Microsoft Technology Licensing, LLC

Dmitry Starostin

Alexey V Orlov

Eldar Akchurin

Thomas Minka

Alexander Armin Spengler

Alexandre De Baynast

Vitaly V Filimonov

Joris Claessens

Panagiotis Periorellis

Aleksandr Klimov

Examining time series sequences representing performance counters from executing programs can provide significant clues about potential malfunctions, busy periods in terms of traffic on networks, intensive processing cycles and so on. An unsupervised anomaly detector can detect anomalies for any time series. A combination of known techniques from statistics, signal processing and machine learning can be used to identify outliers on unsupervised data, and to capture anomalies like edge detection, spike detection, and pattern error anomalies. Boolean and probabilistic results concerning whether an anomaly was detected can be provided.

Unsupervised anomaly detection for arbitrary time series

An approach is described for controlling access to a data item using one or more access graphs. The approach entails distributing a compact package of access-related information to a recipient that pertains to the access graphs. The recipient can use the access-related information to access the data item through the access graphs in an off-line mode of operation. In one implementation, the access-related information includes markers associated with edges between nodes in the access graphs. One type of marker can link the data item to two or more nodes of the access graphs. This type of marker can be used to implement a logical AND operation among two or more policy factors.

Providing access to a data item using access graphs

Information rights management (IRM) systems enable information to be protected after it has been accessed by or delivered to an authorized individual. For example, this might be to allow an email to be viewed for a limited time by specified individuals but to prevent that email from being forwarded. However, existing IRM systems are limited in the situations in which they may operate. An IRM server is provided which communicates with one or more policy evaluators which are independent of the IRM server. Results from the different policy evaluators may be combined by the IRM server and one or more identity providers may be used in conjunction with each policy evaluator. By enabling the IRM server to act as a broker between authors, recipients and policy evaluators situations in which IRM systems may operate are greatly extended.

Information rights management

Growing community of inventors

Aachen, Germany

Dmitry Starostin