Microsoft Technology Licensing, LLC

Gong I.o Ltd.

Mellanox Technologies, Ltd.

Hanan Shteingart

Royi Ronen

Eilon Reshef

Tomer Teller

Yair Tor

Zohar Shay

Eli Koreh

Amit Hilbuch

Yifat Schacter

Eitan Zahavi

Ariel Nicolas Gordon

Moshe Israel

Hani Neuvirth-Telem

Daniel Alon

Omri Allouche

Jean-Francois Puget

Shlomi Medalion

Jonathan Gazit

Inbal Horev

Gary Mataev

Mathias Scherman

Vlad Korsunsky

Yuri Gabaev

Shai Baruch Nahum

Oleg Yanovsky

Yoav Madorsky

Zachi Binshtock

Yoli Shavit

Methods, systems, and machine-readable mediums to perform a neural network to encode log data. In at least one embodiment, a processor comprising one or more circuits to encode at least one log message, at least in part, by encoding a first type of information in the at least one log message to obtain a first encoding, encoding a second type of information in the at least one log message to obtain a second encoding, and obtaining a resultant encoding at least in part by combing at least the first and second encodings.

Using neural networks to encode log data

A method for audio processing includes receiving a recording of a teleconference among multiple participants over a network, including an audio stream containing speech uttered by the participants and information outside the audio stream. The method further includes processing the audio stream to identify speech segments interspersed with intervals of silence, extracting speaker identifications from the information outside the audio stream in the received recording, labeling a first set of the identified speech segments from the audio stream with the speaker identifications, extracting acoustic features from the speech segments in the first set, learning a correlation between the speaker identifications labelled to the segments in the first set and the extracted acoustic features, and labeling a second set of the identified speech segments using the learned correlation, to indicate the participants who spoke during the speech segments in the second set.

Metadata-based diarization of teleconferences

A method for information processing includes computing, over a corpus of conversations, a conversation structure model including (i) a sequence of conversation parts having a defined order, and (ii) a probabilistic model defining each of the conversation parts. For a given conversation, a segmentation of the conversation is computed based on the computed conversation structure model. Action is taken on the given conversation according to the segmentation.

Unsupervised automated extraction of conversation structure from recorded conversations

A method for audio processing includes receiving, in a computer, a recording of a teleconference among multiple participants over a network including an audio stream containing speech uttered by the participants and conference metadata for controlling a display on video screens viewed by the participants during the teleconference. The audio stream is processed by the computer to identify speech segments, in which one or more of the participants were speaking, interspersed with intervals of silence in the audio stream. The conference metadata are parsed so as to extract speaker identifications, which are indicative of the participants who spoke during successive periods of the teleconference. The teleconference is diarized by labeling the identified speech segments from the audio stream with the speaker identifications extracted from corresponding periods of the teleconference.

Disclosed herein is a system and method that can be used with any underlying classification technique. The method receives a test dataset and determines the features in that test dataset that are present. From these features the training dataset is modified to only have those features that are present in the test dataset. This modified test dataset is then used to calibrate the classifier for the particular incoming data set. The process repeats itself for each different incoming dataset providing a just in time calibration of the classifier.

Just in time classifier training

Controlling device security includes obtaining a set of device activity data indicating current device activity on a device and a set of user activity data indicating a current activity state of one or more legitimate users of the device. It is determined whether the indicated current activity state of the users indicates that a legitimate user is in an active state on the device, or that none of the legitimate users is in an active state on the device. A statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, is determined, by a comparison with at least one of the models that are generated via supervised learning. A security alert action may be initiated, based on a result of the determination of the statistical fit indicating a compromised state of the device.

Detection of compromised devices via user states

Systems, methods, and computer-readable storage media are provided for authenticating users to secure services or apps utilizing reversed, hands-free and/or continuous two-factor authentication. When a user desires to access a secure service or app for which s/he is already registered, the user, having a registered mobile computing device in proximity to his or her presence, comes within a threshold distance of a computing device that includes the desired secure service or app. The computing device authenticates the particular mobile computing device as associated with the particular registered user that utilized that mobile device during registration. Subsequent to such device authentication, the user is able to login to the service or app by simply providing his or her user credentials at a login form associated therewith. Two-factor authentication in accordance with embodiments hereof is more secure and more efficient that traditional authentication methodologies.

Two-factor authentication

Disclosed herein is a system and method that can be used with any underlying classification technique. The method takes into account both the value of the current feature vector. It is based on evaluating the effect of perturbing each feature by bootstrapping it with the negative samples and measuring the change in the classifier output. To assess the importance of a given feature value in the classified feature vector, a random negatively labeled instance is taken out of the training set and replaces the feature at question with a corresponding feature from this set. Then, by classifying the modified feature vector and comparing its predicted label and classifier output a user is able measure and observe the effect of changing each feature.

Reasoning classification based on feature pertubation

Detecting a volumetric attack on a computer network with fewer false positives and while also requiring fewer processing resources is provided. The systems and methods described herein use observations taken at the network level to observe network traffic to form a predictive model for future traffic. When the network's future traffic sufficiently exceeds the predictive model, the monitoring systems and methods will indicate to the network to take security measures. The traffic to the network may be observed in subsets, corresponding to various groupings of sources, destinations, and protocols so that security measures may be targeted to that subset without affecting other machines in the network.

Detecting volumetric attacks

One embodiment illustrated herein includes a computer implemented method. The method includes acts for training an amplification attack detection system. The method includes obtaining a plurality of samples of IPFIX data. The method further includes using the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds. The method further includes identifying a plurality of the server samples that are labeled positive for amplification attacks. The method further includes identifying a plurality of server samples that are labeled negative for amplification attacks. The method further includes automatically labeling at least some of the remaining server samples as positive or negative based on the previously identified labeled samples. The method further includes using the automatically labeled samples to train an amplification attack detection system.

IPFIX-based detection of amplification attacks on databases

Growing community of inventors

Herzliya, Israel

Hanan Shteingart