Oracle International Corporation

Sun Microsystems, Inc.

Oracle America, Inc.

Alan Paul Wood

Aleksey M Urmanov

Kenny C Gross

Anton A Bougaev

Guang Chao Wang

Suratna Budalakoti

Randall B Smith

Matthew T Gerdes

Mengying Li

Steven T Jeffreys

Thierry Cruanes

Nipun Agarwal

Ashok V Krishnamoorthy

Garret Frederick Swart

David K McElfresh

Avishkar Misra

Onur Kocberber

Andrew Vakhutinsky

Tomas Karnagel

Yali Zhu

Leick D Robinson

Smriti R Ramakrishnan

Jorge Luis Rivero Perez

Avadh P Patel

Sanghoon Cho

Jing Long

Mengmeng Chen

Coleen L MacMillan

Aakash K Chotrani

Lawrence L Fumagalli, Jr

Beiwen Guo

Jean-Philippe Dumont

John Thomas Coulthurst

Denysse Diaz

Avadh Pratham Patel

Systems, methods, and other embodiments associated with eviction of weakly correlated signals from collections are described. In one embodiment, a mock signal that has random signal properties is generated. A mock correlation coefficient between the mock signal and a measured time series signal from a collection of measured time series signals is then generated. A discrimination value that indicates a weak signal correlation is then selected, based at least in part on the mock correlation coefficient. A first measured signal is then identified from the collection of measured time series signals that has the weak signal correlation by determining that a first correlation coefficient between the first measured signal and a second measured signal is weak based on the discrimination value. The first measured signal is then evicted from the collection of signals in response to the determination that the first measured signal has the weak signal correlation.

Eviction of weakly correlated signals from collections

Embodiments generate a demand model for a potential hotel customer of a hotel room. Embodiments, based on features of the potential hotel customer, form a plurality of clusters, each cluster including a corresponding weight and cluster probabilities. Embodiments generate an initial estimated mixture of multinomial logit ('MNL') models corresponding to each of the plurality of clusters, the mixture of MNL models including a weighted likelihood function based on the features and the weights. Embodiments determine revised cluster probabilities and update the weights. Embodiments estimate an updated estimated mixture of MNL models and maximize the weighted likelihood function based on the revised cluster probabilities and updated weights. Based on the update weights and updated estimated mixture of MNL models, embodiments generate the demand model that is adapted to predict a choice probability of room categories and rate code combinations for the potential hotel customer.

Artificial intelligence based hotel demand model

Systems, methods, and other embodiments for sorting-based assignment to optimize order fulfillment with short supply. One embodiment includes identifying a set of one or more distributions within a series of days. Sorting all demands of a first priority level occurring in the series of days by ascending order of size of the demand. For each demand of the first priority level in sorted order, (a) selecting an initial distribution during which the demand is scheduled to be fulfilled from the set of distributions, and (b) generating an indication that the demand can cannot be completely fulfilled, based on the size of the demand and the amount of supply available. Automatically arranging a graphical representation of a schedule of supplies and met and unmet demands for the series of days in a graphical user interface based at least on the indications generated for each demand.

Rapid sorting-based supply assignment tool for order fulfillment with short supply

The disclosed embodiments relate to a system that automatically selects a prognostic-surveillance technique to analyze a set of time-series signals. During operation, the system receives the set of time-series signals obtained from sensors in a monitored system. Next, the system determines whether the set of time-series signals is univariate or multivariate. When the set of time-series signals is multivariate, the system determines if there exist cross-correlations among signals in the set of time-series signals. If so, the system performs subsequent prognostic-surveillance operations by analyzing the cross-correlations. Otherwise, if the set of time-series signals is univariate, the system performs subsequent prognostic-surveillance operations by analyzing serial correlations for the univariate time-series signal.

Automatic data-screening framework and preprocessing pipeline to support ML-based prognostic surveillance

Techniques are described for generating an approximate frequency histogram using a series of Bloom filters (BF). For example, to estimate the f1 and f2 cardinalities in a dataset, an ordered chain of three BFs is established ('BF1', 'BF2', and &#x201c;BF3&#x201d;). An insertion operation is performed for each datum in the dataset, whereby the BFs are tested in order (starting at BF1) for the datum. If the datum is represented in a currently-tested BF, the subsequent BF in the chain is tested for the datum. If the datum is not represented in the currently-tested BF, the datum is added to the BF, a counter for the BF is incremented, and the insertion operation for the current datum ends. To estimate the cardinality of f1-values in the dataset, the BF2-counter is subtracted from the BF1-counter. Similarly, to estimate the cardinality of f2-values in the dataset, the BF3-counter is subtracted from the BF2-counter.

Chaining bloom filters to estimate the number of keys with low frequencies in a dataset

The disclosed embodiments relate to a system that compactly stores time-series sensor signals. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in a monitored system. Next, the system formulizes the original time-series sensor signals to produce a set of equations, which can be used to generate synthetic time-series signals having the same correlation structure and the same stochastic properties as the original time-series signals. Finally, the system stores the formulized time-series sensor signals in place of the original time-series sensor signals.

Formulizing time-series sensor data to facilitate compact storage and eliminate personally identifiable information

During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Detecting anomalies in software service usage activity

Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Multi-distance similarity analysis with tri-point arbitration

The disclosed embodiments relate to a system that facilitates development of machine-learning techniques to perform prognostic-surveillance operations on time-series data from a monitored system, such as a power plant and associated power-distribution system. During operation, the system receives original time-series signals comprising sequences of observations obtained from sensors in the monitored system. Next, the system decomposes the original time-series signals into deterministic and stochastic components. The system then uses the deterministic and stochastic components to produce synthetic time-series signals, which are statistically indistinguishable from the original time-series signals. Finally, the system enables a developer to use the synthetic time-series signals to develop machine-learning (ML) techniques to perform prognostic-surveillance operations on subsequently received time-series signals from the monitored system.

Synthesizing high-fidelity time-series sensor signals to facilitate machine-learning innovations

The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies. When an anomaly is detected, the system triggers an alert.

Detecting anomalies during operation of a computer system based on multimodal data

Dynamic generation and implementation of assignment mappings of data items in large data files to distributed processors to achieve objectives such as reduced overall processing time like. Any appropriate key (e.g., character string) can be identified or obtained for each data item in a data file and the file can be segmented into sequential data blocks, where each data block includes a set of data items. The data items in each of a first plurality of the blocks (e.g., sampled block set) may be initially sorted into one of a plurality of key ranges of a search space (each corresponding to a different respective processor) and analyses conducted on the data items totals in each key range. The key range boundaries can be adjusted by accounting for uncertainty in the sample estimates to more evenly distribute data items from all blocks sent to each processor and thereby achieve the objective.

Load balancing for distributed processing of deterministically assigned data using statistical analysis of block data

Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Multi-distance clustering

The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

System and method for protecting online resources against guided username guessing attacks

The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.

Anomaly detection based on events composed through unsupervised clustering of log messages

Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for a user authentication attempt to access a secure computer resource, user authentication log data having user attribute values is collected. The user authentication log data is transformed into a tracer data structure. The tracer data structure is augmented with timestamp data to generate an event data structure. It is determined whether the tracer data structure matches an existing tracer data structure stored in a rules database and, if not, a novelty flag is set to generate a new user behavior model filter. If the tracer data structure matches the existing tracer data structure: an existing user behavior model filter is applied, issuance of an alarm message or signal is controlled, and the existing user behavior model filter is updated based, at least in part, on the event data structure.

Growing community of inventors

San Jose, CA, United States of America

Alan Paul Wood