Nec Corporation

Nec Laboratories America, Inc.

Alcatel Lucent

Cristian Lumezanu

Haifeng Chen

Guofei Jiang

Dongjin Song

Yuncong Chen

Nipun Arora

Yueping Zhang

Vishal Kumar Singh

Hui Joyce Zhang

Katherine Hua Guo

Bo Zong

Takehiko Mizoguchi

Daeki Cho

Qiang Xu

Junghwan Rhee

Mingda Li

Abhishek Sharma

Curtis Yu

Wei Cheng

Wei Zhu

Bo Dong

Ye Wang

Cheng Jin

Takehiko Mizuguchi

Kai Chen

Zhengzhang Chen

Masanao Natsumeda

Xiao Yu

Xuchao Zhang

Qi Song

Ahsan Arefin

Hao Yuan

Xiaoyuan Liang

Youfu Li

Jurijs Nazarovs

Hyun-Wook Baek

Zhuotao Liu

Kyriakos Zanfis

Chuxu Zhang

Hui Lu

Anupam Das

Hui Zhang

Vishal Singh

Methods and systems for training a neural network include collecting model exemplar information from edge devices, each model exemplar having been trained using information local to the respective edge devices. The collected model exemplar information is aggregated together using federated averaging. Global model exemplars are trained using federated constrained clustering. The trained global exemplars are transmitted to respective edge devices.

Federated learning for anomaly detection

Edge-side federated learning for anomaly detection

A method classifies missing labels. The method computes, using a neural network model trained on training data, rank-based statistics of a feature of a time series segment to attempt to select two candidate labels from the training data that the segment most likely belongs to. The method classifies the segment using k-NN-based classification applied to the training data, responsive to the two candidate labels being present in the training data. The method classifies the segment by hypothesis testing, responsive to only one candidate label being present in the training data. The method classifies the segment into a class with higher values of the rank-based statistics from among a plurality of classes with different values of the rank-based statistics, responsive to no candidate labels being present in the training data. The method corrects a prediction by an applicable one of the classifying steps by majority voting with time windows.

Ordinal time series classification with missing information

A method for system metric prediction and influential events identification by concurrently employing metric logs and event logs is presented. The method includes concurrently modeling multivariate metric series and individual events in event series by a multi-stream recurrent neural network (RNN) to improve prediction of future metrics, where the multi-stream RNN includes a series of RNNs, one RNN for each metric and one RNN for each event sequence and modeling causality relations between the multivariate metric series and the individual events in the event series by employing an attention mechanism to identify target events most responsible for fluctuations of one or more target metrics.

Causal attention-based multi-stream RNN for computer system metric prediction and influential events identification based on metric and event logs

Methods and systems of training and using a neural network model include training a time series embedding model and a text embedding model with unsupervised clustering to translate time series and text, respectively, to a shared latent space. The time series embedding model and the text embedding model are further trained using semi-supervised clustering that samples training data pairs of time series information and associated text for annotation.

Embedding multi-modal time series and text data

Systems and methods for updating a classification model of a neural network. The methods include selecting, as a set of landmarks, a limited number of data from a set of historical data used to train a classification model. Additionally, the methods generate new training data from recently collected data. Further, the methods update the classification model with the new training data and the set of landmarks to obtain an updated classification model having a loss function configured to capture similarities in the new training data and remember similarities in the historical data represented by the set of landmarks within a predefined tolerance.

Landmark-based classification model updating

Methods and systems for detecting and correcting anomalies includes generating historical binary codes from historical time series segments. The historical time series segments are each made up of measurements from respective sensors. A latest binary code is generated from a latest time series segment. It is determined that the latest time series segment represents anomalous behavior, based on a comparison of the latest binary code to the historical binary codes. The sensors are ranked, based on a comparison of time series data of the sensors in the latest time series segment to respective time series data of the historical time series, to generate a sensor ranking. A corrective action is performed responsive to the detected anomaly, prioritized according to the sensor ranking.

Sensor attribution for anomaly detection

A system for cross-modal data retrieval is provided that includes a neural network having a time series encoder and text encoder which are jointly trained using an unsupervised training method which is based on a loss function. The loss function jointly evaluates a similarity of feature vectors of training sets of two different modalities of time series and free-form text comments and a compatibility of the time series and the free-form text comments with a word-overlap-based spectral clustering method configured to compute pseudo labels for the unsupervised training method. The computer processing system further includes a database for storing the training sets with feature vectors extracted from encodings of the training sets. The encodings are obtained by encoding a training set of the time series using the time series encoder and encoding a training set of the free-form text comments using the text encoder.

Word-overlap-based clustering cross-modal retrieval

A method is provided. Intermediate audio features are generated from respective segments of an input acoustic time series for a same scene. Using a nearest neighbor search, respective segments of the input acoustic time series are classified based on the intermediate audio features to generate a final intermediate feature as a classification for the input acoustic time series. Each respective segment corresponds to a respective different acoustic window. The generating step includes learning the intermediate audio features from Multi-Frequency Cepstral Component (MFCC) features extracted from the input acoustic time series, dividing the same scene into the different windows having varying MFCC features, and feeding the MFCC features of each window into respective LSTM units such that a hidden state of each respective LSTM unit is passed through an attention layer to identify feature correlations between hidden states at different time steps corresponding to different ones of the different windows.

Audio scene recognition using time series analysis

Methods and systems for anomaly detection and correction include generating original signature matrices that represent a state of a system of multiple time series. The original signature matrices are encoded using convolutional neural networks. Temporal patterns in the encoded signature matrices are modeled using convolutional long-short term memory neural networks for each respective convolutional neural network. The modeled signature matrices using deconvolutional neural networks. An occurrence of an anomaly is determined using a loss function based on a difference between the decoded signature matrices and the original signature matrices. A corrective action is performed responsive to the determination of the occurrence of the anomaly.

Unsupervised anomaly detection, diagnosis, and correction in multivariate time series data

Systems and methods for preventing cyberattacks using a Density Estimation Network (DEN) for unsupervised anomaly detection, including constructing the DEN using acquired network traffic data by performing end-to-end training. The training includes generating low-dimensional vector representations of the network traffic data by performing dimensionality reduction of the network traffic data, predicting mixture membership distribution parameters for each of the low-dimensional representations by performing density estimation using a Gaussian Mixture Model (GMM) framework, and formulating an objective function to estimate an energy and determine a density level of the low-dimensional representations for anomaly detection, with an anomaly being identified when the energy exceeds a pre-defined threshold. Cyberattacks are prevented by blocking transmission of network flows with identified anomalies by directly filtering out the flows using a network traffic monitor.

Density estimation network for unsupervised anomaly detection

Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.

Network gateway spoofing detection and mitigation

A method is provided. Intermediate audio features are generated from an input acoustic sequence. Using a nearest neighbor search, segments of the input acoustic sequence are classified based on the intermediate audio features to generate a final intermediate feature as a classification for the input acoustic sequence. Each segment corresponds to a respective different acoustic window. The generating step includes learning the intermediate audio features from Multi-Frequency Cepstral Component (MFCC) features extracted from the input acoustic sequence. The generating step includes dividing the same scene into the different acoustic windows having varying MFCC features. The generating step includes feeding the MFCC features of each of the different acoustic windows into respective LSTM units such that a hidden state of each respective LSTM unit is passed through an attention layer to identify feature correlations between hidden states at different time steps corresponding to different ones of the different acoustic windows.

Sequence models for audio scene recognition

Systems and methods for optimizing query execution to improve query processing by a computer are provided. A query is analyzed and translated into a logical plan. A runtime query optimizer is applied to the logical plan to identify a physical plan including operators for execution. The logical plan is translated into the physical plan. Execution of the query is scheduled according to the physical plan.

Optimizations for a behavior analysis engine

Methods and systems for mitigating a spoofing-based attack include calculating a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live information from the received packet. An expected travel distance between the source IP address and the target IP address is estimated based on a sparse set of known source/target distances. It is determined that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security action is performed responsive to the determination that the received packet has a spoofed source IP address.

Neural network based spoofing detection

Growing community of inventors

Princeton Junction, NJ, United States of America

Cristian Lumezanu