Nec Corporation

Nec Laboratories America, Inc.

Nec C Orporation

Guofei Jiang

Hui Joyce Zhang

Haifeng Chen

Kenji Yoshihira

Zhichun Li

Junghwan Rhee

Nipun Arora

Cristian Lumezanu

Zhenyu Wu

Yueping Zhang

Jianwu Xu

Zhengzhang Chen

LuAn Tang

Vishal Kumar Singh

Biplob Kumar Debnath

Kai Zhang

Abhishek Sharma

Wei Cheng

Bo Zong

Kangkook Jee

Min Ding

Qiang Xu

Xusheng Xiao

Xia Ning

Dongjin Song

Atul Singh

Jungwhan Rhee

Akhilesh Saxena

Yuseok Jeon

Ye Wang

Zhiyun Qian

Curtis Yu

Renqiang Min

Franjo Ivancic

Cristian Ungureanu

Ding Li

Jiaping Gui

Mu Zhang

Tan Yan

Ya-Yunn Su

Pallavi Joshi

Hengtong Zhang

Xiaoqiao Meng

Cheng Jin

Yao Qin

Ke Zhang

Peng Gao

Ting Wang

Kai Chen

Lei Xu

Kai Ma

Jingchao Ni

Sriram Sankaranarayanan

Xiao Yu

Vasileios Kemerlis

Chung Hwan Kim

Lauri Korts-Parn

Jun Wang

Long Lu

Ying Lin

Yangchun Fu

Xiao Bian

Qi Song

Hancheng Ge

Fengyuan Xu

Qiang Zeng

Hui Lu

Hongteng Xu

Kangjie Lu

Yixin Sun

Bin Liu

Anupam Das

Hanhuai Shan

Myoungku Song

Tingyang Xu

Yong Ge

Ahsan Arefin

Richard Chang

Boxiang Dong

Hui Kang

Chunxiao Li

Wenxuan Zhang

Yu Ru

Hossein Hamooni

Hyun-Wook Baek

Jianjun Huang

Zhuotao Liu

Kyriakos Zanfis

Behnaz Arzani

Masoud Akhoondi

Markus Kusano

Om Prasad Patri

Hui Zhang

Vishal Singh

A computer-implemented method for simultaneous metric learning and variable selection in non-linear regression is presented. The computer-implemented method includes introducing a dataset and a target variable, creating a univariate neighborhood probability map for each reference point of the dataset, and determining a pairwise distance between each reference point and other points within the dataset. The computer-implemented method further includes computing a Hessian matrix of a quadratic programming (QP) problem, performing optimization of the QP problem, re-weighing data derived from the optimization of the QP problem, and performing non-linear regression on the re-weighed data.

Mining non-linear dependencies via a neighborhood mixture model

Systems and methods are disclosed for parsing logs from arbitrary or unknown systems or applications by capturing heterogeneous logs from the arbitrary or unknown systems or applications; generating one pattern for every unique log message; building a pattern hierarchy tree by grouping patterns based on similarity metrics, and for every group it generates one pattern by combing all constituting patterns of that group; and selecting a set of patterns from the pattern hierarchy tree.

Fast pattern discovery for log analytics

A computer-implemented method for automatically analyzing log contents received via a network and detecting content-level anomalies is presented. The computer-implemented method includes building a statistical model based on contents of a set of training logs and detecting, based on the set of training logs, content-level anomalies for a set of testing logs. The method further includes maintaining an index and metadata, generating attributes for fields, editing model capability to incorporate user domain knowledge, detecting anomalies using field attributes, and improving anomaly quality by using user feedback.

Content-level anomaly detection for heterogeneous logs

Systems and methods for time series prediction are described. The systems and methods include encoding driving series into encoded hidden states, the encoding including adaptively prioritizing driving series at each timestamp using input attention, the driving series including data sequences collected from sensors. The systems and methods further includes decoding the encoded hidden states to generate a predicting model, the decoding including adaptively prioritizing encoded hidden states using temporal attention. The systems and methods further include generating predictions of future events using the predicting model based on the data sequences. The systems and methods further include generating signals for initiating an action to devices based on the predictions.

Dual stage attention based recurrent neural network for time series prediction

A heterogeneous log pattern editing recommendation system and computer-implemented method are provided. The system has a processor configured to identify, from heterogeneous logs, patterns including variable fields and constant fields. The processor is also configured to extract a category feature, a cardinality feature, and a before-after n-gram feature by tokenizing the variable fields in the identified patterns. The processor is additionally configured to generate target similarity scores between target fields to be potentially edited and other fields from among the variable fields in the heterogeneous logs using pattern editing operations based on the extracted category feature, the extracted cardinality feature, and the extracted before-after n-gram feature. The processor is further configured to recommend, to a user, log pattern edits for at least one of the target fields based on the target similarity scores between the target fields in the heterogeneous logs.

Recommender system for heterogeneous log pattern editing operation

Systems and methods for anomaly detection in complex physical systems, including extracting features representative of a temporal evolution of the complex physical system, and analyzing the extracted features by deriving vector trajectories using sliding window segmentation of time series, applying a linear test to determine whether the vector trajectories are linear, and performing subspace decomposition on the vector trajectory based on the linear test. A system evolution model is generated from an ensemble of models, and a fitness score is determined by analyzing different data properties of the system based on specific data dependency relationships. An alarm is generated if the fitness score exceeds a predetermined number of threshold violations for the different data properties.

Data analytic engine towards the self-management of complex physical systems

A system and method are provided for identifying security risks in a computer system. The system includes an event stream generator configured to collect system event data from the computer system. The system further includes a query device configured to receive query requests that specify parameters of a query. Each query request includes at least one anomaly model. The query request and the anomaly model are included in a first syntax in which a system event is expressed as {subject-operation-object}. The system further includes a detection device configured to receive at least one query request from the query device and continuously compare the system event data to the anomaly models of the query requests to detect a system event that poses a security risk. The system also includes a reporting device configured to generate an alert for system events that pose a security risk detected by the detection device.

System and method for detecting security risks in a computer system

Methods for querying a database and database systems include optimizing a database query for parallel execution using spatial and temporal information relating to elements in the database, the optimized database query being split into sub-queries with sub-queries being divided spatially according to host and temporally according to time window. The sub-queries are executed in parallel. The results of the database query are outputted progressively.

Progressive processing for querying system behavior

Systems and a method are provided. A system includes a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor. The TBQL server configured to construct a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction. The TBQL server is further configured to execute the TBQL query to generate TBQL query results.

Risky behavior query construction and execution

Automated security systems and methods include a set monitored systems, each having one or more corresponding monitors configured to record system state information. A progressive software behavioral query language (PROBEQL) database is configured to store the system state information from the monitored systems. A query optimizing module is configured to optimize a database query for parallel execution using spatial and temporal information relating to elements in the PROBEQL database. The optimized database query is split into sub-queries with sub-queries being divided spatially according to host and temporally according to time window. A parallel execution module is configured to execute the sub-queries on the PROBEQL database in parallel. A results module is configured to output progressive results of the database query. A security control system is configured to perform a security control action in accordance with the progressive results.

Security monitoring with progressive behavioral query language databases

A computer-implemented method, computer program product, and computer processing system are provided. The method includes preprocessing, by a processor, a set of heterogeneous logs by splitting each of the logs into tokens to obtain preprocessed logs. Each of the logs in the set is associated with a timestamp and textual content in one or more fields. The method further includes generating, by the processor, a set of regular expressions from the preprocessed logs. The method also includes performing, by the processor, an unsupervised parsing operation by applying the regular expressions to the preprocessed logs to obtain a set of parsed logs and a set of unparsed logs, if any. The method additionally includes storing, by the processor, the set of parsed logs in a log analytics database and the set of unparsed logs in a debugging database.

Structure-level anomaly detection for unstructured logs

Systems and methods are disclosed for detecting periodic event behaviors from machine generated logging by: capturing heterogeneous log messages, each log message including a time stamp and text content with one or more fields; recognizing log formats from log messages; transforming the text content into a set of time series data, one time series for each log format; during a training phase, analyzing the set of time series data and building a category model for each periodic event type in heterogeneous logs; and during live operation, applying the category model to a stream of time series data from live heterogeneous log messages and generating a flag on a time series data point violating the category model and generating an alarm report for the corresponding log message.

Periodicity analysis on heterogeneous logs

Methods and systems for detecting a system fault include determining a network of broken correlations for a current timestamp, relative to a predicted set of correlations, based on a current set of sensor data. The network of broken correlations for the current timestamp is compared to networks of broken correlations for previous timestamps to determine a fault propagation pattern. It is determined whether a fault has occurred based on the fault propagation pattern. A system management action is performed if a fault has occurred.

Content-aware anomaly detection and diagnosis

Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.

Automated blackbox inference of external origin user behavior

A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.

Host level detect mechanism for malicious DNS activities

Growing community of inventors

Princeton, NJ, United States of America

Guofei Jiang