Nicholas D Scott

US Patent:

20180205756, Jul 19, 2018

Filed:

Jan 19, 2017

Appl. No.:

15/409892

Inventors:

- Burlington MA, US
Andrew D. Mortensen - Ann Arbor MI, US
James E. Winquist - Ypsilanti MI, US
Ronald G. Hay - Ann Arbor MI, US
Nicholas Scott - Ann Arbor MI, US

Assignee:

Arbor Networks, Inc. - Burlington MA

International Classification:

H04L 29/06
H04L 12/26
H04L 12/24

Abstract:

A system and method are provided to select mitigation parameters. The method includes receiving selection of at least one mitigation parameter, accessing a selected portion of stored network traffic or associated summaries that corresponds to a selectable time window, applying a mitigation to the selected portion of the stored network traffic or associated summaries using the selected at least one mitigation parameter, and outputting results of the applied mitigation.

US Patent:

20180152474, May 31, 2018

Filed:

Nov 28, 2016

Appl. No.:

15/362250

Inventors:

- Burlington MA, US
Ronald G. Hay - Ann Arbor MI, US
Nicholas Scott - Ann Arbor MI, US

International Classification:

H04L 29/06
H04L 12/26

Abstract:

A method for configuring a network monitoring device is provided. One or more performance metrics associated with one or more thresholds to be configured are received from a user. Historical network traffic flow information associated with a previously detected malicious activity is analyzed to identify characteristic values for the one or more performance metrics. Threshold values are automatically configured based on the identified characteristic values.

US Patent:

20160134503, May 12, 2016

Filed:

Nov 7, 2014

Appl. No.:

14/536346

Inventors:

- Burlington MA, US
James E. Winquist - Tpsilanti MI, US
Jeremiah Martell - Ann Arbor MI, US
Nicholas Scott - Ann Arbor MI, US

Assignee:

ARBOR NETWORKS, INC. - Burlington MA

International Classification:

H04L 12/26
H04L 29/08

Abstract:

A method for network traffic characterization is provided. Flow data records are acquired associated with a security alert signature. Unidimensional traffic clusters are generated based on the acquired data. A Bloom filter is populated with the acquired flow data records. Clusters of interest are identified from the generated unidimensional traffic clusters. The identified clusters of interest are compressed into a compressed set. A determination is made whether a multidimensional processing of the acquired flow data needs to be performed based on a priority associated with the alert signature. A multidimensional lattice corresponding to the unidimensional traffic clusters is generated. The multidimensional lattice is traversed and for each multidimensional node under consideration a determination is made if the Bloom filter contains flow records matching the multidimensional node under consideration. A determination is made if the unidimensional node corresponding to the multidimentional node is included in the compressed set of unidimensional nodes.