Micro Focus Lcc

Interset Software, Inc.

Maria Pospelova

Shaun Pilkington

Stephan F Jou

Martin Arlitt

Manish Marwah

Ross Diener

Venkatesh HariRama Subbu

Asad Narayanan

A system includes a processor and a memory coupled with and readable by the processor and storing therein a set of instructions. When executed by the processor, the processor is caused to receive application events associated with an application and create data records based on the application events. The processor is further caused to compute an interestingness value for each of the data records based on a goal of the application, assign the computed interestingness value to each of the data records and store each of the data records with the assigned interestingness value.

Systems and methods for entity interestingness-based retention and removal

An apparatus may include a processor that may be caused to access a distribution of a plurality of values, each value of the plurality of values quantifying an event of an event type in a computer network. The processor may determine a mean of the plurality of values and a second highest value of the plurality of values, generate an expected maximum of the distribution based on the mean and the second highest value, and access a first value quantifying a first event of the event type in the computer network. The processor may further determine that the first event is an anomalous event based on the first value and the expected maximum.

Efficient determination of expected maximum for anomaly detection

First-order anomaly scores are received from related anomaly detectors. Each first-order anomaly score indicates a likelihood of an anomaly at a target system. A relatedness measure of the related anomaly detectors is determined, based on the first-order anomaly scores that have been received. A higher-order anomaly score is determined based on the relatedness measure that has been determined. The higher-order anomaly score indicates a likelihood of an anomaly at the target system. An anomaly at the target system is detected based on the higher-order anomaly score.

Anomaly detection based on higher-order anomaly score

Humans as well as non-human actors may interact with computer devices on a computer network. As described herein, it is possible to train and apply human vs. non-human detection models to provide an indication of the probability that a human or a non-human actor was interacting with a computer device during a particular time period. The probability that a human or non-human was interacting with computers during a particular time may be used to improve various actions, including selecting one or more different threat detection models to apply during the particular time, selecting data to use with threat detection models during the time, or selecting data from the particular time to store.

Growing community of inventors

Ottawa, Canada

Maria Pospelova