or signaling traffic for one of the reverse physical channels, a multiplex option is determined during service negotiations between the MS and the BS. The multiplex option defines a traffic format having a header and a payload including traffic data, and the header includes a service reference identifier field, a length indicator field indicating the presence or absence of a length field, and the length field indicating the length of the traffic data. A PDU is generated by formatting a reverse traffic to have a header and a payload according to the determined multiplex option.

Abstract: A server system facilitates an exchange of messages with a remote client application. The server system includes a plurality of application servers hosting a plurality of applications. A plurality of Application Program Interfaces (APIs) provides programmatic access to the plurality of applications, each of the APIs being configured to receive request messages compiled by the remote client application. First and second request messages, respectively addressed to first and second APIs of the plurality of APIs by a remote client application, each comprise at least one common data component. Further, the first request message includes a first payload specific to the first API, and the second request message includes a payload specific to the second API.

Abstract: An efficient use of communication resources is provided by determining a behavior for selecting the payload size (data rate) of a reverse link transmission from a mobile station to a base station. The mobile station may store a predetermined table including the ratio of the power levels of the traffic channel and pilot channel (TPR), where each entry corresponds to one or more specific sizes of data payload, and consequently a data rate for transmission in a predetermined time frame. The payload size is selected based on an authorized-TPR. The authorized-TPR and a target-TPR are adjusted in accordance with a value of common TPR commands received from the base station. A fast-ramp-up behavior for adjustments of the authorized-TPR is followed when the authorized-TPR is less than the target-TPR. The down TPR commands are ignored in the adjustments of the authorized-TPR to allow following a fast-ramp-up behavior.

Abstract: PROBLEM TO BE SOLVED: To provide a communications device, communication method and communications system, capable of being used together with current devices, of solving the overhead caused due to sending multiple frames by promoting efficiency of a frame format, and of thus improving substantial communication throughput. SOLUTION: The communications device comprises a physical frame construction means for constructing a physical frame having a medium access control super frame payload, including a plurality of medium access control frames; a first setting means for setting virtual carrier sense information in the plurality of medium access control frames so that the result of carrier sensing, with respect to the physical frame constructed by the physical frame construction means is the same, even by virtual carrier sensing based on the plurality of medium access control frame in the medium access control super frame payload; and a transmission means for transmitting the physical frame, in which the virtual carrier sense information is set by the first setting means to a destination communications device. COPYRIGHT: (C)2005,JPO&NCIPI

Abstract: An apparatus including a first integrated circuit (IC) (202), a second IC (204), and an interface coupling the first IC to the second IC (200). The interface transfers payload control information between the first IC and the second IC utilizing a number of data transmission lines. On the clock cycle transition following the transfer of payload control information, the interface transfers packetized data between the first IC and the second IC at a data rate of at least approximately 20Gbps utilizing the same transmission lines. A one-bit control signal is used by the interface to identify when payload control information is present on all of the data transmission lines.

Abstract: Systems and methods for encoding packetized data include applying different codings to the header and the payload. The header of a data packet is encoded for error correction separately from the payload of the data packet. The use of separate error correction techniques for the header and payload of a packet permits optimization of each for use in a data network, and more particularly, in a wireless data network.

Abstract: The present invention provides a device, system, and method for a portable handheld device for displaying information. An embodiment of the invention provides a portable handheld device for displaying information, including traffic information. The portable device includes a wireless receiver arranged for receiving an information-data packet having at least one payload element, a translation table arranged for decoding a payload element, and a microcontroller including a memory and a processor, and which is operable to decode the at least one payload element. The device also includes an information viewing screen that includes an incorporated traffic map having road-display segments corresponding to selected roads and the visual display, the visual display having a plurality of individually controllable display elements corresponding to the road-display segments, each element corresponding to a road-display segment and being arranged to display a plurality of visual properties each representing a different traffic condition.

Abstract: A method, apparatus and computer program product for providing rapid information dissemination using network coding is presented. A coded message including a payload and a code vector, is transmitted from a first node of the network to a second node of the network. The information thus stored can also be retrieved by collecting code vectors from at least one node and viewing the collected code vectors as a matrix. A determination is made regarding whether a dimension of the matrix is equal to a predefined number. When the dimension of the matrix equals the predefined number, the information is retrieved using the collection of code vectors in the matrix.

Abstract: A communication system (200) conveys Multimedia Broadcast Multicast Service (MBMS) data to multiple mobile stations (MSs) (202-205) subscribing to an MBMS service while minimizing possible congestion over an Iub interface (214). A network controller (216) receives at least one MBMS data packet comprising an MBMS payload. In response to receiving the at least one data packet, the network controller establishes communication channels to the multiple MSs for conveyance of MBMS data and conveys to a downstream network element (212), via the Iub interface, a single copy of the payload. The downstream network element replicates the received payload to produce a copy of the payload for each established communication channel. The downstream network element then assembles, in association with each established communication channel, a set of one or more data packets for conveyance via the established communication channel, wherein each set of data packets includes a copy of the payload.

Abstract: A method for determining a fan speed for a fan used to cool a payload is disclosed. The method includes, according to various embodiments, receiving a first signal indicative of a first fan speed and receiving a second signal indicative of a system temperature. The method further includes selecting a temperature setpoint based on the first fan speed and, based on a comparison of the system temperature and the selected temperature setpoint, computing a first fan speed output. A thermal management system and method for determining a speed-setpoint droop characteristic are also disclosed.

Abstract: The present invention disclosed herein is an asynchronous switch for an network on chip application making possible between IP (Intellectual Property) communication among various IPs in the network on chip. The asynchronous switch according to the present invention in which comprises a data input unit for receiving and storing a plurality of data flits, and confirming whether a kind of each data flit is a header flit or a payload flit according to a transmission request signal; an output port arbitration unit for outputting an output port selection signal showing a output priority of the data by receiving a header flit request signal, final payload flit process request signal, routing information of the header flit, and the a arbitration request signal from the data input unit; and a data output unit for receiving a header storage request signal and a payload storage request signal from the data input unit, temporarily storing the data flit inputted from the data transmission path setting unit, transferring header and payload storage completion signals indicating that the data flit is stored to the data input unit, and outputting the temporarily stored data flit to a designated port according to a pre-set order.

Abstract: A method of communicating messages among a number of radio communications devices via a communications medium, each of said messages comprising a message header and a message payload. The method comprises transmitting the message header of a first message, where the first message is to be transmitted from a first one of the number of radio communications devices to at least a second one of the number of radio communications devices, at a first power level high enough to enable each of the number of radio communications devices to receive the message header, transmitting the message payload of the first message at a second power level determined separately from the first power level to be high enough to enable the second radio communications device to receive the message payload.

Abstract: Path information is obtained in a bridged network by generating an L2 frame with a special MAC address in the header and a target MAC address embedded in the payload of the frame. The special MAC address in the header of the frame triggers the collection of path information as the frame traverses the bridged network while the target MAC address in the payload of the frame is used to forward the frame in the bridged network. In an embodiment, the destination MAC address of the frame is set to a special MAC address that identifies the frame as a “trace-path” frame, for example, a multicast MAC address.