Telcordia Technologies, Inc.

Nec Laboratories America, Inc.

Vencore Labs, Inc.

Kddi Corporation

Akshay Vashist

Ritu Chadha

Abhrajit Ghosh

Ayumu Kubota

Rauf Izmailov

Yukiko Sawaya

Vladimir Vapnik

Shoshana Loeb

Kyriakos Manousakis

Alexander Poylisher

Cho-Yu Jason Chiang

Yitzchak Gottlieb

Constantin Serban

Konstantine Arkoudas

Akira Yamada

An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

System and method for correlating historical attacks with diverse indicators to generate indicator profiles for detecting and predicting future network attacks

A communication node operable to estimate faults in a mobile ad hoc network and method of performing the same. In one embodiment, the communication node includes a processor and memory including computer program code configured to, with the processor, cause the communication node to monitor a set of observable parameters at the communication node, produce a fault estimate at the communication node from the set of observable parameters, and provide the fault estimate to a global fault detector at another communication node.

Communication node operable to estimate faults in an ad hoc network and method of performing the same

A method for active learning using privileged information is disclosed. A processing device receives a set of labeled examples and a set of unlabeled examples. For each unlabeled example in the set of unlabeled examples, the processing device determines whether to query at least one of an oracle to obtain a label for the unlabeled example or a teacher to obtain privileged information about the unlabeled example. The processing device outputs a decision rule based on minimizing a number of queries to the oracle for a label and the teacher for privileged information. Minimizing the number of queries to the teacher and the oracle is based on a cost of querying the teacher or the oracle.

Active acquisition of privileged information

A system and method for secure data management is presented. The method comprises receiving a query, performing the query and obtaining answers to it, creating certain formulas representing the answers; and determining whether there is a minimum number of distinct models of these formulas conjoined with the relevant anonymity predicates along with previous answers and general background knowledge, and when that number of models does not exist, suppressing the answers. In one aspect, the method further comprises creating formulas encoding the information conveyed by the answer; and combining the formulas encoding the information with prior information.

Model-theoretic approach to data anonymity and inference control

A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

System and method for spammer host detection from network flow data profiles

Methods and systems are provided for developing decision information relating to a single system based on data received from a plurality of sensors. The method includes receiving first data from a first sensor that defines first information of a first type that is related to a system, receiving second data from a second sensor that defines second information of a second type that is related to said system, wherein the first type is different from the second type, generating a first decision model, a second decision model, and a third decision model, determining whether data is available from only the first sensor, only the second sensor, or both the first and second sensors, and selecting based on the determination of availability an additional model to apply the available data, wherein the additional model is selected from a plurality of additional decision models including the third decision model.

Robust information fusion methods for decision making for multisource data

A method and system for use in describing a phenomenon of interest. The method and system computes a decision rule for use in describing the phenomenon of interest using training data relating to the phenomenon of interest, labels for labeling the training data, and hidden information about the training data or directed distances obtained from the hidden information, as inputs.

System and method using hidden information

A system and method for support vector machine plus (SVM+) computations include selecting a set of indexes for a target function to create a quadratic function depending on a number of variables, and reducing the number of variables to two in the quadratic function using linear constraints. An extreme point is computed for the quadratic function in closed form. A two-dimensional set is defined where the indexes determine whether a data point is in the two-dimensional set or not. A determination is made of whether the extreme point belongs to the two-dimensional set. If the extreme point belongs to the two-dimensional set, the extreme point defines a maximum and defines a new set of parameters for a next iteration. Otherwise, the quadratic function is restricted on at least one boundary of the two-dimensional set to create a one-dimensional quadratic function. The steps are repeated until the maximum is determined.

Growing community of inventors

Plainsboro, NJ, United States of America

Akshay Vashist