International Business Machines Corporation

Microsoft Technology Licensing, LLC

Globalfoundries Inc.

Elad Yom-Tov

David Carmel

Hani Neuvirth-Telem

Yossi Richter

Aviad Zlotnick

Haggai Roitman

Zorik Machulsky

Hani Hana Neuvirth

Shai Fine

Daniel Alon

Shmuel Ur

Royi Ronen

Liane Lewin-Eytan

Avi Ziv

Gidon Gershinsky

Konstantin Shagin

Yoav Avraham Katz

Michal Rimon

Amit Hilbuch

Adam Darlow

Yehuda Finkelstein

Shay Baruch Nahum

Eric J Horvitz

Ryen William White

Richard Edwin Harper

Gueorgui Chkodrov

Dan S Pelleg

Yotam Livny

Noam Slonim

Dotan Patrich

Scott Joseph Counts

Hadas Bitran

Asaf Adi

Yariv Aridor

Philip Newman

Rachel Tzoref

Sivan Yogev

Ron Matchoro

Dawn Antonette Burns

Einat Amitay

Aviad Tsherniak

Sivan Sabato

Naama Zwerdling

Amit Sebastian Hilbuch

Ori Kashi

Daniel Alon Hilevich

Omer Chechik

Munmun De Choudhury

Nir Rosenfeld

Eran Gat

Moshe Goldstine

Lawrence Adam Darlow

Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Anomaly lookup for cyber security hunting

A system includes identification of a data source of a production environment, the data source storing authentic data, generation of simulated data of the data source, reception of a request for data of the data source from a requesting system in the production environment and, in response to the received request, providing of the simulated data to the requesting system. In some aspects, the simulated data is provided to the requesting system if it is determined that the request is related to an electronic attack, and the authentic data of the data source is provided to the requesting system if it is not determined that the request is related to an electronic attack.

Data generation for data protection

A computer-implemented filtering method comprising: receiving a set of propositions, each comprising a respective linguistic description expressed by a respective user; forming an input matrix of lexical components vs. propositions, wherein rows in the input matrix represent the propositions and columns in the input matrix represent lexical components in the respective descriptions; performing a matrix factorization on the input matrix to reveal latent clusters of the lexical components and/or propositions; filtering the set of propositions based on one or more of the latent clusters; and outputting a result of the filtering to a target user.

Filtering of large sets of data

A system for identifying abnormal resource usage in a data center is provided. In some embodiments, the system employs a prediction model for each of a plurality of resources and an abnormal resource usage criterion. For each of a plurality of resources of the data center, the system retrieves current resource usage data for a current time and past resource usage data for that resource. The system then extracts features from the past resource usage data for that resource, predicts using the prediction model for that resource usage data for the current time based on the extracted features, and determines an error between the predicted resource usage data and the current resource usage data. After determining the error data for the resources, the system determines whether errors satisfy the abnormal resource usage criterion. If so, the system indicates that an abnormal resource usage has occurred.

Detection of abnormal resource usage in a data center

In an example embodiment, a computer-implemented method comprises obtaining labels from messages associated with an email service provider, wherein the labels indicate for each message IP how many spam and non-spam messages have been received; obtaining network data features from a cloud service provider; providing the labels and network data features to a machine learning application; generating a prediction model representing an algorithm for determining whether a particular set of network data features are spam or not; applying the prediction model to network data features for an unlabeled message; and generating an output of the prediction model indicating a likelihood that the unlabeled message is spam.

Spam classification system based on network flow data

A system for detecting an attack by a virtual or physical machine on one or more auto-generated websites is provided. The system includes a processor, a memory, and an application. The application is stored in the memory and includes instructions, which are executable by the processor. The instructions are configured to: access an index of a search engine server computer and determine uniform resource locators (URLs) of auto-generated websites, where the auto-generated websites include the one or more auto-generated websites; and access Internet protocol (IP) address-URL entries stored in a domain name system server computer. The instructions are also configured to: determine a first feature based on the URLs of the auto-generated websites and the IP address-URL entries; collect header data of packets transmitted to or received from the virtual or physical machine; determine a second feature based on the first feature and the header data; based on the second feature, generate a value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites; and perform a countermeasure based on the value.

Systems and methods for detecting an attack on an auto-generated website by a virtual machine

A system for providing care to a ward that alerts a caregiver of the caregiver's capacity to deal competently with the ward's needs.

Caregiver monitoring system

The subject disclosure is directed towards monitoring user behavior on a computerized device for any deviation from normal or acceptable behavior that is likely to affect the user's mental state. A prediction model corresponding to features of one or more mental states may be compared with features based upon current user behavior. If the user's current behavior presents a mental state indicative of an uncharacteristic deviation from the normal or acceptable behavior, descriptive data associated with that mental state may be presented to the user in addition to a trusted individual, such as a health care professional.

User behavior monitoring on a computerized device

A computer-implemented method, an apparatus and a computer program for automatically extracting useful information for functional verification. The method comprising performing repeatedly both operating an instruction generator associated with a Design Under Test (DUT), whereby a generated instruction is determined, the generated instruction having one or more instruction attributes; and collecting information relating to the generated instruction. Based on the generated instruction and the collected information, a classification technique is utilized to classify the information based on the instruction attributes.

Automatic identification of information useful for generation-based functional verification

An advanced metering infrastructure comprises intermediate nodes. The intermediate nodes receive data from child nodes and relay a subset of the data that is not according to an expected value. The expected value may be determined based on a forecasting function computed based on past data. The expected value may be a spatial shape in an n-dimension space. A data not within the spatial shape may be considered not in accordance with the expected value. In some case, the spatial shape is defined by a centroid and a radius. The spatial shape may shift over time based on a consumption profile, such as low consumption at noon, and high consumption at evening. The consumption profiles may be determined in a learning phase, as well as shifting of spatial shapes of each group over time.

Data forecasting in a multi-node system

An advanced metering infrastructure comprises intermediate nodes. The intermediate nodes receive data from child nodes and aggregate the data according to groups of child nodes. The aggregation provides for a reduced version of the data. The reduction is performed based on groups determined by clustering. The reduced version of the data comprises data describing a group of measurements over time, such as a centroid in an n-dimension space, number of customers in the group, radius of the group and the like. The centroid may shift over time based on a consumption profile, such as low consumption at noon, and high consumption at evening. The consumption profiles may be determined in a learning phase, as well as shifting of centroids of each group over time.

Data reduction in a multi-node system

Systems and methods for generating a storage policy for a storage system are provided. The method comprises receiving a target function applicable to a storage system having one or more data storage mediums, wherein the target function represents values for storage parameters associated with productivity or loss tolerance in the storage system; implementing one or more simulation rules according to the received target function; generating one or more storage operation requests to access data on said one or more data storage mediums based on said one or more simulation rules; submitting said one or more storage operation requests to the storage system for processing; analyzing simulation results obtained for the storage system, in response to the storage system processing said one or more storage operation requests; and generating one or more storage policies, by a machine learning entity, in response to analyzing the simulation results.

Storage policy evaluation in a computing environment

A novel and useful method for enabling system logs to be effectively and efficiently monitored by ranking the system log messages by their estimated value to administrators and generating a log view that displays the most important messages. The ranking process uses a dataset of system logs from many computer systems to score messages. For better scoring, unsupervised clustering is used to identify sets of systems that behave similarly. The expected distribution of messages in a given system is estimated using the resulting clusters, and log messages are scored using this estimation.

Apparatus for and method of implementing system log message ranking via system behavior analysis

Growing community of inventors

Hoshaya, Israel

Elad Yom-Tov